Do small businesses need to document "AI literacy"? Here is what actually holds up

Search for "Article 4 AI literacy" right now and you will find a dozen Norwegian websites telling you the same thing: every business must document that its staff have had AI training, the fines run to several million euros, and the deadline was yesterday. Several of them sell courses that solve exactly this problem.

Most of that is inaccurate. Not a lie, but stretched far beyond what the law actually says, and written by people who make money from you being worried. Here is what actually holds up, checked against the legal text, the Norwegian Parliament's own EU/EEA updates and a peer-reviewed legal review.

The short answer

No, not as a statutory documentation requirement in Norway. Not yet. The regulation it rests on is not Norwegian law. And even in the EU, where it does apply, the requirement was just made milder than it was three weeks ago.

That does not mean you should do nothing. It means you should do the right thing, at the right pace, for the right reasons. Not because a course-selling company told you it was urgent.

What Article 4 actually says

Article 4 of the EU AI Act is the provision on "AI literacy": providers and deployers of AI systems are to ensure that staff who use the tools have sufficient competence to use them responsibly. It applies whether or not the tool is high risk, and therefore also to an entirely ordinary business using ChatGPT or Copilot.

What is new, and what very few of the Norwegian guide pages have picked up on: on 27 July 2026 the EU's Digital Omnibus on AI came into force, Regulation (EU) 2026/1744, and it rewrites Article 4 completely. The original text obliged organisations to "ensure, to the extent possible, a sufficient level of competence". After the rewrite the duty instead reads that organisations shall "take measures to support the development" of such competence. The law also states explicitly that this involves no obligation to guarantee a particular level of competence in any individual. A separate paragraph requires the European Commission and member states to support small and medium-sized businesses in this work specifically.

In short: from an obligation of result to an obligation of effort, three weeks before most of the Norwegian guides were written.

One thing the omnibus did not change: national supervisory authorities in the EU only began genuine supervision of Article 4 in August 2026. Until then the provision had formally been in force since 2 February 2025, without anyone actively enforcing it.

Does this apply in Norway at all right now?

No. That is the most important point in this article, and it is also the point that drowns in fear-selling content.

The AI Act has been assessed as EEA-relevant, but it has not yet been incorporated into the EEA Agreement — and therefore is not Norwegian law. The Norwegian Parliament's own EU/EEA bulletin wrote in June 2026 that the timing of incorporation remains unclear. Karianne Tung, Norway's Minister of Digitalisation and Public Governance, has confirmed to NTB that the government aims to send the amendments out for consultation in autumn 2026, with the goal of putting a bill before the Norwegian Parliament in spring 2027. A bill, that is, not a finished law. Progress depends on negotiations with the EU on the necessary EEA adaptations, the minister writes.

Nor is there any direct parallel to Article 4 in Norwegian law today. A review in the Norwegian legal journal Lov & Data concludes that the provision "has no parallel in Norwegian legislation today", and points out that the duty is in any case limited in purpose — it is not intended as general public education, but as a precondition for the people who actually use or are affected by an AI system to make informed judgements about it.

One exception is worth noting: if your organisation operates into the EU market, supplies EU customers or has staff physically in an EU country, you may already be directly covered by the EU regulation itself, regardless of the fact that it is not yet Norwegian law. For a purely Norwegian small business using AI internally, this is rarely the situation.

Why "documentation requirement" is an overstatement, for now

Several commercial operators describe Article 4 as though it imposes a specific documentation regime: completed courses, certificates with QR codes, archived training logs ready to show an inspector. That is a description of what might be sensible to have, not of what the legal text actually requires.

Neither the original text nor the rewritten July 2026 version of Article 4 specifies a documentation format. What the EU's own guidance material says is that supervisory authorities will look for proportionate, role-specific evidence that something has been done, not one particular form. And the law is explicit about proportionality: the requirement is to take account of the individual's technical knowledge, experience and education, and of the context the AI system is used in. A small business with ten employees using Copilot to draft text is not to be judged by the same standard as a bank using AI in credit assessment.

There is no reason to think Norwegian implementation, when it comes, will be stricter than the EU text it is built on.

What already applies to you today

This is not the same as saying you can avoid thinking about it. Two sets of rules apply in full in Norway already, and they cover much of the same ground:

Section 4-2 of the Norwegian Working Environment Act requires the employer to provide necessary training when new systems are introduced. That applies whether or not the system is AI-based. And if an AI tool processes personal data, which most language model tools do in practice, the Norwegian Personal Data Act and the GDPR apply in full, with requirements for a documented legal basis and an assessment of risk.

We have gone through both of these in more depth in an earlier article on whether your organisation needs an AI policy.

What we actually recommend

Not because the law forces you to yet, but because it is cheap, sensible and already expected of you under other regulation.

Write down, in a few sentences, which AI tools you use and for what. Give staff a short, practical walkthrough of what the tool can and cannot do. Particularly that it can be wrong with great confidence. Note the date you did it. It is neither a certificate nor a QR code. It is three sentences showing that somebody has thought it through, and something you can build on when the regulation actually lands in Norway. And it is going to.

Frequently asked questions