AI Literacy Under EU AI Act Article 4: Rules After the Omnibus
Article 4 of the EU AI Act still requires providers and deployers of AI systems, which in the EU includes almost any company whose staff use AI tools for work, to take measures that support AI literacy among their staff and others using AI on their behalf. Since the Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on July 27, 2026, there is no longer a “sufficient level” to reach. No certificate, course format or minimum number of hours is required. In practice, that means knowing which AI is in use, giving each role fitting training or guidance and keeping an internal record.
Note: This article describes the legal situation in general terms as of the date below. It is not legal or tax advice and does not replace a review of your specific case by a lawyer or tax advisor. All information without guarantee of completeness or timeliness.
What does EU AI Act Article 4 require after the Digital Omnibus?
The AI Act (Regulation (EU) 2024/1689) defines AI literacy in Article 3(56) as the skills, knowledge and understanding that allow providers, deployers and affected persons to deploy AI systems in an informed way and to be aware of the opportunities, risks and possible harm of AI. The Digital Omnibus on AI of July 8, 2026, published in the Official Journal on July 24, replaced Article 4 in full and entered into force on July 27, 2026.
Article 4 before and after the Digital Omnibus (as of November 2026)
| Aspect | Original text (applied from February 2, 2025) | Amended text (since July 27, 2026) |
|---|---|---|
| Core duty | Take measures to ensure, to their best extent, a sufficient level of AI literacy | Take measures to support the development of AI literacy |
| Required level | A “sufficient level” | No specific level; nothing has to be guaranteed for any individual |
| Who must be considered | Staff and other persons dealing with the operation and use of AI systems on the organization’s behalf | Unchanged |
| Factors to take into account | Technical knowledge, experience, education and training, context of use, persons on whom the AI is used | Unchanged |
| Public support | Not part of Article 4 | Commission and Member States support providers and deployers, in particular SMEs; the Commission is to publish practical examples on the single information platform |
| AI Board | Not part of Article 4 | Is to adopt recommendations, taking into account European competence frameworks |
Recital 8 of the amending regulation explains why: a stringent duty to ensure a sufficient level would not suit every type of provider and deployer and creates additional compliance burden, especially for smaller enterprises. In German, the concept is KI-Kompetenz.
Does Article 4 apply if your staff only use ChatGPT or Copilot?
Yes. Article 4 applies to providers and deployers of AI systems regardless of risk class. A deployer is any person or organization using an AI system under its authority, except for personal, non-professional use. Most companies are deployers of AI built by others, from chat assistants to AI features in office, CRM or accounting software. You become a provider if you develop an AI system, or have one developed, and place it on the market or put it into service under your own name or trademark.
The European Commission’s AI literacy Q&A covers the everyday case: a company whose employees use ChatGPT to write advertising copy or translate texts is covered, and staff should be informed about specific risks such as hallucinations. For a structured format, AI workshops for companies in English or German range from a half-day impulse workshop to a multi-day in-house onboarding.
Article 4 also covers “other persons” acting on the company’s behalf; according to the Q&A, these are people broadly within the organization’s remit, such as contractors, service providers or clients. The Q&A also states that the AI Act, including Article 4, reaches actors inside and outside the EU as long as the AI system is placed on the EU market, used in the EU or has an impact on people located in the EU.
Article 4 deadlines, enforcement and fines in Germany
Key dates for AI literacy and related duties (as of November 2026)
| Date | What applies or happened |
|---|---|
| February 2, 2025 | Chapters I and II of the AI Act apply, including Article 4 in its original wording and the prohibited practices |
| August 2, 2025 | Penalty provisions (Chapter XII) apply; Member States had to set national rules on penalties |
| July 27, 2026 | Digital Omnibus enters into force; amended Article 4 applies |
| July 29, 2026 | German KI-MIG enters into force; the Bundesnetzagentur becomes the central market surveillance authority |
| August 2, 2026 | General application of the AI Act; according to the Commission, national supervision and enforcement of Article 4 start |
| December 2, 2027 | High-risk obligations for Annex III systems apply, including deployer duties under Article 26 |
| August 2, 2028 | High-risk obligations for Annex I (product-related) systems apply |
Germany set up supervision with the KI-MIG of July 22, 2026. Under Section 2, the Bundesnetzagentur is the market surveillance authority unless the act assigns another one; BaFin, for example, covers AI systems directly connected to regulated financial activities of the firms it supervises. The Bundesnetzagentur is also the central point of contact and complaints office, and its KI-Service Desk offers guidance, including notes on building AI literacy.
On fines, the texts are narrower than many warnings suggest. Article 99(4) of the AI Act lists the provisions that carry fines of up to EUR 15 million or 3% of worldwide annual turnover; Article 4 is not on that list. Section 15 of the KI-MIG defines national offenses, for example in connection with Articles 21, 27 and 86, and does not mention Article 4 either. That does not make the duty optional: the Commission’s Q&A stresses that any sanction must be proportionate and may be more likely where an incident can be traced to a lack of appropriate training. How authorities and courts will apply Article 4 is still open.
AI literacy training requirements: a lean Article 4 checklist
The Commission’s Q&A names minimum considerations for an AI literacy program: a general understanding of AI, the organization’s role as provider or deployer, the risks of the systems in use, and measures tailored to people’s knowledge and the context of use, including legal and ethical aspects. It adds that there is no one-size-fits-all format, relying only on instructions for use can be ineffective, and different levels of training for different groups can be appropriate.
Article 4 checklist (one possible structure, not an official template; as of November 2026)
| Step | What to do | What to keep on file |
|---|---|---|
| 1. Owner and inventory | Name an owner; list the AI systems in use, including AI features in licensed software and free tools staff use for work | AI inventory with owner, purpose and user groups |
| 2. Role and risk | Check per system whether you are provider or deployer, and whether any use could be high-risk, for example recruitment under Annex III, point 4 | Short assessment per system |
| 3. Target groups | Define levels: all users, frequent users and specialists, leadership and IT, staff assigned to human oversight | Role matrix |
| 4. Measures | Training sessions, short guides, internal usage rules (which data may go into which tool), Q&A sessions | Agendas, materials, usage policy |
| 5. Other persons | Clarify what contractors and service providers working with your AI need to know | Briefing note or contract clause |
| 6. Record | Who took part, when, which content, which version of the materials (example template below) | Internal record; the Commission says no certificate is needed |
| 7. Review | Update when tools, use cases or rules change; set a fixed review date, for example once a year | Review date and change log |
Developers using AI coding assistants usually need a module on reviewing and testing generated code; for trading software, see the pre-live checklist for AI-built trading bots.
Typical example: a midsize company uses a chat assistant for drafting and translation. All users get a short session on how it works, why it can state false facts and which data must not be entered. The company is also evaluating a tool that filters job applications, a high-risk use under Annex III, so HR and leadership get a separate module on the human oversight duty in Article 26(2) that would apply from December 2, 2027.
AI literacy documentation: an example record template
Article 4 prescribes no form of documentation. According to the Commission, no certificate is needed, and organizations can keep an internal record of trainings and other guidance measures. The example shows useful fields, one row per AI system and user group; it is not a legal requirement or an official form.
Example: AI literacy record (fields and illustrative entries, as of November 2026)
| Field | What to note | Illustrative entry |
|---|---|---|
| AI system | Tool or feature, provider, license | Chat assistant, company license |
| Role | Provider or deployer for this system | Deployer |
| Use and user group | What it is used for, by whom | Sales: drafting and translating customer emails |
| Risks and rules | Known risks, internal usage rules | Can state false facts; no customer personal data in prompts |
| High-risk check | Annex III result, who checked, when | No Annex III use; IT lead, October 2026 |
| Measure | Training, guide or Q&A session; format and length | 90-minute basic session plus a one-page usage guide |
| Content and materials | Topics, materials version | How the tool works, hallucinations, data rules; slides v1.2 |
| Delivery and attendance | Trainer, date, where the attendance list is kept | IT lead, October 14, 2026; list in the HR system |
| Other persons | Contractors or service providers briefed | Translation agency: briefing note |
| Owner, open points, review | Who keeps the row current, what is pending, next review | Inventory owner; catch-up for absentees; on tool change, at the latest after 12 months |
Attendance lists are employee personal data: keep them minimal and agree access and retention with your data protection officer, if you have one.
If the record lives in a spreadsheet, a short script can check a CSV export for missing fields, invalid roles and overdue reviews. It uses only the Python 3 standard library, reads one local file and sends nothing. Test condition: Python 3.9, the example file below, date set to November 3, 2026.
"""Flag gaps in an AI literacy record kept as a CSV file.
Python 3, standard library only. Reads one local file; sends nothing."""
import csv
import sys
from datetime import date
REQUIRED = ["ai_system", "role", "user_group", "measure", "date", "next_review", "owner"]
ROLES = {"provider", "deployer"}
def check(path, today):
problems = []
with open(path, newline="", encoding="utf-8-sig") as f:
for line, row in enumerate(csv.DictReader(f), start=2):
missing = [k for k in REQUIRED if not (row.get(k) or "").strip()]
if missing:
problems.append(f"line {line}: missing {', '.join(missing)}")
role = (row.get("role") or "").strip().lower()
if role and role not in ROLES:
problems.append(f"line {line}: role must be provider or deployer")
review = (row.get("next_review") or "").strip()
try:
if review and date.fromisoformat(review) < today:
problems.append(f"line {line}: review overdue since {review}")
except ValueError:
problems.append(f"line {line}: next_review is not YYYY-MM-DD")
return problems
if __name__ == "__main__":
today = date.fromisoformat(sys.argv[2]) if len(sys.argv) > 2 else date.today()
found = check(sys.argv[1], today)
print("\n".join(found) or "no gaps found")
sys.exit(1 if found else 0)Example file (illustrative data) and output:
record_id,ai_system,role,user_group,measure,materials_version,date,next_review,owner R1,Chat assistant (company license),deployer,Sales,Basic session 90 min + usage guide,v1.2,2026-10-14,2027-10-14,IT lead R2,AI coding assistant,deployer,Developers,,,,2026-09-30,IT lead $ python3 check_ai_literacy_record.py ai_literacy_record.csv 2026-11-03 line 3: missing measure, date line 3: review overdue since 2026-09-30
It checks completeness, not whether a measure fits the people and the risks.
Germany: works council and training language
In companies with a works council, AI training also falls under the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG). The employer must inform the works council in good time about planned work procedures, explicitly including the use of artificial intelligence (Section 90(1) no. 3). If a tool is capable of monitoring employee behavior or performance, co-determination under Section 87(1) no. 6 may apply. The works council also co-determines how in-house training measures are carried out (Section 98(1)) and, where planned changes mean that employees’ skills no longer suffice for their tasks, the introduction of such measures (Section 97(2)). Involving the works council from the start is generally the smoother route. More detail: works council co-determination in AI training (German).
Language matters too. Article 4 asks organizations to take into account their people’s knowledge, experience and education and the context of use. For international teams in Germany, that argues for training in the language people actually work in. The AI Act does not prescribe one.
Common mistakes and open questions
- “The duty was abolished.” It was not. The Commission’s proposal of November 19, 2025 would have shifted it to the Commission and Member States; the adopted text keeps it with providers and deployers.
- Copying a published example. The Commission’s living repository collects more than 40 AI literacy initiatives; according to the Commission, replicating them currently does not automatically grant a presumption of compliance.
- Treating Article 4 as the whole job. High-risk deployers have additional duties, and the transparency obligations of Article 50 apply from August 2, 2026; providers of generative systems placed on the market before that date have until December 2, 2026 to meet the marking duty in Article 50(2).
- Ignoring actions AI can trigger. Where an assistant is linked to business systems, training should cover which actions need human approval: for example, every order when Claude or ChatGPT is connected to Interactive Brokers via MCP.
In its update of October 20, 2026, the Commission’s Q&A still refers in the future tense to the practical examples on the single information platform and to the AI Board’s recommendations under Article 4(3). Whether a specific program is adequate is a question for legal counsel in the individual case.
Frequently asked questions
Is AI literacy training mandatory under Article 4 of the EU AI Act?
Article 4 requires providers and deployers of AI systems to take measures that support the development of AI literacy among staff and others using AI on their behalf. It does not prescribe a specific course, format or number of hours. The European Commission notes that relying only on instructions for use can be ineffective in many cases, so training or guidance tailored to roles is the usual way to meet the duty. This is general information, not legal advice.
What did the Digital Omnibus change in Article 4?
Regulation (EU) 2026/1744, in force since July 27, 2026, replaced the duty to ensure a sufficient level of AI literacy with a duty to take measures to support its development. The text now states that no specific level has to be guaranteed for any individual. It also requires the Commission and Member States to support companies, especially SMEs, and the AI Board to adopt recommendations.
Do companies need an AI literacy certificate under the EU AI Act?
No. According to the European Commission's AI literacy Q&A, there is no need for a certificate, and no specific governance structure such as an AI officer is required for Article 4. Organizations can keep an internal record of trainings and other guidance measures. Offers that present a certificate as legally required for Article 4 overstate what the law says.
Does Article 4 apply if employees only use ChatGPT or Copilot at work?
Yes. Article 4 applies to deployers of AI systems regardless of risk class, and using an AI tool for work makes a company a deployer. The European Commission confirms that a company whose employees use ChatGPT for advertising copy or translation is covered, and that staff should be informed about specific risks such as hallucinations. Only personal, non-professional use falls outside the deployer definition.
Does the AI literacy requirement apply to companies outside the EU?
It can. According to the European Commission's AI literacy Q&A, the AI Act applies to public and private actors inside and outside the EU as long as the AI system is placed on the EU market, used in the EU or has an impact on people located in the EU, and this also covers Article 4. A US company whose staff in the EU use AI tools for work will therefore usually need to cover them in its AI literacy measures. Whether a specific setup is covered is a question for legal counsel.
Who enforces AI literacy rules in Germany, and are there fines?
Since the KI-MIG took effect on July 29, 2026, the Bundesnetzagentur has been the central market surveillance authority for the AI Act in Germany, with sector authorities such as BaFin for certain financial firms. In the published texts, neither Article 99(4) of the AI Act nor Section 15 of the KI-MIG lists Article 4 as a fineable offense. Supervision still applies, and questions about a specific case belong with legal counsel.
How should a company document AI literacy measures?
According to the European Commission, no certificate is needed; organizations can keep an internal record of trainings and other guidance measures. A workable record lists, per AI system and user group, the role as provider or deployer, the measure taken, the version of the materials, attendance with dates, other persons briefed, an owner and a review date. The template in this article is an example, not an official form.
How often does AI literacy training need to be repeated?
Neither Article 4 nor the European Commission's AI literacy Q&A sets a frequency or a minimum duration. What counts is that the measures fit the AI systems in use and the people using them. Because tools and features change quickly, updating the training when tools, use cases or internal rules change, plus a fixed review date such as once a year, keeps both the knowledge and the record current.
Does the works council have a say in AI training in Germany?
Where a works council exists, yes, in several ways. Under the Works Constitution Act, the employer must inform it about planned use of AI in work procedures, and it co-determines how in-house training measures are carried out. Where changes mean employees' skills no longer suffice for their tasks, it can also co-determine the introduction of training. Involving the works council early is generally the smoother route.
Sources and status
- Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI), OJ L, 24.7.2026 — EUR-Lex, Publications Office of the European Union (retrieved November 3, 2026)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3, 4, 26, 99 and 113 and Annex III — EUR-Lex, Publications Office of the European Union (retrieved November 3, 2026)
- AI Literacy - Questions & Answers (last update 20 October 2026) — European Commission, Shaping Europe's digital future (retrieved November 3, 2026)
- Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG) of 22 July 2026, BGBl. 2026 I Nr. 223 — Federal Ministry of Justice, gesetze-im-internet.de (retrieved November 3, 2026)
- Bundesnetzagentur übernimmt zentrale Rolle bei der Umsetzung der KI-Verordnung (press release, 29 July 2026) — Bundesnetzagentur (retrieved November 3, 2026)
- Betriebsverfassungsgesetz (Works Constitution Act), Sections 87, 90, 97 and 98 — Federal Ministry of Justice, gesetze-im-internet.de (retrieved November 3, 2026)
As of November 2026. Third-party rules, prices and APIs may have changed since; the providers' current documentation and the official texts are authoritative.
Need AI literacy training for your team in English or German? Get in touch — a free preliminary call clarifies your AI tools, roles, language and how to document the training. More: AI workshops and AI training for companies.