Turn the lights on.

For AI literacy, yes. Article 4 of the EU AI Act (Regulation (EU) 2024/1689) requires providers and deployers of AI systems to take measures supporting the development of AI literacy among their staff — applicable since 2 February 2025, and supervised by national market surveillance authorities since 2 August 2026. Regulation (EU) 2026/1744 rewrote that article on 27 July 2026: what is required are the measures, and the text itself says the obligation does not require guaranteeing any specific level of AI literacy in any individual. NIS2 (Directive (EU) 2022/2555, Article 20) additionally requires the members of management bodies of essential and important entities to follow cybersecurity training, and expects those entities to offer similar training to employees on a regular basis.

Almost certainly yes. The duty falls on providers and deployers, and a "deployer" is anyone using an AI system under their authority in a professional context. There is no size threshold, no turnover floor, no sector test and no risk test — it is not limited to high-risk systems. ChatGPT counts, Copilot counts, and so do the AI features that have quietly appeared inside tools you have been paying for a while. It also reaches beyond your payroll to anyone operating those systems on your company's behalf, freelancers and agencies included. What falls outside it is personal use, away from work.

There is no official syllabus, no mandatory format, and no certification the law requires. The European Commission's questions and answers on AI literacy set out four steps: build a general understanding of what AI is and what it risks, establish whether your organisation is a provider or a deployer, work out what each person needs to know for the systems they actually touch, and tailor the result to their background and role. National regulators converge on much the same content: how these systems behave and where they fail (hallucination, bias, limits), which tools your company uses and for what, the prohibited practices in Article 5, the transparency duties in Article 50, human oversight, and the constraints imposed by data protection, confidentiality and intellectual property. Documenting internally what you did is what evidences the measure.

This deserves a precise answer, because the figures in circulation do not hold up. Article 4 does not appear in Article 99 of the AI Act, which is where the harmonised European fines are set, so there is no European fine for breaching it: penalties are left to each Member State. Spain does not have that regime yet. AESIA was created by royal decree, which cannot define administrative infringements, and the Organic Law Bill on the good use and governance of AI (file 121/000096) is still before Congress — and as drafted, it does not list Article 4 anywhere. Put plainly: AESIA cannot fine you for this today. What can cost you money is elsewhere: Article 26(2), on human oversight of high-risk systems by people with adequate training, which the Spanish bill does classify as a serious infringement from December 2027; obstructing a market surveillance inspection; and the AEPD, which can fine up to 20 million euros or 4% today for AI uses touching personal data. We sell training, not fear: the reason to do this is not the fine, it is that the duty is already in force, already supervised, and evidence is built before anyone asks for it.

Blocking doesn't stop Shadow AI — it moves it to personal phones and private accounts, where you have zero visibility. It also doesn't discharge your AI Act literacy duty: your team still deals with AI embedded in the tools they use every day. Training changes behaviour where blocking can't reach, and produces the evidence blocking never will.

No. The course is hosted at noshadow.ai — employees just need a work email to start, on any device. Nothing to install, nothing to integrate.

About 35 minutes end to end, on any device, and it can be done in short sittings. The first module is free and takes 5 minutes — try it before rolling anything out.

The certificate itself doesn't expire: it's a dated record that a named person passed the assessment on a given day, and that stays true. What changes is the tooling and the rules around it, so companies generally refresh awareness training about once a year and keep each year's certificates in the evidence file.

It's a named, dated training record with a serial number an auditor can verify against our registry. It supports your evidence for ISO 27001 control A.6.3 (awareness, education and training), the AI-literacy duty of EU AI Act Article 4, and the training expectations of NIS2 Article 20. No certificate makes you compliant by itself — this one is built to slot into the evidence file that does.