AI literacy requirement 2026: what Article 4 of the EU AI Act means for your business

What exactly does Article 4 require?

Article 4 of the AI Act (officially Regulation (EU) 2024/1689, often called the EU AI Act) applies to companies that provide or use AI systems. They must take measures to support the AI literacy of their staff. This also covers people who work with AI on their behalf. What counts is people’s prior knowledge, experience and education, and the context in which the AI is used.

Article 3(56) defines what AI literacy is: the skills, knowledge and understanding to use AI in an informed way and to be aware of its opportunities, risks and possible harm. Programming skills are not part of it. It is about handling AI confidently day to day.

Who does the requirement apply to?

Every company and every employer that uses AI systems. It starts early: anyone who uses AI tools such as ChatGPT, Microsoft Copilot or DeepL for work counts as a deployer of an AI system (Article 3(4) of the AI Act). The European Commission names exactly this example: even a company whose team only uses ChatGPT for advertising copy or translations falls under Article 4.

There is no exception for small businesses. And the requirement does not only cover employees: according to the European Commission, freelancers or service providers who work with AI on your behalf are included too. Because the AI Act, as an EU regulation, applies directly in all Member States, the requirement also applies in Austria, for example.

What changed in 2026?

Originally, companies had to ensure “to their best extent” a sufficient level of AI literacy. With the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026), Article 4 was reworded: today, it is about supporting the development of AI literacy. Companies do not have to guarantee a specific level of knowledge for every single person. Also new: the European Commission and the Member States are supposed to support companies with this, especially small and medium-sized ones.

Important: the requirement remains binding. Since 2 August 2026, the national market surveillance authorities have been monitoring whether it is being met. In Germany, the AI Market Surveillance Act (German abbreviation: KI-MIG) has regulated this since the end of July 2026, and the central contact point is the Federal Network Agency (Bundesnetzagentur).

Do I need a certificate?

No. The law does not require a certificate, a number of hours or a particular format. The European Commission says explicitly: it is enough to keep an internal record of training and other measures. You should, however, be able to show what you have done. Documented training with proof of participation is the easiest way to do that.

What happens if I do nothing?

The authorities can penalize violations of Article 4. According to the European Commission, any sanction must be proportionate and based on the individual case, for example on how serious the violation is.

There is also a practical risk: if confidential data ends up in a public AI tool or a customer receives wrong information, you need to be able to explain how your team was prepared for working with AI. Documented training helps you do that.

What good AI training should cover

As a basis, the European Commission recommends: a general understanding of what AI is and how it works, your own role as a provider or deployer, the risks of the AI systems you use, and measures that fit your staff’s level of knowledge. In our view, this means the following in practice:

• Basics: how generative AI works and where it typically makes mistakes.
• Data protection and confidentiality: which data may go into which tool and which may not.
• Practice with your tools: real tasks from everyday work instead of theory.
• Recognizing risks: made-up facts, copyright, bias in results.
• Clear rules: who may use which AI for what, and who decides.

Four steps to AI literacy

1. Take stock. Who uses which AI tools in your company, even unofficially?
2. Training by role. Sales needs different knowledge than accounting or HR.
3. AI policy. A short, easy-to-understand page with the rules for your everyday work.
4. Document and refresh. Keep a record of who took part and include new employees right away.

How to document the training

A simple overview is enough, as long as it is up to date. Record the following in it:

• Who was trained? Name, role and date.
• What was covered? Topics, materials and the tools involved.
• Which rules apply? Your AI policy, with the date of the current version.
• When will it be refreshed? An interval you set yourselves, for example once a year, and a process for new employees.

You can see how we train teams on our AI training page: live in a workshop and, soon, also online on our learning platform. We are based in Hamburg and train teams across Germany, by video or on site if needed. In a free intro call, we work out what makes sense for your use of AI.