Art. 4 of the AI Regulation (Regulation (EU) 2024/1689, "EU AI Act" for short) obliges providers and deployers of AI systems to take measures to support the development of the AI literacy of their employees and of the persons dealing with AI on their behalf. According to the text of the provision, the decisive factors are the technical knowledge, experience, education, and training of the persons and the specific context in which the systems are used (Art. 4 EU AI Act, EUR-Lex, as amended by Regulation (EU) 2026/1744; until July 26, 2026, the obligation was to ensure, "to their best extent", a sufficient level of AI literacy).
The provision prescribes no specific format – neither a particular form of training nor a certificate of completion. What matters is the result: that the persons concerned can use AI systems competently and assess their opportunities as well as their risks. Art. 4 is thus the central basis of the much-cited "AI training obligation" – even though the text of the Regulation mentions the word "training" only as one of several possible measures. The obligation is deliberately worded to be technology-neutral and results-oriented.
The background is the Regulation's aim of promoting trustworthy AI use that complies with fundamental rights: only those who know the limits and risks of a system can use it responsibly and avoid wrong decisions. AI literacy is therefore not an end in itself but a prerequisite for legally compliant use in companies.
The term is defined in Art. 3 no. 56 EU AI Act: AI literacy means "skills, knowledge and understanding that allow … to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause". The definition is deliberately broad and covers providers, deployers, and affected persons alike (further terms in the AI glossary).
"Sufficient" is a relative standard: the Regulation specifies neither a uniform minimum standard nor a number of hours. How deep the literacy must go depends on three factors – the person's prior knowledge, their task, and the risk of the specific use. Someone who uses an AI system only for text research needs a different level of literacy than a team that operates a high-risk system under Annex III. Which applications are considered high-risk is classified by the EU AI Act via its risk categories – an overview can be found in our article on the risk categories of the EU AI Act.
From the definition in Art. 3 no. 56 and the European Commission's interpretation, several building blocks of literacy can be derived, which vary in depth depending on the role:
These building blocks are not an exhaustive checklist but a point of orientation. The link to the specific use remains decisive: a team that uses AI only in a supporting role needs above all risk awareness and review skills; anyone who configures AI systems or integrates them into processes needs a deeper technical understanding.
Art. 4 addresses two roles that the EU AI Act clearly distinguishes:
The obligation applies to both groups regardless of sector, legal form, and company size. For most companies, the deployer role is the relevant one: even the professional use of generally available tools – such as an AI chatbot for creating texts – can trigger the deployer obligation under Art. 4. A minimum turnover or an employee threshold is not provided for in the text of the provision (Art. 3, Art. 4 EU AI Act). Responsibility always remains with the organization that deploys the persons – it must ensure the literacy of its employees and of commissioned third parties.
Expressly covered are not only permanent employees but also persons who deal with the AI system on behalf of the company – such as temporary agency workers or external service providers. Anyone who uses such persons must take their literacy into account in the same way as that of their own workforce.
The AI literacy obligation under Art. 4 has applied directly since February 2, 2025 (Art. 113 subparagraph 3 lit. a EU AI Act) and was therefore binding from the outset. The key dates at a glance:
In Germany, the Federal Network Agency has been responsible for national enforcement as the market surveillance authority since July 29, 2026 (Section 2 (1) KI-MIG, BGBl. 2026 I no. 223); sectoral authorities remain responsible in their areas. Limit: A later enforcement date does not release anyone from the obligation itself – Art. 4 has been binding since February 2025, and omissions from the transition period may become relevant later.
A differentiated view is important here. Art. 4 is not specifically listed in the catalog of fines in Art. 99 (4) EU AI Act. An isolated violation of the AI literacy obligation alone therefore does not trigger a directly quantified EU fine range. The upper limits regulated there of up to 15 million euros or 3% of worldwide annual turnover apply to the obligations listed in Art. 99 (4) – such as deployer obligations under Art. 26 or transparency obligations under Art. 50 –, not to Art. 4 itself (Art. 99 EU AI Act). For comparison: violations of the prohibitions of Art. 5 are subject to fines of up to 35 million euros or 7% of annual turnover.
Relevance nevertheless arises in several ways: via the national rules on penalties to be laid down by the member states under Art. 99 (1), and in practice because a lack of AI literacy can be considered an aggravating circumstance in other violations. For small and medium-sized enterprises, Art. 99 also provides that the lower of the two values (fixed amount or percentage) applies in each case. Limit: Irrespective of fines, insufficient AI literacy can become relevant under liability and due-diligence law – for example in the event of damage caused by improper use of AI.
The Digital Omnibus Regulation (Regulation (EU) 2026/1744) was published in the Official Journal of the EU on July 24, 2026, and has been in force since July 27, 2026 (European Commission, 27 Jul 2026). It gives Art. 4 EU AI Act a new wording (Art. 1 no. 5): providers and deployers "take measures to support the development of the AI literacy of their staff and other persons"; they are expressly not required to guarantee a specific level of literacy for individual persons. The date from which the obligation applies – February 2, 2025 – remains unchanged.
In substance, this has removed the results orientation, which had previously already been limited to "best extent": the obligation to ensure a sufficient level of literacy has become an obligation to support the development of AI literacy. In addition, key obligations for high-risk systems under Annex III have been postponed to December 2, 2027, and for high-risk AI embedded in products under Annex I to August 2, 2028. In practice, this means: the AI literacy obligation continues to apply; training and documentation measures remain the means by which companies demonstrate the required measures. The new wording does not lower the requirements to zero but removes the guarantee of an individual level of literacy from the obligation. What else the Omnibus has changed is assessed in the article Digital Omnibus: What is changing in the EU AI Act.
Since the EU AI Act does not prescribe a format, a documented, risk-based approach is advisable. In practice, the following procedure has proven effective:
What the measures look like in concrete terms depends on the role: for the broad workforce that uses AI assistants in everyday work, a structured basic training course with practical examples is often sufficient. For specialists and managers who decide on the use of AI, in-depth modules on governance, liability, and the selection of suitable systems make sense. Technical teams that develop or operate AI additionally need training on data quality, testing procedures, and human oversight.
A common mistake is to neglect documentation: without a traceable record of content, participants, and date, the fulfillment of the obligation cannot be proven in case of doubt. Documentation is therefore just as important as the training itself.
The European Commission provides an FAQ on AI literacy for interpretation, but also emphasizes in it that there is no uniform standard. The documentation also serves as proof to the supervisory authority.
A note on our own behalf: Companies that do not want to build up the implementation themselves can use ready-made AI training courses from Bridgly, which can be rolled out via a learning platform and demonstrated with documented content, participants, and date. Whether such standard training is sufficient in an individual case still depends on role and deployment risk.
Further articles on AI literacy are collected in the Artificial Intelligence topic hub. Note: These instructions remain abstract and general and do not replace the assessment of the individual case.
This article evaluates the text of the Regulation (Regulation (EU) 2024/1689), the European Commission's AI literacy FAQ, and the official communications on the Digital Omnibus. Evaluation as of: 4 Sep 2026. No individual legal advice is provided.
Yes. The AI literacy obligation under Art. 4 EU AI Act applies regardless of sector and company size to providers (Art. 3 no. 3) and deployers (Art. 3 no. 4). Even the professional use of a generally available AI chatbot can trigger the deployer obligation. The required level of literacy depends on prior knowledge, task, and deployment risk.
Not necessarily. What matters is that the AI literacy fits the context of use – Art. 4 EU AI Act does not prescribe a fixed format. If new AI systems are introduced or the legal situation changes, adjustments must be made. Content, participants, and date should be documented, because the documentation serves as proof to the supervisory authority.
No. Neither Art. 4 nor Art. 3 no. 56 EU AI Act requires a certificate of completion or a specific form of training. A documented, risk-based approach has proven effective: an inventory of the AI systems, determination of the level of literacy for each role, and appropriate measures such as training or inductions – recorded in a traceable manner as proof to the supervisory authority.
Not directly. Art. 4 is not listed in the catalog of fines in Art. 99 (4) EU AI Act, so an isolated violation does not trigger an EU fine range of its own. Relevance arises via national rules on penalties (Art. 99 (1)) and as an aggravating circumstance in other violations. Irrespective of this, a lack of literacy can become significant under liability law.
Image license: AI-generated image (prompt see field „Bild-Prompt (KI-Bild)“), labeled "Created with AI" in line with Art. 50 EU AI Act; asset still to be generated and inserted.
Insights into the future of digital learning, with a focus on AI, compliance, and modern training solutions. Discover the latest posts and articles to gain practical insights into legally compliant, efficient, and automated corporate training.
Bridgly is the European training partner for audit-proof, tailored, and automated training and professional development.
We support the IHK initiative "Pack ma's digital" to help businesses in Upper Bavaria with digitalisation and secure the future of the region.Note: Some text, images, and videos on this website were generated using artificial intelligence.
All content is for informational purposes and has been carefully reviewed from a journalistic perspective, but does not claim to be exhaustive or legally binding.
.webp)