AI Literacy Obligation: What Article 4 Requires Since 2026

Blog · AI Literacy Obligation

The AI literacy obligation in Article 4 of the EU AI Act has applied since 2 February 2025 to every business that uses AI systems, including the office team that works with ChatGPT. Since 27 July 2026 it applies in amended form: you have to take measures that support the development of AI literacy, but you do not have to guarantee a specific level of competence for any individual. No certificate is required. Both the European Commission and Germany's Federal Network Agency (Bundesnetzagentur) recommend internal documentation. And the frequently quoted fine of 35 million euros applies to prohibited AI practices, not to the AI literacy obligation.

In brief

Article 4 has applied since 2 Feb 2025 to providers and deployers of AI systems, regardless of sector or company size.
Since 27 Jul 2026 the duty reads: take measures. A business no longer owes a fixed level of competence per person.
In Germany, the Federal Network Agency (Bundesnetzagentur) has been the market surveillance authority as a general rule since 29 Jul 2026. Some sectors keep their own supervisory authority.
No certificate needed, but an internal record: who, when, what content, for which AI tools.

Published 25 Sep 2026Nikolai Schöbel and Jeremias Burger9 min read

Nikolai Schöbel and Jeremias Burger

Co-founders of Scalableloops GmbH. Nikolai Schöbel leads online marketing and AI strategy, Jeremias Burger the AI architecture. Both build AI systems and train teams on them in their own agency work.

On this page

What does Article 4 of the EU AI Act require since the 2026 amendment?
Does the AI literacy obligation apply to your business?
What fine applies if AI training is missing?
Who checks AI literacy in Germany?
What should a business document about AI training?
What does AI training look like that holds up in daily work?
Frequently asked questions
How to put your AI literacy obligation into a form that stands up to checks
Where the information on this page comes from

Legal position

What does Article 4 of the EU AI Act require since the 2026 amendment?

Regulation (EU) 2024/1689, known internationally as the AI Act, deals with AI literacy in Article 4. The provision sits in Chapter I of the regulation and has therefore applied since 2 February 2025.

In the original wording, providers and deployers had to take measures to ensure, "to their best extent", a "sufficient level of AI literacy" among their staff. The amending Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It rewrote Article 4.

The new wording requires providers and deployers to take measures to support the development of AI literacy among their staff. The added sentence is what matters in practice: the obligation does not require them "to guarantee a specific level of AI literacy for any person". A business owes the measure, not a provable learning outcome for every single person.

Paragraph 2 is also new: the European Commission and the Member States support businesses, explicitly including small and medium-sized enterprises. The Commission publishes practical examples for this on a central information platform.

Point	Wording until 26 Jul 2026	Wording since 27 Jul 2026
Core of the duty	Measures to ensure, to the best extent, a sufficient level of AI literacy	Measures to support the development of AI literacy
Competence level per person	Sufficient level as the goal	Explicitly no specific level owed
Who is covered	Staff and persons dealing with AI systems on the organisation's behalf	Unchanged: staff and persons acting on its behalf
Support from the EU and Member States	Not regulated	New in paragraph 2, with a focus on SMEs

Scope

Does the AI literacy obligation apply to your business?

Very likely, yes. The Bundesnetzagentur describes those covered as providers and deployers of AI systems, including general-purpose systems such as chatbots, regardless of economic sector or size of organisation. A deployer is anyone who uses an AI system under their own authority in a professional context.

In its questions and answers on AI literacy, the European Commission addresses exactly the everyday case: a company whose employees use ChatGPT for advertising copy or translations falls under Article 4. Employees should be informed about the specific risks, and the Commission gives made-up content, so-called hallucinations, as an example.

People outside your workforce are covered too. Article 4 refers to "other persons" dealing with the operation and use of AI systems on the organisation's behalf. The Bundesnetzagentur names contractors and service providers as examples. If an agency, a freelancer or a temporary worker uses AI on your behalf, that person belongs in your considerations.

Fines

What fine applies if AI training is missing?

This is where most of the uncertainty comes from. Many pages put figures of 35 million euros or 7 percent of worldwide annual turnover next to the AI literacy obligation. That ceiling is set out in Article 99(3) of the AI Act and applies to non-compliance with the prohibited AI practices under Article 5, such as manipulative techniques. It has nothing to do with the AI literacy obligation.

The second tier of up to 15 million euros or 3 percent in Article 99(4) is also tied to an exhaustive list: obligations of providers, authorised representatives, importers, distributors and deployers under specific articles, plus transparency obligations under Article 50. Article 4 is not on that list.

That does not make the duty toothless. According to the European Commission, national market surveillance authorities can enforce breaches of Article 4 with penalties and other measures based on national law, in each case proportionate and tailored to the individual case. Anyone who gives an authority incorrect, incomplete or misleading information in response to a request risks up to 7.5 million euros or 1 percent of annual turnover under Article 99(5).

The third point is liability. The Bundesnetzagentur points out that a lack of AI literacy may be regarded as a breach of the duty of care, especially if it leads to damage. It therefore recommends documenting the measures well.

Fine range	What it applies to	Covers Article 4?
up to €35m or 7% of annual turnover	Prohibited AI practices under Article 5	No
up to €15m or 3% of annual turnover	Exhaustive list of obligations, including deployers under Article 26 and transparency under Article 50	No, Article 4 is not listed
up to €7.5m or 1% of annual turnover	Incorrect, incomplete or misleading information to authorities	Indirectly, if you answer a request incorrectly

€35m

This fine ceiling applies to prohibited AI practices under Article 5, not to the AI literacy obligation under Article 4.

Article 99(3) Regulation (EU) 2024/1689

Supervision

Who checks AI literacy in Germany?

The German act on AI market surveillance and innovation promotion (KI-Marktüberwachungs- und Innovationsförderungs-Gesetz, KI-MIG) entered into force on 29 July 2026. Under Section 2(1), the Bundesnetzagentur is the market surveillance authority responsible for compliance with the AI Act, unless the act provides otherwise. It does provide otherwise mainly for sectors with their own supervisory authority: in the financial sector, for example, BaFin remains responsible.

The Bundesnetzagentur is also the central point of contact and the central complaints office. Complaints about breaches of the AI Act are received there and passed on to the competent authority where necessary. For businesses it runs an AI Service Desk with information on building AI literacy.

On timing: the duty has existed since February 2025, and according to the European Commission, supervision and enforcement by national market surveillance authorities began in August 2026. Since then, an authority can ask what your business has done. The best answer is a file you already have.

Documentation

What should a business document about AI training?

The European Commission makes clear that no certificate is needed. Organisations can keep an internal record of training and other guidance measures. The Bundesnetzagentur takes the same view: no certification requirement, internal or external measures are possible, and the measures taken should be documented.

According to the Bundesnetzagentur, the following are not required: guaranteed competence levels for individuals, formalised or standardised training, external certification or a dedicated AI officer. That keeps the effort down. It also means you have to explain yourself why your measures suit your business.

From our work with businesses, a lean file that answers five questions has proven useful. It is a recommendation, not a legal requirement.

Component	What goes in	Why it helps
AI tools in use	List of the systems used, such as chatbot, translation, image generator, AI features in industry software, with their purpose	Article 4 refers to the context in which AI systems are used
People involved	Who uses which tool, including service providers and freelancers acting on your behalf	The duty also covers persons acting on your behalf
Training record	Date, duration, participants, content, materials or slides	Answers the question of who was trained on what content and when
Usage rules	Internal rules, for example on customer data, checking results, labelling	Shows that the risks of the systems in use have been considered
Refresher	Next date and trigger, such as a new tool or a new feature	According to the Bundesnetzagentur, AI literacy should be refreshed regularly

In practice

What does AI training look like that holds up in daily work?

The AI Act does not prescribe a format. It does name the yardsticks: the technical knowledge, experience, education and training of the people involved, and the context in which the systems are used. The European Commission and the Bundesnetzagentur derive four reference points from this, which work well as a framework for training.

Training built around these points takes up a manageable share of your team's working time and delivers more than legal certainty: people who know where a chatbot helps reliably and where it makes up facts work faster and produce less rework. The Bundesnetzagentur puts it in similar terms: building AI literacy is in companies' own interest.

At Scalableloops we therefore build AI training around the tools and tasks that actually come up in your business, and we tailor it to prior knowledge: management needs different content from the team that writes copy or quotes every day.

01
Basic understanding
What is AI?
How do the systems your team uses work, and why can they be convincingly wrong?
02
Role
Provider or deployer?
Most businesses use AI and are therefore deployers. Anyone who offers AI systems themselves starts from a different position.
03
Risks
What can go wrong in use?
Made-up facts, handling of customer and employee data, checking results before passing them on.
04
Staying current
What has changed?
New tools and features keep arriving. A refresher keeps knowledge and documentation up to date.

Frequently asked questions

Does every employee need AI training?

Article 4 requires measures for staff and for persons acting on the organisation's behalf who deal with the operation and use of AI systems. Anyone in the business who does not use AI is not affected. The form of the measure depends on prior knowledge and the context of use, and the regulation does not prescribe uniform mandatory training.

Do you need a certificate for the AI literacy obligation?

No. The European Commission makes clear that no certificate is needed and that an internal record of training can be enough. The Bundesnetzagentur does not mention a certification requirement either, but recommends documenting the measures.

Since when has the AI literacy obligation applied?

Article 4 has applied since 2 February 2025. Since 27 July 2026 it applies in the version amended by Regulation (EU) 2026/1744.

Is there a fine for missing AI training?

The AI Act does not set a separate fine range for Article 4. The amounts of 35 million euros apply to prohibited practices under Article 5. According to the European Commission, national authorities can still impose proportionate penalties for breaches of Article 4 based on national law.

Who enforces the AI literacy obligation in Germany?

Since the KI-MIG entered into force on 29 July 2026, the Bundesnetzagentur has been the competent market surveillance authority as a general rule. For certain sectors the respective supervisory authority remains responsible, for example BaFin in the financial sector.

Does it apply if we only use ChatGPT?

Yes, Article 4 still applies. The European Commission names exactly this case: employees who use ChatGPT for advertising copy or translations should be informed about the specific risks, such as made-up content.

Next steps

How to put your AI literacy obligation into a form that stands up to checks

01
Take stock
List which AI tools are used in the business and by whom, including service providers acting on your behalf.
02
Tailor the training
Match the content to prior knowledge and use: basic understanding, your role as a deployer, risks of the specific tools.
03
Record it
Keep participants, date, content and materials in an internal file.
04
Schedule a refresher
Set a fixed date for the next round and a trigger, such as a new tool.