Article 4 of the EU AI Act, Regulation (EU) 2024/1689, requires every organisation that uses AI systems professionally to take measures that support the AI literacy of its staff and of the people who work with AI on its behalf. The obligation has applied since 2 February 2025, and since 27 July 2026 in a new, softer version: you don't have to guarantee any particular level for anyone. The law does not require a certificate, a prescribed course or an AI officer. What the law requires is measures. What I recommend for that is a plan you can explain: who uses which tool for what, what those people need to know, and a short note of what you did. The note is not an obligation, but it is your evidence if anyone asks.
I am a developer, not a lawyer, and this is not legal advice, just the operator's perspective. I run my business with a workforce of fourteen Claude-based AI employees, and for this article I read the regulation on EUR-Lex, the amending regulation, the German implementing act and the guidance from the European Commission and Germany's Federal Network Agency (Bundesnetzagentur) on 18 October 2026. The sources are named in the text. Everything I write about AI in day-to-day business is collected on the Artificial Intelligence page.
What Article 4 of the AI Act requires
The article is short. In the version in force since 27 July 2026, paragraph 1 reads:
"Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."
Three terms carry that sentence:
- Deployer, under Article 3(4), is anyone "using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity". If your business uses a chat assistant or a transcription tool, you are a deployer. Under Article 3(3), a provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. So if you have an AI employee built for you and run it under your own name, you may be a provider yourself; that is a question for professional advice.
- Staff and other persons: the Commission reads "other persons" as people who "are not employees, but persons broadly under the organisational remit", for example a contractor, a service provider or a client.
- AI literacy is defined in Article 3(56) as the skills, knowledge and understanding that allow people "to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause".
The Bundesnetzagentur states that this applies regardless of sector and size of the organisation and explicitly includes chatbots. The Commission answers the question whether a company whose staff use ChatGPT for advertising copy or translations is covered with a plain yes: they "should be informed about the specific risks, for example hallucination".
Since when it applies, and what changed in 2026
Under Article 113, the AI Act generally applies from 2 August 2026, but Chapters I and II have applied since 2 February 2025. Article 4 sits in Chapter I, so the obligation has run since February 2025.
On 24 July 2026 the Official Journal published Regulation (EU) 2026/1744, the Digital Omnibus on AI. It entered into force on the third day after publication, 27 July 2026, and replaced Article 4 in full. The difference comes down to a few words:
So the sufficient level of AI literacy from the old version is no longer in the law. The Commission's FAQ (last updated 27 July 2026) says AI literacy remains an obligation for providers and deployers, but that no specific and no "sufficient" level is mandated any more. Recital 8 of the amending regulation gives the reason openly: such obligations create "an additional compliance burden, particularly for smaller enterprises".
What did not happen matters just as much: the obligation was not deleted. In November 2025 the Commission had proposed shifting it entirely to the Commission and the Member States. What was adopted keeps the obligation with the organisation. It no longer names a target level. The old version already asked for measures "to their best extent", and now the sufficient level is gone too.
What the law does not require
This is where training offers and the legal position drift furthest apart. According to the Bundesnetzagentur, the following are expressly not required for Article 4:
- guaranteed AI literacy levels for individuals,
- formalised or standardised training measures,
- (external) certification of the measures taken,
- appointing an AI officer.
The Commission says the same in its own words: "There is no need for a certificate", there are "no strict requirements or mandatory trainings", and Article 4 does not entail an obligation to measure employees' AI knowledge. I wrote a separate article on the AI officer question: Do I Need an AI Officer?
The Commission's FAQ and the Bundesnetzagentur's page are interpretive guidance, not binding rules; what counts is the text of the regulation. That doesn't mean anything goes. The Commission warns that in many cases simply relying on the instructions for use, or asking staff to read them, might be ineffective. And deployers of high-risk AI systems have an additional duty under Article 26(2): they "shall assign human oversight to natural persons who have the necessary competence, training and authority". High-risk systems include those in Annex III, for example tools for selecting job applicants; a writing assistant for quotes and emails is not one of them. Under the amended Article 113, the obligations in Sections 1 to 3 of Chapter III apply to Annex III systems only from 2 December 2027, and to high-risk products under Annex I from 2 August 2028. From then on, the competence requirement in Article 26 is also subject to fines via Article 99(4)(e).
What happens if you do nothing
Enforcement does not sit with the EU AI Office but with national market surveillance authorities. In Germany, under section 2(1) of the KI-MIG, the German AI market surveillance act of 22 July 2026, that is generally the Bundesnetzagentur; the act entered into force on 29 July 2026. The Commission names August 2026 as the start of supervision.
On fines I checked three sources, as of 18 October 2026:
- Article 99 of the AI Act leaves penalty rules to the Member States (para. 1). The fixed fine ranges in paragraphs 3 to 5 cover prohibited practices, a list of specific obligations (such as Articles 16, 26 and 50) and incorrect information to authorities. Article 4 is not on that list.
- Section 15 KI-MIG, Germany's fine provisions, lists breaches of Articles 21, 27, 45 and 86. Article 4 is not mentioned.
- The Commission writes in general terms that national authorities "could impose penalties and other enforcement measures" for breaches of Article 4, and that this is more likely where an incident results from a lack of training.
So I found no dedicated fine for Article 4 either in Article 99 of the AI Act or in the KI-MIG; I did not systematically search other laws. That is a snapshot, not an all-clear: Article 99(1), as amended from 27 July 2026, obliges Member States to provide penalties "applicable to any infringement", expressly including warnings and non-monetary measures. In addition, under section 11 KI-MIG the authority has powers to order measures, and the Bundesnetzagentur points out that a lack of AI literacy can be seen as a breach of the duty of care, especially if damage results. If someone on your team gives a client wrong advice based on an invented AI answer, the question of what you did beforehand is not theoretical. If you work outside Germany, your own country's implementing rules apply; I have not checked those.
How to put AI literacy into practice in a small business
The Bundesnetzagentur suggests three cornerstones: assess the need, design the measures, then document and refresh. For a business with two to twenty people, I translate that like this.
1. One list: who, which tool, what for
Write down who in the business uses which AI tool for which task, including freelancers who use it on your behalf. A table with four columns is enough: person, tool, purpose, what can go wrong. The last column is the actual need. Anyone drafting quotes with AI has to know that figures can be invented. Anyone transcribing client calls has to know what the law says; I covered that in Transcribing Calls: What German Law Says.
2. A briefing per role, not one seminar for everyone
The Commission names at least four steps: build a general understanding of AI, clarify the organisation's role (provider or deployer), consider the risks of the systems in use, and base the measures on that, matched to people's existing knowledge, the context of use and the persons on whom the AI is used. The Bundesnetzagentur recommends a staged approach, from basics to the specific tool to role-specific topics. For a small business that means:
- For everyone: how a language model arrives at its answers, why it can be convincingly wrong, which data does not belong in which tool.
- Per tool: what this tool may do, where its limits are, and who approves a result before it leaves the business.
- Per role: anyone handling client data needs the privacy side as well, for example from Claude Privacy and GDPR: What Applies.
In my own business, the most important rule for the AI employees is the one I would give people on a team as well: whatever leaves the house is approved first, and a separate role checks it before I approve. How to bring a team along when you introduce this is in AI Colleague or Competitor? Bring Your Team.
3. A note of what you did
The Commission says organisations can keep an internal record of trainings and other initiatives. The Bundesnetzagentur recommends recording the type of measure, its content and duration, and who took part. For a small business that is one line per session: date, topic, who attended, how long. Add once a year, or with every new tool, the question whether the list from step 1 is still accurate.
Where the training can come from
The format is up to you: self-study course, internal briefing, workshop or external course. The Bundesnetzagentur itself names free contact points in Germany: the European Digital Innovation Hubs (EDIHs) and the Mittelstand-Digital Centres with around 100 AI trainers who support small and medium-sized businesses independently of vendors. The Commission also points to the AI Skills Academy, which started operations on 1 May 2026.
I offer trainings and workshops on this myself, for teams and management, on site at your company or remotely, from AI fundamentals to Claude in daily work. What that includes is on AI Training and Workshops for Teams. For Art. 4 it does not matter where the training comes from; what matters is that it fits your tools and tasks.
Special case: you work alone
Article 4 speaks of your staff and of other persons dealing with AI systems on your behalf. It says nothing about you as the owner. If you have no employees, what remains is mainly freelancers and service providers using AI on your behalf. What exactly follows from that for a sole trader is a question of interpretation I can't answer. In practice little changes: if you work alone and use AI, you should know the risks of your tools anyway, and the list from step 1 takes half an hour. What else pays off for freelancers is in AI for Freelancers: What Pays Off.
Frequently asked questions
Do I need a certificate for AI literacy?
No. The Commission says "There is no need for a certificate", and the Bundesnetzagentur lists (external) certification explicitly among the things not required for Article 4. A certificate can be useful as evidence, but it is not an obligation.
Does this apply if my team only uses ChatGPT or Claude?
Yes. Anyone using an AI system professionally is a deployer under Article 3(4), and the Bundesnetzagentur names chatbots explicitly. The Commission answered exactly this case: a company whose staff use ChatGPT for advertising copy or translations should inform them about risks such as hallucination.
Do I have to test or measure my people's knowledge?
No. The Commission states that Article 4 does not entail an obligation to measure employees' AI knowledge, and the new version expressly rules out a guarantee of any specific level. It still makes sense to check after a briefing that the rules have been understood.
What happens if I do nothing at all?
I found no dedicated fine for Article 4 either in Article 99 of the AI Act or in section 15 of the German KI-MIG (as of 18 October 2026); Member States must, however, provide penalties for any infringement and can add rules. The supervisory authority, in Germany generally the Bundesnetzagentur, can still order measures, and according to the Bundesnetzagentur a lack of AI literacy can count as a breach of the duty of care, especially after damage has occurred. Doing nothing breaches the obligation, even though it is softly worded.
Is a free online course enough?
The law prescribes no format, so it can be one building block. Whether it is enough depends on whether it fits your tools and tasks. A general introduction does not replace a briefing on what is allowed with which tool in your business.
Does this apply in Austria and Switzerland?
The AI Act applies directly in all EU Member States, including Austria; I have not checked Austrian implementing law. Switzerland is not an EU member. Under Article 2(1), however, the regulation also covers providers and deployers established outside the EU, for example where the output of their AI system is used in the EU.
Where to go from here
Start with the list from step 1; it is the part no seminar can do for you. Then an hour's briefing per tool and one line in the log. If you are just introducing AI in your business, the briefing belongs in the plan I describe in Bringing AI to a Small Business. And if you are wondering whether all this needs a dedicated role: Do I Need an AI Officer?
How I onboard my AI employees, give them rules and check their results is something I show in my community Claude Practitioners. Membership does not fulfil an Article 4 obligation; that stays your job in your own business.
