Article 4 EU AI Act: AI Literacy Obligation Explained

Article 4 EU AI Act (AI literacy) requires providers and deployers of AI systems to take measures that support the AI literacy of their staff. The obligation has applied since 2 February 2025, covers all risk tiers and is met through documented, role-based training. The AI Act sets no separate fine for Article 4; penalties are set by national law.

The AI literacy obligation is the most frequently underestimated provision in the entire AI Regulation. It is not a special high-risk rule but a baseline obligation that affects every company deploying AI in its operations, from the marketing copilot to the agentic research tool.

• Who? Providers AND deployers. For almost every company in Germany and Austria, the deployer role applies. Swiss companies are only covered under the conditions of Art. 2(1), for example if they place AI systems on the EU market or the output of their AI systems is used in the EU.
• Since when? 2 February 2025, fully applicable. Not postponed by the Digital Omnibus, but rewritten in July 2026.
• How to comply? A documented, role-based training concept. No certificate required, but evidence is expected.

What Article 4 specifically requires

Since the Digital Omnibus rewrote it, Article 4 requires providers and deployers to take measures that support the development of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. Until July 2026, the text required them to ensure, to their best extent, a "sufficient level" of AI literacy. The new text drops that target and does not require any specific level of AI literacy for any individual (European Commission Q&A).

The measures still have to take into account the technical knowledge, experience, education and training of the persons concerned and the context the AI systems are to be used in, and consider the persons or groups of persons on whom the AI systems are to be used (Art. 4(1) as amended by Regulation (EU) 2026/1744).

Importantly, the provision mandates no certificate and no external certification. However, documentation of the literacy program is expected. An authority will usually rely on this documentation when it checks compliance. Anyone unable to present a demonstrable measure will have a problem in the event of an audit, even if the staff is in fact trained.

Since when the obligation has applied and what the Digital Omnibus changed

Article 4 has applied since 2 February 2025, alongside the list of prohibitions in Article 5. AI literacy is therefore among the very first applicable obligations of the AI Regulation.

The Digital Omnibus was published in the Official Journal as Regulation (EU) 2026/1744 on 24 July 2026 and has been in force since 27 July 2026. It postpones the bulk of the high-risk obligations: Annex III now applies from 2 December 2027, Annex I from 2 August 2028. It does not postpone Article 4. In November 2025, the Commission had proposed turning the obligation into a mere mandate for the Member States and the Commission to promote AI literacy (European Commission Q&A). What was adopted instead is the rewrite described above: the obligation stays with providers and deployers.

For AI literacy, this means unequivocally: the obligation is live today. There is no longer any transition period.

Who the obligation affects: providers and deployers

Unlike most obligations of the AI Regulation, Article 4 does not differentiate by risk tier. It applies across all four tiers, including minimal-risk applications such as internal RAG agents over non-sensitive documents or code-generation copilots for internal use.

The key classification for mid-sized companies in Germany and Austria: almost every company is a deployer, not a provider. Anyone using Microsoft 365 Copilot, Google Gemini for Workspace, ChatGPT Enterprise, Anthropic Claude for Work or specialized vendor tools is a deployer and therefore subject to Article 4. A widespread fallacy is: "We only use Microsoft 365 Copilot, so we are out of scope." Wrong: the mid-market deployer is the responsible operator, and the AI literacy obligation applies to it regardless of the tool.

How to comply in practice: the training concept

The European Commission's Q&A on AI literacy (first published May 2025, updated July 2026) names as a minimum: a general understanding of AI within the company, the company's role as provider or deployer, the risk of the AI systems it provides or deploys, and measures built on that analysis and tailored to prior knowledge and context of use. This calls for a role-based and risk-proportionate approach. Building on that, we recommend the following content:

• Awareness of what AI is and how it differs from conventional software (in line with the definition guidelines of 6 February 2025).
• The four risk tiers and the basic obligations applicable to the company's specific applications.
• How to recognize a prohibited practice under Article 5.
• Recognizing transparency triggers under Article 50 (chatbots, synthetic content, deepfakes).
• For staff with operational responsibility for high-risk systems: human oversight expectations (Art. 14, Art. 26(2)), incident reporting obligations (Art. 26(5), Art. 73) and the information obligation under Art. 26(7) toward workers' representatives and affected workers before high-risk AI is used in the workplace. Co-determination rights of the works council come from national employment law: in Austria, for example, for control measures and technical systems used to monitor employees, where they affect human dignity (§ 96(1) no. 3 ArbVG), in Germany for technical devices designed to monitor employees' conduct or performance (§ 87(1) no. 6 BetrVG).
• For developers and procurement: vendor due diligence and the substantial modification trap (Art. 25).
• For executives: fine risk (Art. 99) and governance responsibility.

Mapping roles to competence levels

Practical implementation begins with a role matrix. A mapping to the levels of leadership, management, operational, technical and end user is recommended. A 200-person mid-sized company typically manages with 3 to 5 distinct competence modules; a DAX/ATX/SMI corporation with 5,000+ employees is more likely to need 10+ modules.

Documentation, localization and dovetailing

Four practical guardrails apply:

• Document training: attendance records, content versioning, periodic refreshers.
• Localize content: German for DE/AT, German/French/Italian for CH, taking into account the applicable anti-discrimination and data protection frameworks.
• Coordinate with the works council: Where AI is used in the workplace, discuss the training concept with it early. Article 4 does not require this, but it eases the rollout.
• Refer to authoritative sources: the BNetzA AI Service Desk (Bonn), the RTR AI Service Point (Vienna) and FINMA's risk monitor materials (for staff in the financial sector).

The fine risk

Article 4 has no fine of its own under the AI Act: Article 99 does not mention it in any of its three fine tiers. Penalties for breaches of Article 4 are laid down by the Member States under Art. 99(1). Since 2 August 2026, national market surveillance authorities have been responsible for supervising and enforcing the obligation. Any sanction must be proportionate and based on the individual case (European Commission Q&A).

In an audit, what counts is what you can document. Article 4 contains no separate documentation requirement, but the Commission's Q&A names internal records of training and other measures as possible evidence. According to the Q&A, a sanction is more likely if an incident can be traced back to inadequate training or guidance of staff.

Missing AI literacy gets expensive when it leads to breaches of obligations that do carry fines. Article 99 sets three tiers, and the higher amount applies in each case:

• Art. 99(3): prohibited practices under Article 5, up to EUR 35 million or 7% of worldwide annual turnover.
• Art. 99(4): an exhaustive list of obligations of providers, deployers and other operators, mainly Art. 16 and Art. 26 for high-risk systems (for example human oversight under Art. 26(2)) and the transparency obligations under Art. 50, up to EUR 15 million or 3%.
• Art. 99(5): incorrect, incomplete or misleading information supplied to authorities or notified bodies, up to EUR 7.5 million or 1%.

For SMEs and start-ups, Article 99(6) applies the lower of the two figures (absolute amount or percentage), not the higher. With the new Art. 99(6a), the Digital Omnibus extends this protection to small mid-cap companies (SMCs), but only for the fines under Art. 99(4) and (5), not for prohibited practices.

Worked example with figures

An Austrian industrial mid-sized company with 180 employees and EUR 40 million annual turnover deploys an agentic research and quotation copilot (minimal risk). The management considers AI literacy "not relevant, because it is not a high-risk system".

Legally, this is a fallacy: Article 4 applies across all risk tiers. A fine under the AI Act cannot be calculated for a pure Article 4 breach, though, because the penalty is set by national law. What can be calculated is a knock-on breach. Suppose the company later builds its own customer chatbot and, because nobody on the project team knows the disclosure obligation, customers are not told they are talking to an AI. That breaches Art. 50(1) and falls under Art. 99(4): up to EUR 15 million or 3% of worldwide annual turnover. As the company qualifies as an SME with fewer than 250 employees and below the turnover threshold, Article 99(6) applies the lower figure, here 3% of EUR 40 million = EUR 1.2 million. This cap applies to the knock-on breach; it is not an Article 4 fine. Set against this is a compliant training concept: 4 modules for around 180 people, annual refreshers, documented attendance in the LMS. The effort is in the low four- to five-figure euro range. The ratio of implementation effort to risk exposure makes the prioritization unambiguous.

For agencies and B2B decision-makers

Marketing agencies are doubly affected: as deployers of their own AI tools (copywriting agents, image and video generators) and as advisors to their clients, who must themselves demonstrate AI literacy. Anyone who sets up a documented, role-based competence program covers their own Article 4 obligation and at the same time creates a sellable advisory module, including dovetailing with transparency obligations (Art. 50) and informing workers' representatives (Art. 26(7)). For B2B decision-makers, AI literacy is the pragmatic entry point into the entire AI Act compliance: it is mandatory, due immediately and achievable with manageable effort.

We support DACH companies and agencies in building an audit-proof AI literacy program: from the role matrix through localized modules to the documentation structure.

Note: This article serves general information purposes and does not constitute legal advice. For a binding assessment of your specific individual case, please seek qualified legal counsel.