The AI literacy duty: what Article 4 of the AI Act really requires.
Every company that uses AI must support its staff’s AI literacy. The law requires no certificate and no exam. This guide explains what Article 4 requires since the Digital Omnibus, whom it affects and how to meet the duty in five steps, with proof.
As of 15 October 2026 · checked monthly · not legal advice
Key takeaways
- Article 4 has applied since 2 February 2025 to every company that provides or uses AI: regardless of risk class.
- Since the Digital Omnibus (27 July 2026), Article 4 requires measures to support AI literacy, not a specific level per person.
- A certificate, an exam or an AI officer are not required.
- The AI Act sets no fine of its own for Article 4. A lack of AI literacy can still count as a breach of the duty of care: document your measures.
Is there an AI training duty?
Yes, but differently from what the word suggests. Article 4 of the EU AI Act obliges providers and deployers of AI systems to take measures to support the AI literacy of their staff. This includes people who use AI on their behalf, such as freelancers or service providers. The measures follow prior knowledge, experience, training and how the AI is used.
“Training” is the most common way, but not the only one. A usage policy, an on-the-job briefing or a named contact person can also be measures. What matters is that staff understand what the AI can do, where it makes mistakes and which data they may enter.
Article 4 before and after the Digital Omnibus.
| Point | Until 26 July 2026 | Since 27 July 2026 |
|---|---|---|
| Duty | Measures to ensure, “to their best extent”, a sufficient level of AI literacy | Measures to support the development of AI literacy |
| Standard | a sufficient level among staff | no specific level per person owed |
| Who is covered | Providers and deployers, their staff and people acting on their behalf | unchanged |
| Support | — | The Commission and Member States support, especially small and medium-sized companies |
Sources: Article 4 of the AI Act (EU) 2024/1689; Regulation (EU) 2026/1744 (Digital Omnibus), published in the Official Journal on 24 July 2026, in force since 27 July 2026. A duty of result became a duty of effort.
Who must train staff on AI?
Companies that use AI
Every company that uses AI systems professionally is a deployer, from the chatbot on the website to the writing assistant in the office.
Providers of AI
Anyone who develops an AI system or offers it under their own name must support their staff’s AI literacy in the same way.
People acting on your behalf
Freelancers, agencies or service providers who use AI for you are included. Set out the training in the contract.
What Article 4 does not require.
No certificate
The regulation provides for no certification. Internal training counts just as much as external.
No fixed level
Since the Omnibus you need not guarantee a specific level per person, but support it seriously.
No AI officer
A dedicated role is not required. A named contact person still helps.
No standard course
You set format and length yourself: to fit role, risk and the AI you use.
Building AI literacy: the plan in five steps.
Map your AI use
Which AI systems does who use, for what and with which data? Including services staff bring themselves.
Sort roles and risk
Occasional users need less than people who prepare decisions with AI or run systems.
Set the rules
An AI policy: approved services, forbidden data, checking results, labelling.
Train by role
A short basic session for everyone, deeper units for specialist users, IT and managers.
Document and refresh
Record measure, content, duration and participants; retrain when systems or features change.
What belongs in AI training: by role.
All staff
What AI can and cannot do, spotting hallucinations, which data is off limits, checking results, labelling AI content.
Specialist users
Prompts for their own task, checking sources, limits in legal, HR and finance, reporting errors.
IT and administration
Data flows, roles and permissions, logs, model choice, security risks such as manipulated inputs.
Managers
Duties under the AI Act and GDPR, risk classes, responsibility for approvals, working with the works council.
What you should document.
| Item | Example |
|---|---|
| Measure | Basic AI training, 60 minutes, online |
| Content | Limits of AI, data rules, checking results, labelling |
| Audience and participants | all sales staff, attendance list |
| Date and refresher | 15 October 2026, next round with a new system or after 12 months |
| Supporting rules | AI policy, version 1.2, on the intranet |
The Bundesnetzagentur recommends documenting the type, content and duration of the measures and the participants, so you can show the implementation at any time.
Fines, liability and the works council.
The AI Act sets no fine of its own for Article 4; Article 99 does not list it. In Germany, the Bundesnetzagentur has been the supervisory authority since 29 July 2026. The duty still has consequences: in the Bundesnetzagentur’s view, a lack of AI literacy can count as a breach of the duty of care, especially when it causes damage.
It gets stricter with high-risk AI, for example in candidate selection. From 2 December 2027, deployers must assign human oversight to people with the necessary competence and training (Article 26(2)). And if you have a works council, clarify early whether AI training counts as co-determined vocational training or stays a simple briefing.
Questions about the AI literacy duty.
Is there an AI training duty for companies?
Yes. Since 2 February 2025, Article 4 of the AI Act has obliged every company that provides or uses AI to take measures to support its staff’s AI literacy. Since the Digital Omnibus of July 2026, this is a duty of effort. You do not have to guarantee a specific level for each person.
Do staff need a certificate in AI literacy?
No. The AI Act requires no certificate and no exam. Internal training, briefings, an AI policy and a contact person can be enough if they fit the role and the risk. What matters is that you document the measures so you can show them to a supervisory authority or a court.
Who must be trained on AI?
All staff who work with AI systems, and people who use AI on your behalf, such as freelancers or service providers. The scope follows prior knowledge, task and risk. Someone who uses AI only occasionally for texts needs less than someone who prepares decisions with it or runs the systems.
What happens if we do not train?
The AI Act sets no fine of its own for Article 4. A lack of AI literacy can still count as a breach of the duty of care if it causes damage, for example through wrong information or a data leak. GDPR duties come on top. Documented measures are your most important proof.
Does the duty apply if staff only use freely available AI chat services?
Yes, if they use them for work and with the company’s knowledge. Your company is then a deployer and must support AI literacy. An AI policy with approved services and forbidden data, plus a short basic training, helps most here. Purely private use is not covered by Article 4.
How often must the training be repeated?
The AI Act sets no fixed interval. A refresher makes sense when new AI systems or features are introduced, when tasks change and after about twelve months at the latest. Train new staff when they join. Record every round in your documentation.
Already have an AI policy for your team?
The free AI policy tool takes you in three steps to rules you can train and document. Or talk to Stefan about your plan.