Is AI training mandatory for companies in Spain?

The short answer is yes. Article 4 of Regulation (EU) 2024/1689 has applied since 2 February 2025 and still binds any company whose staff use AI. The long answer carries a nuance almost nobody is reporting: the Digital Omnibus did not only defer the high-risk regime, it also rewrote this article.

Who it binds

The article addresses providers and deployers. The second is the surprise: you are a deployer if you use an AI system under your authority, even if someone else built it. You need not develop anything. It is enough that your sales team drafts proposals with an assistant, that HR screens CVs with a tool that embeds AI, or that support runs a chatbot.

Nor does it cover employees alone. The text speaks of staff and "other persons dealing with the operation and use of AI systems on their behalf": interns, contractors working for you, and in many setups external vendors operating your tools.

What changed on 27 July 2026

Until that date the article asked you to "ensure a sufficient level" of literacy. It was an obligation of result: you were measured by where your staff ended up. Since then it asks you to "take measures to support the development" of that literacy, and adds an express clarification: it does not require guaranteeing any specific level of AI literacy of any individual.

That is a shift from an obligation of result to an obligation of means, and it softens things less than it appears: it moves them. You no longer answer for whether your salesperson understood algorithmic bias; you answer for what you did about it, for whom, and on what basis. What used to be shown with a test is now shown with a record of measures.

Which measures count as appropriate

The regulation still sets no syllabus, no hour count and no exam. What it gives are proportionality criteria, and they are the same as before: technical knowledge, experience, education and context of use.

• Proportionate to risk: someone using a writing assistant does not need what someone operating a CV-screening tool needs.
• Proportionate to role: leadership, HR and technical profiles carry different exposure and deserve different tracks.
• Documented: a measure you cannot date or attribute to anyone is, in practice, a measure you did not take.

What it is not

There is no official AI-literacy certification, and no register of bodies authorised to deliver it. Article 4 places a duty on the company; it does not create a regulated training market. Anyone selling you an "AI Act certification" is selling something that does not exist.

Nor does it carry a fine of its own: the Article 99 penalty regime does not list it. The Commission has indicated that breaching it works as an aggravating factor inside a larger proceeding, not as a standalone sanction. That does not make it irrelevant, but it is worth knowing before buying out of fear.