AI Literacy Obligation under Article 4 of the EU AI Act: What Companies Need to Do and Document

Yes, there is an AI training obligation: under Article 4 of the EU AI Act, every company that provides AI systems or uses them at work must take measures to build its staff's AI literacy. This has applied since 2 February 2025, and it applies even if your team "only" uses ChatGPT or Copilot. No certificate is required, but you should be able to document what you have done.

This article explains what Article 4 actually requires, what changed with the "Digital Omnibus" in summer 2026, how big the risk really is and how to meet the obligation with little effort. Status: October 2026. This is an overview and does not replace legal advice.

What does Article 4 of the AI Act require?

The EU AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and has been applying in stages ever since. Article 4 is titled "AI literacy" and was among the first rules to apply.

The original wording said, in essence: providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons using AI systems on their behalf. They must take into account technical knowledge, experience, education and training, the context of use and the people the AI is used on.

What AI literacy means is defined in Article 3(56): the skills, knowledge and understanding needed to deploy AI systems in an informed way and to be aware of the opportunities, risks and possible harm. So this is not about programming. It is about using the tools safely and critically in everyday work.

What did the Digital Omnibus change?

In November 2025, the European Commission proposed the "Digital Omnibus on AI", a package to simplify the AI Act. It was adopted in summer 2026 as Regulation (EU) 2026/1744 and entered into force at the end of July 2026 (EUR-Lex). According to the Commission's AI literacy Q&A, this means for Article 4:

• The obligation stays. Providers and deployers must still take measures to build their staff's AI literacy.
• No fixed level any more. A specific or "sufficient" level is no longer mandated. The measures should support the development of AI literacy, in line with knowledge, experience and context of use.
• More support from the EU. The Commission and member states are to help companies with practical examples and recommendations.
• High-risk stays strict. Anyone deploying high-risk AI must still specifically train the people responsible for human oversight.

The Commission's original proposal would have largely shifted the obligation to the Commission and member states. The final text did not go that far. Some guides online still reflect the proposal and claim the training obligation was "abolished". Based on what the Commission itself publishes, that is not correct.

Who does the AI literacy obligation apply to?

Article 4 addresses two groups:

• Providers develop an AI system or place it on the market under their own name.
• Deployers use an AI system under their own authority in a professional context. Only purely personal use is exempt.

Most small and mid-sized companies are deployers. It is enough that staff use ChatGPT for writing, Microsoft 365 Copilot in daily office work, or that an AI chatbot answers customer questions. In its Q&A, the Commission explicitly mentions employees who use ChatGPT to write ads or translate text. They too should know about risks such as made-up content ("hallucinations").

Importantly, it is not only about permanent employees. People working with AI on your company's behalf, such as freelancers or service providers, are covered too. The obligation also does not depend on a risk class. It applies even if you use no high-risk AI at all.

Since when does it apply and who enforces it?

Date	What applies
1 August 2024	AI Act enters into force
2 February 2025	Article 4 (AI literacy) and the prohibitions in Article 5 apply
End of July 2026	Digital Omnibus enters into force, Article 4 is reworded
2 August 2026	National market surveillance authorities supervise and enforce, transparency rules in Article 50 apply
2 December 2027	Obligations for high-risk AI under Annex III (e.g. HR, education)
2 August 2028	Obligations for high-risk AI in regulated products under Annex I

The Omnibus pushed back the high-risk deadlines. You can find the current timeline on the Commission's AI Act page.

In Germany, the AI Market Surveillance and Innovation Act (KI-MIG) has been in force since 29 July 2026. It makes the Federal Network Agency (Bundesnetzagentur) the central market surveillance authority for the AI Act, unless a sector regulator such as BaFin is responsible. The agency also runs an AI service desk with information aimed especially at small and mid-sized companies.

Penalties and liability: a realistic view

Many training providers advertise fines in the millions. For Article 4, that is not accurate:

• No dedicated fine in the AI Act. The list of fines in Article 99 does not mention Article 4.
• No dedicated fine in German law. The penalty provisions in Section 15 of the KI-MIG do not list Article 4 either, according to the published version.
• Authorities can still act. According to the Commission, authorities can take measures under national law. A sanction becomes more likely if an incident shows that training or guidance was missing.

The real risk lies elsewhere. If staff without basic knowledge copy customer data into a private AI account, that is a data protection problem with fines under the GDPR. If someone publishes a made-up legal statement or someone else's image without checking, liability and cease-and-desist letters follow. In those cases, the question of whether the company properly instructed its people quickly becomes relevant. Read more about these risks in our articles on AI and the GDPR and AI and copyright.

In short: the AI literacy obligation is not a fine trap, but it is a duty of care. If you meet it and document it, you are in a much better position when something goes wrong.

What does "sufficient" mean in practice?

The word "sufficient" was removed from the legal text by the Omnibus. The question behind it remains: how much training is enough? There is no fixed number of hours. In its Q&A, the Commission suggests four building blocks:

1. General understanding: What is AI, roughly how does it work, which AI does your company use, what are the opportunities and dangers?
2. Your own role: Is your company a provider or a deployer, and what follows from that?
3. Risks of the systems in use: What can go wrong with your specific tools, and what does everyone need to do about it?
4. Tailored to people and context: Different roles need different depth, including legal and ethical questions.

The Commission also points out that simply referring to a tool's instructions for use is usually not enough.

In everyday terms: an assistant who drafts emails with ChatGPT needs less depth than a team running an AI agent for invoice checks. Management also needs to understand responsibility, policies and approvals. Good training therefore works with the real tasks of each role rather than generic slides.

Topics no training should leave out:

• Which data may go into which tool, and which may not
• Why AI output always has to be checked (hallucinations, outdated knowledge, bias)
• Copyright and labelling of AI content
• Internal rules: approved tools, contact person, how to handle mistakes
• Hands-on exercises with the tools people actually use

How to document AI literacy

The AI Act does not prescribe a specific form of proof. The Commission states explicitly that no certificate is needed and internal records of training and other measures are enough. This checklist helps you build clean documentation:

1. Take stock: List every AI tool and AI system used in the company, including unofficial ones.
2. Map roles: Who uses which tool for what? Group by role, for example sales, accounting, customer service, management.
3. Define needs: Set the content and depth each role needs.
4. Write an AI policy: Record which tools are allowed, which data is off-limits and who helps with questions.
5. Train: Run suitable formats, from short e-learning to workshops.
6. Record attendance: Name, date, format, content, trainer. A certificate of attendance per person is ideal.
7. Include external people: Clarify how freelancers and service providers who use AI on your behalf are covered, for example by contract.
8. Plan for new hires: Make AI literacy a fixed part of onboarding.
9. Refresh regularly: New tools and features bring new risks. Plan at least one refresher per year.
10. Keep everything in one place: Policy, training materials and records should be quick to find on request.

Article 4 does not require an AI officer or an AI board, by the way. Having a named contact person still helps a lot in practice.

Training formats compared

There is no single right format. Most companies combine two or three building blocks.

	E-learning	Workshop	Champions programme
Best for	Basic knowledge for many people	Teams and departments	Multipliers inside the company
Duration	30 to 90 minutes per person	half or full day	several sessions over a few weeks
Practical relevance	low, mostly generic content	high, with real tasks	very high, with your own use cases
Proof	automatic via learning platform	certificate of attendance	certificate plus results
Strength	cheap, scalable, good for refreshers	questions answered on the spot, usage rises noticeably	AI becomes part of how the company works
Weakness	often just clicked through	one-off, needs follow-up	more effort for the champions

Our experience from workshops: e-learning alone ticks the box on paper, but rarely changes how people work. A workshop built around the team's own tasks makes sure AI is actually used afterwards, and used safely. The AI champions programme pays off when AI needs to reach several departments and you want internal go-to people.

How aiworx workshops cover the obligation

At aiworx, we run workshops and training that cover AI literacy under Article 4 of the EU AI Act. We work with the tools your team already uses, such as ChatGPT, Claude or Microsoft Copilot, and with tasks from your daily work. If you are deciding between Copilot and ChatGPT Enterprise, our comparison Copilot vs. ChatGPT Enterprise is a good starting point.

Format	Duration	Price (net, plus VAT)
Half-day workshop	approx. 4 hours	€2,750
Full-day workshop	approx. 8 hours	€4,950
AI champions programme	several weeks	on request

Every participant receives a certificate of attendance for your records. We tailor content and depth to your roles and tools in a free initial call, from the basic module for the whole team to a governance session for management.

Workshops often reveal routine work that could be automated. The next step is then an AI agent as a digital colleague. Find out how that works on our AI automation page and in our guide to AI in business.

Frequently asked questions

Is AI training for employees legally required? Yes. Since 2 February 2025, Article 4 of the AI Act has required providers and deployers of AI systems to take measures to build their staff's AI literacy. The Digital Omnibus softened the wording in 2026, but did not abolish the obligation.

Does the obligation apply if we only use ChatGPT or Copilot? Yes. Anyone using AI tools at work is a deployer under the regulation. The Commission explicitly names using ChatGPT for writing and translation as an example.

Do we need a certificate as proof? No. According to the Commission, internal records of training and other measures are enough. Useful items are a certificate of attendance per person, the training content and your AI policy.

Are there fines if we do not train our staff? Neither the AI Act nor the German KI-MIG sets a dedicated fine for Article 4. Authorities can still take measures, and missing training matters after incidents, for example in data protection breaches or liability cases.

How often does training have to be repeated? The regulation sets no interval. Because tools and risks change quickly, an annual refresher makes sense, plus an introduction for every new hire.

Who enforces the obligation in Germany? Under the KI-MIG, the Federal Network Agency is the central market surveillance authority for the AI Act. In some sectors, such as banking, specialist regulators like BaFin remain responsible.

Want to meet the obligation and get your team genuinely ready for AI at the same time? Let's find the right format for you in a free initial call.