AI literacy under the AI Act: how to train fashion teams and document it
Article 4 has applied since February 2025 and was softened by the AI Omnibus. What fashion companies must now do, who needs training and how to keep a defensible record.
KEY TAKEAWAYS Summary by the editors
- Article 4 of the EU AI Act has required providers and deployers of AI systems to address AI literacy among their staff since 2 February 2025.
- The AI Omnibus amended Article 4 so that companies must take measures to support the development of AI literacy, rather than ensure a specific level for each person.
- The European Commission states that no certificate is needed and that an internal record of training and other initiatives is sufficient documentation.
- AI literacy measures should cover a general understanding of AI, the company's role as developer or user, and the risks of the specific systems staff use.
- Staff overseeing high-risk AI systems must still have the necessary competence, training and authority under Article 26.
Every fashion company that uses AI systems in the EU has had an AI literacy duty since 2 February 2025. After the AI Omnibus, the obligation is to take measures that support a sufficient level of AI literacy among staff and others using AI on the company's behalf, without a mandated level per person. In practice that means a role-based training plan, proportionate to the risks of the tools in use, and an internal record that it happened.
What does Article 4 require after the AI Omnibus?
The original text asked providers and deployers to ensure a sufficient level of AI literacy. The AI Omnibus, in force since 27 July 2026, changed this to a duty to take measures to support the development of AI literacy, according to White & Case. The Commission's AI literacy Q&A confirms that no specific or "sufficient" level is now mandated, and that the Commission and member states will support companies with practical examples.
The duty has not disappeared. Measures must take account of staff's technical knowledge, experience, education and training and the context in which AI is used. National market surveillance authorities supervise compliance, and the Commission notes that a lack of appropriate training could make enforcement more likely after an incident.
Who in a fashion company needs AI literacy training?
The Commission says Article 4 covers staff and other persons dealing with AI systems on the company's behalf, which can include contractors and service providers. In fashion, the groups differ widely in how they use AI:
| Group | Typical AI use | Literacy focus |
|---|---|---|
| Executives and board | Approving AI investments and policies | Risk categories, accountability, what the company will not do |
| Design and product development | Image generation, trend analysis | IP and training data questions, labelling of synthetic content |
| Marketing and e-commerce | Copy and image generation, chatbots, personalisation | Article 50 disclosure, deepfake test, brand and accuracy review |
| Merchandising and planning | Forecasting and allocation tools | Reading model output critically, data quality, override rules |
| Wholesale and sales teams | AI-assisted order proposals and buyer communication | Checking recommendations, confidentiality of partner data |
| HR and store management | Screening, scheduling, performance tools | High-risk use, human oversight, prohibited emotion recognition |
| Customer service | Chatbots and agent assist | Escalation to humans, handling personal data, error spotting |
What should the training cover?
The Commission suggests a minimum content that maps neatly onto a fashion programme:
- General understanding of AI: what AI is, how it works, which AI the company uses, and its opportunities and risks.
- The company's role: whether it develops AI systems or uses systems built by others, since obligations differ.
- Risks of the systems in use: what staff need to know about each tool, typical failure modes such as fabricated answers or biased rankings, and how to mitigate them.
- Legal and ethical aspects: encouraged rather than required, and useful where tools touch personal data, copyright or employment.
A practical format is a short company-wide baseline module, followed by role-specific sessions tied to the tools each team actually uses. Training on a tool should happen before staff get access, not after rollout.
How do you document AI literacy?
Because the duty is now about measures, documentation should show that the company assessed needs and acted on them. A defensible file usually contains:
- An AI inventory linking each system to the teams that use it.
- A training needs assessment by role, referencing the risk of each tool.
- Training materials and dates, with attendance records kept in the learning management system.
- Supporting measures such as usage guidelines, prompt libraries, internal help channels and escalation routes.
- A review cycle, for example when a new tool is introduced or after an incident.
- Contractor provisions where agencies or freelancers use AI on the company's behalf.
How often should AI literacy measures be refreshed?
The Act sets no fixed interval, so the trigger should be change rather than the calendar. Sensible moments for an update are the introduction of a new tool, a significant change in an existing one, a move of a team into a new use case, and any incident or near miss. Generative tools in particular change quickly: features that did not exist when staff were trained, such as agents that act on a user's behalf or image tools that edit real photographs, may need a short addendum within months.
Contractors and agencies deserve explicit treatment. The Commission's Q&A notes that service providers acting on the company's behalf can fall within the scope of Article 4, depending on the type of system and the risk. A design studio generating imagery, a content agency writing product copy or an outsourced customer service team using AI on the brand's behalf should either receive the relevant guidance or confirm in the contract that their staff have appropriate AI skills for the task. A short clause and a copy of the company's usage guidelines are usually enough for low-risk work.
What extra applies to high-risk AI?
The softening of Article 4 does not reach the high-risk rules. The Commission notes that the obligation to train staff for human oversight remains for high-risk deployers. Article 26 requires deployers to assign oversight to people with the necessary competence, training and authority. For fashion, that mainly concerns HR systems used for recruitment, task allocation or worker monitoring, whose high-risk obligations apply from 2 December 2027.
What are the limits of training?
Training alone does not make an AI tool safe. Staff can only spot errors if they have time and authority to check outputs, and if the process gives them a way to override a recommendation. Literacy programmes work best alongside clear usage policies, sensible defaults in the tools themselves and leadership that accepts slower adoption where checking is needed. The aim is competent use, not a completion rate.
Frequently asked questions
Is AI literacy training mandatory under the EU AI Act?
Companies that provide or deploy AI systems must take measures to support AI literacy among staff and others using AI on their behalf. Since the AI Omnibus, no specific level is mandated, but the duty has applied since 2 February 2025.
Do employees need an AI Act certificate?
No. The European Commission states that no certificate is required. An internal record of training and other initiatives is sufficient.
Who enforces the AI literacy obligation?
National market surveillance authorities, not the EU AI Office. Penalties are set under national law and must be proportionate.
What should AI literacy training include?
The Commission suggests a general understanding of AI, the company's role as developer or user, and the risks of the specific systems staff use, adapted to their knowledge and context.
One edition every weekday morning. Read in five minutes. Free for industry professionals.
