Implementing the AI Literacy Obligation (Art. 4 AI Act): What Companies Need to Train

Since February 2, 2025, companies that use AI have had to do something concrete — and very few have documented it cleanly. The reason is Article 4 of the AI Act: the AI literacy obligation. It sounds like common sense, but there is more to it than meets the eye, because it applies to every company that uses AI — from the large corporation to the three-person office with a ChatGPT subscription. This article does not aim to show that the obligation exists, but how to implement it in practice: which content, for which roles, in which format, and with what documentation to back it up. (Professional analysis, not legal advice for an individual case.)

Implementing the AI literacy obligation under Art. 4 of the AI Act means: mapping your own AI inventory, defining roles and competence levels, training in a risk-appropriate way, and documenting everything without gaps. The obligation has applied since February 2, 2025; since July 27, 2026, Regulation (EU) 2026/1744 has softened it: what is required are measures that support the development of AI literacy — nobody has to guarantee a specific level of literacy for any individual. The regulation prescribes neither a format, nor a certificate, nor a level of proof. Role-based, documented implementation is still the right path — not because of a fine, but because untrained use is the actual risk.

As of September 2026 — updated. Regulation (EU) 2026/1744 (the “Digital Omnibus on AI”) has been in force and applicable since July 27, 2026. It postpones the high-risk regime (Annex III to December 2, 2027, Annex I to August 2, 2028) — and it softens Art. 4: the obligation is now only to take measures that support the development of AI literacy; neither providers nor deployers have to guarantee a specific level of literacy for any individual. An earlier version of this article assumed that Art. 4 was not affected by the amendment — that is outdated. For context: what the Digital Omnibus changed and who supervises AI in Germany. This article is updated on an ongoing basis; the version of the regulation in force at any given time remains authoritative.

What Art. 4 is really about

Art. 4 of the AI Act requires providers and deployers of AI systems to take measures that support the development of AI literacy among their staff — as well as among the persons who operate the systems on their behalf. Since the amending regulation, the provision expressly states that this does not require guaranteeing any specific level of AI literacy for any individual. The key point still stands: the obligation is independent of the risk class. It applies not only to high-risk AI, but also to seemingly harmless tools such as ChatGPT, Microsoft Copilot, or Claude in everyday office use.

The regulation deliberately leaves open which measures are appropriate. In practice, what matters is technical knowledge, experience, education, and the specific context in which the persons concerned use the system. This openness is not a loophole but a risk-based mandate — and this is precisely where good implementation separates itself from poor implementation. For the definitional fundamentals (what, who, by when), see our detailed article on the AI literacy obligation under Art. 4; this article focuses on the how.

What exactly do companies need to train?

The regulation does not prescribe a fixed curriculum. In practice — and in line with the European Commission’s FAQ (May 2025) — a robust AI training program breaks down into three content dimensions:

1. Technical fundamentals. How do AI and large language models work at their core? What are hallucinations, why do biases arise, and where are the limits of reliability? Employees need to understand why they must not adopt AI outputs blindly.
2. Legal framework. The essentials of the AI Act, the interface with the GDPR, transparency obligations, avoiding discrimination, and how to handle business and personal data in prompts. This is where the most underestimated risk lies: AI plus personal data.
3. Specific application context. The company-specific use cases, your own tools, your own risks, and your internal AI policy. Generic online courses almost never cover this layer.

Why “law and technology from a single source” is decisive here

It is precisely at the seam between dimensions 1 and 2 that most offerings on the market fall short. Pure law firms deliver the legal framework but do not know the systems in detail. Pure training and LMS providers deliver technical fundamentals, but the legal depth remains thin. An AI training program that explains technically correctly why a model hallucinates, and at the same time situates with legal precision when this creates a GDPR or liability problem, needs both competencies under one responsibility. More on this on the page about AI training for your team.

A robust AI training program only holds up when technology, law, and your own application context are brought together — if one dimension is missing, it falls short in day-to-day work.

Implementing the AI literacy obligation: step by step

The following sequence has proven itself for implementation in mid-sized companies:

1. Map your AI inventory. Which AI tools are in use (including “shadow AI” such as privately used ChatGPT)? Who uses them, for which tasks, with what data? Without this inventory, “risk-appropriate” cannot be determined.
2. Define roles and competence levels. Not everyone needs the same knowledge. Assign people to competence levels (see Table 1).
3. Create a training framework. Specify who learns what and when — risk-based and tiered by role and prior knowledge. This framework will later be your central piece of evidence.
4. Deliver the training. Choose suitable formats (see Table 2): in-person, webinar, e-learning, train-the-trainer. Combining them is allowed and often makes sense.
5. Anchor an internal AI policy. An AI usage policy translates the training into binding rules for daily work (permitted tools, prohibited data, approval processes).
6. Document without gaps. Record who learned what and when (details below).
7. Update regularly. New tools, new roles, new legal situation — review the framework at least annually and whenever there is a triggering event.

Table 1: Roles, competence levels, and content

Role / group	Competence level	Training focus
Management / leadership	Strategic	Obligations under the AI Act, liability, governance, investment decisions
Compliance / data protection	In-depth (legal)	The AI Act in detail, GDPR interface, evidence keeping, supervision
Power users / departments using AI	Application-strong	Correct prompting, data protection in prompts, hallucination check, use-case risks
AI development / integration	Technically deep	Model behavior, bias mitigation, provider/deployer obligations, documentation
Remaining workforce (only marginal AI)	Basic awareness	What I may (not) do, basic understanding, internal AI policy
External service providers “on your behalf”	Depends on the task	Contractually secured minimum level analogous to internal roles

Who has to be trained?

Covered are all persons who use AI on behalf of the company — and this expressly includes external service providers and business partners who operate the systems on your behalf (per the European Commission FAQ of May 2025). Secure this contractually with external parties.

SMEs are not exempt either. Art. 4 sets no size threshold; a small company must fulfill the obligation, but may design the effort in a risk-appropriate — and therefore leaner — way. What is new runs the other way: the amending regulation expressly obliges the Commission and the Member States to support SMEs, and the Commission publishes practical examples on the central information platform.

Do I have to train employees who don’t use AI at all? Anyone who demonstrably does not use AI does not need in-depth training. A brief basic awareness session is nonetheless advisable: it prevents the uncontrolled use of private AI tools (“shadow AI”) and is part of a credible overall concept.

Does this also apply to ChatGPT, Copilot, and Claude? Yes. The obligation does not depend on the tool but on its use within the company. Anyone who uses one of these tools for business purposes is a deployer within the meaning of the AI Act and is therefore covered by Art. 4.

Documenting training evidence correctly

An official certificate is not required — and since the amending regulation, neither is a specific level of literacy. Documentation is therefore not a formal duty but a matter of self-interest: anyone who can show that they took appropriate measures is in a far better position if a dispute or an audit ever arises. For this reason, keep records of:

• Participants and date of each measure (who, when)
• Content and version of the training (slide deck, agenda, status)
• Trainer / source of the training (internal or external)
• Role-specific learning objectives per group (linked to the training framework)
• The applicable AI policy including employees’ acknowledgment of receipt
• Updates (when the framework was reviewed, what changed)

Rule of thumb: your training framework plus attendance records plus AI policy together tell the story that counts if it ever comes to that — clean, dated documentation is worth more than any generic certificate.

Deadline, enforcement, and penalties — the correct legal situation

This is where factual accuracy parts ways with fear marketing. Three dates must be kept apart:

• Since February 2, 2025, the AI literacy obligation has been directly applicable (at the same time as the prohibition of certain AI practices under Art. 5).
• Since July 27, 2026, Art. 4 has applied in the softened version introduced by Regulation (EU) 2026/1744: what is required are measures that support the development of literacy — not a guaranteed level.
• Since July 29, 2026, Germany has had a statutory AI supervisory authority at all: the KI-MIG act gives the Federal Network Agency (Bundesnetzagentur) default responsibility for the AI Act, with BaFin responsible for AI directly connected to regulated financial activity. The penalty layer of the AI Act (Chapter XII), by contrast, has applied since August 2, 2025 — the authority is younger than the rules it enforces.

And the fines? An important clarification: Art. 4 does not carry a standalone fine in the penalty catalog of Art. 99 of the AI Act. The widely cited amounts of “up to €15 million / 3% of annual turnover” relate to other breaches (provider/deployer obligations under Art. 99(4)); “up to €35 million / 7%” applies to prohibited practices under Art. 5. So anyone claiming that a missing AI course costs “up to €35 million” is legally off the mark. Nor does the national catalogue of administrative offences in § 15 KI-MIG (a range of up to €50,000) cover Art. 4.

This does not mean that Art. 4 is without consequences. Enforcement takes place through national market surveillance measures, and an indirect liability and damages risk arises: if an AI incident (for example a data protection breach or a wrong decision) can be traced to a demonstrable lack of competence, this has an aggravating effect — under both civil and supervisory law. So the serious driver is not a fantasy fine but real liability and auditability.

Train in-house or commission externally?

An honest assessment — even though we offer training ourselves:

Table 2 / 3: In-house, external, or blended?

Criterion	Train in-house yourself	External provider	Blended (external + internal)
Legal depth	only with in-house expertise	high (if legally well-founded)	high
Currency of the legal situation	hard to maintain	in the provider’s interest	good
Company-specific context	very high	low, unless tailor-made	very high
Internal effort	high	low	medium
Evidence / auditability	to be built yourself	usually included	included + internally anchored
Cost	”hidden” personnel costs	transparent, calculable	medium

For many mid-sized companies, blended is the best path: an external, legally accountable framework (concept, role-based content, evidence templates) plus internal anchoring in your own AI policy and your own use cases. If you want an implementation that covers law and technology from a single source, contact us for a legally sound, GDPR-compliant AI training program — ideally starting with a no-obligation initial consultation.

Frequently asked questions (FAQ)

Is a one-time online course enough?

For very low-risk use with basic awareness, a good online course can be a starting point. It is only “enough” if it is role-specific and documented. Because tools and the legal situation change, refreshers (at least annually, and whenever triggered by an event) are part of the obligation.

Do I need an official certificate for Art. 4 of the AI Act?

No. Neither the AI Act nor the European Commission prescribes any specific certificate — and since the amending Regulation (EU) 2026/1744, no specific level of literacy either. Art. 4 now only requires measures that support the development of AI literacy. Document those measures anyway: not for the sake of a certificate logo, but because the documentation is your evidence if liability is ever at issue.

Do I also need an internal AI policy?

It is not expressly required, but it is practically indispensable. The AI usage policy translates the training content into binding everyday rules and is at the same time strong evidence of your measures.

By when does implementation have to be in place?

The obligation has applied legally since February 2, 2025; the amending regulation did not change that date, but it did change the substance. There is no fixed deadline by which implementation must be finished, and the widely cited August 2, 2026 was never the start of Art. 4 enforcement: Germany has had a statutory AI supervisory authority only since July 29, 2026 (the KI-MIG act, with the Federal Network Agency). Starting early is still the right move — a clean, dated history is more convincing in an audit than a late certificate.

Does the obligation also apply to my small company?

Yes. There is no exemption for SMEs. However, the scope may be risk-appropriate — and therefore leaner — than in a large corporation.

Sources — as of 26.09.2026

• Regulation (EU) 2024/1689 (AI Act), Art. 3(56), Art. 4, Art. 99 — primary source (EUR-Lex)
• Regulation (EU) 2026/1744 (the “Digital Omnibus on AI”) amending the AI Act — Art. 4 recast, in force since July 27, 2026 — https://publications.europa.eu/resource/celex/32026R1744
• German AI Market Surveillance and Innovation Promotion Act (KI-MIG) of July 22, 2026, in force since July 29, 2026 — https://www.gesetze-im-internet.de/ki-mig/BJNR0DF0B0026.html
• Art. 99 AI Act (penalties, full text) — https://ai-act-law.eu/de/artikel/99/
• European Commission FAQ on AI literacy under Art. 4 (May 2025), prepared by the Otto Schmidt IT law blog — https://www.otto-schmidt.de/blog/it-recht-blog/faq-der-eu-kommission-zur-ki-kompetenz-nach-art-4-ki-vo-was-fur-arbeitgeber-gilt-und-ab-wann-ITBLOG0007892.html
• Noerr — Article 4 AI Act: obligations and opportunities for companies — https://www.noerr.com/de/insights/artikel-4-ki-vo-pflichten-und-chancen-fuer-unternehmen-im-umgang-mit-ki-kompetenz
• Bundesnetzagentur (Federal Network Agency) — AI literacy (national supervision in Germany) — https://www.bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/7_Kompetenz/start.html
• Council of the EU — “Artificial Intelligence: Council and Parliament agree to simplify and streamline rules” (Digital Omnibus provisional agreement, May 2026 — now superseded by Regulation (EU) 2026/1744) — https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/

This article reflects the situation as of September 2026 and is no substitute for legal advice in an individual case. This is general information, not legal advice. — Leon Lotz, business lawyer (Wirtschaftsjurist)