AI literacy training: what Article 4 of the AI Act requires

Hardly any obligation under the EU AI Act affects as many companies as Article 4, and hardly any is surrounded by so many myths. Some sell certificates as protection against supposed fines in the millions, others believe the training obligation only starts in August 2026. Both are wrong. Time for a sober look: what does Article 4 really require, what changed in July 2026, and how do you put it into practice pragmatically with a small team?

Who the obligation applies to, and since when

Article 4 has applied since 2 February 2025, and it applies equally to providers and deployers of AI systems. A deployer is any company that uses AI in a professional context. A five-person agency with a ChatGPT account is covered just as much as a large corporation; there is no exemption for small companies. Besides employees, the obligation also covers people who work with AI on your behalf, such as freelancers. Your obligations towards them are less extensive than towards your own team, though.

What changed in July 2026

With the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026), the EU softened Article 4. Previously, you had to ensure, to the best of your ability, that your staff had a sufficient level of AI literacy. Now you have to take measures to support the development of AI literacy. You no longer have to guarantee a particular level of AI literacy.

This is not an all-clear. The obligation to actively do something remains. If you provide no training at all, you are in breach of the new version too. And the timing matters: on 2 August 2026, the Federal Network Agency (Bundesnetzagentur) starts work as Germany's AI supervisory authority. The window in which nobody was looking is closing right now.

Are there fines for missing training?

It pays to be precise here, because many vendors use scare figures in their marketing. The truth: Article 4 does not appear in the AI Act's fine provisions. There is no direct fine for missing training. Doing nothing is still risky, for four reasons:

• Supervision: Since August 2026, the Bundesnetzagentur has been able to request information and proof. Incorrect or incomplete information can cost up to €7.5 million or 1% of turnover.
• Aggravating factor: For other breaches of the AI Act, such as of the labelling obligations, a lack of training increases the fine.
• Liability: If an untrained employee causes damage using AI, you can quickly face the accusation of organisational fault, with claims for damages as a result.
• Knock-on costs: Data protection breaches, copyright infringements or embarrassing mistakes caused by unchecked AI output hit you regardless of the AI Act.

The real cost of unchecked AI output

German courts now show, month after month, how real this last risk is. In July 2025, the Cologne Local Court (Amtsgericht Köln) found that all the sources cited from page 8 onwards in a lawyer's written submission had been made up. In September 2025, the Frankfurt Regional Court (Landgericht Frankfurt) reprimanded a lawyer who had quoted three completely fictitious decisions of the Federal Court of Justice (BGH) word for word. And in November 2025, the Kammergericht, Berlin's Higher Regional Court, formally admonished a lawyer over hallucinated judgments. By mid-2026, an international database had already counted more than 1,600 such cases worldwide. The lesson for every team: AI output gets checked before it leaves the company. That is exactly what people learn in good training.

What training needs to cover

In its Questions and Answers of May 2025, the European Commission made clear what it expects. No fixed curriculum, no exam, no mandatory certificate, but your programme should achieve four things:

1. A general understanding: what is AI, how are its answers produced, and why do language models hallucinate?
2. The link to your own company: which tools do we use, in which role, and for which purposes?
3. The risks of the specific systems in use and how to handle them properly.
4. Training tailored to employees' prior knowledge and role. The Commission says explicitly that simply having people read the instructions for use is not enough in many cases.

The training plan for small teams

In practice, a three-tier structure based on roles has proven effective:

• Basics for everyone (60 to 90 minutes): Fundamentals, hallucinations, data protection and your own AI rules. As a live session or e-learning.
• User level (2 to 4 hours): For everyone who works with AI every day. Prompting, checking output and the typical risks in their own field, such as discrimination risks in HR or labelling obligations in marketing.
• Key roles: Management and the people responsible for AI also need an overview of the roles and obligations under the AI Act, the approval process for new tools and responsibility for the documentation.

The law sets no requirements on how often training must take place. What has proven effective is an annual refresher plus sessions whenever there is a specific reason: a new tool, a new use case, a relevant change in the law. E-learning is expressly permitted. The only thing that matters is that the content fits the tools you actually use instead of staying generic.

Documenting it properly

The Commission expects you to keep internal records of your measures. You do not need external certification, and vendors who promise you "certified Article 4 compliance" are promising more than the law even provides for. A clean list is enough as proof: who was trained, when, on what content, in what format, with reference to which tools and with what proof of attendance. Your AI policy and your tool inventory belong with it, because training, rules and inventory together make up your Article 4 proof.

The most common mistakes

• Training once and ticking the box. AI literacy is an ongoing task.
• Treating everyone the same. The wording of the law requires training tailored to role and prior knowledge.
• A policy without training, or training without a policy. The two belong together.
• Not documenting anything. Without proof, even the best training is worthless if it is ever called into question.
• Forgetting freelancers and student employees.
• Falling for the myth that the obligation only starts in August 2026. It has applied since February 2025.

Free help

Two points of contact cost nothing and are well worth using: the Bundesnetzagentur's AI Service Desk, as the official point of contact, answers questions from small companies and offers an interactive Compliance Compass. And the European Commission's Living Repository collects practical examples of AI literacy programmes, explicitly including ones from micro-enterprises.

How training works with Klaus

Klaus puts exactly this role-based approach into practice, but without you having to create training material or introduce a learning management system. The process consists of four steps:

Setup only takes a few minutes, because Klaus never asks anything twice: he already knows your industry, team size and AI inventory from the company onboarding. All he still needs to know is which functional areas you have and which tools they use. From this, he builds a separate training course for each area, exactly following the principle above: management gets governance and liability, HR gets discrimination risks, marketing gets copyright and labelling, IT gets security and logging. And because the Commission requires training to fit the systems actually in use, Klaus bases his examples on your real tools, not on generic slides.

The training itself is a dialogue rather than a video: Klaus explains, asks a comprehension question for each section and waits for the answer. Simply clicking through is not possible, not even on request. At the start, each person confirms which area they work in and which AI tools they use. Exactly these details end up in the training records, together with the completion date. That gives you the documentation described in this article without a single Excel spreadsheet: who, when, which area, which tools, which content.

Conclusion

The Article 4 training obligation is less dramatic than its reputation, but it asks more of you than doing nothing: there is no direct fine, but there are real liability risks, and since August 2026 there has been a supervisory authority that is allowed to ask questions. With basic training for everyone, in-depth modules for heavy users and simple documentation, you are on solid ground. It can be organised in an afternoon, and it makes your team better along the way.