The AI literacy obligation under Art. 4
Since 2 February 2025, companies must ensure that everyone working with AI systems on their behalf has a sufficient level of AI literacy.
What does Article 4 require?
Article 4 of the EU AI Act (Regulation (EU) 2024/1689) obliges providers and deployers of AI systems to ensure that their staff and all other persons operating or using AI systems on their behalf have a sufficient level of AI literacy. The law deliberately uses open-ended language: the requirements depend on the knowledge, experience and training of the individuals concerned, the specific context in which the AI system is used and the groups of people it affects. The legislator does not prescribe a rigid catalogue of learning content. What matters is that the competence is demonstrable and proportionate to the system in use.
When did the obligation take effect?
Article 4 is not a future concern. It has applied since 2 February 2025, the first significant milestone of the EU AI Act, on which the ban on unacceptable AI practices and the literacy obligation both became directly applicable. Companies that have taken no action to date are already in a state of non-compliance. All further dates — including the extensive obligations for high-risk AI from 2 August 2026 — are set out on the deadlines page.
Who does it apply to?
The EU AI Act distinguishes two main groups, both of which are covered by Article 4:
Providers
Companies or individuals that develop an AI system or place it on the market under their own name. They bear the most extensive obligations under the EU AI Act.
Deployers
Anyone who uses an AI system in the course of their professional activities or on their own responsibility, and that applies to most companies.
All company sizes
Whether a large corporation, an SME or a start-up: anyone who uses AI professionally is affected. The obligation has no minimum size and no sector exemption.
Every risk class
Even using simple AI tools — for example for writing assistance or image editing — triggers the obligation to ensure competence.
The most common misconception is: "We don't develop AI, so this doesn't affect us." In reality, professional use of an AI tool is sufficient to qualify as a deployer and trigger the obligation. More about the roles and the risk-based approach of the Regulation is explained on the EU AI Act overview page.
What does AI literacy mean in practice?
The law defines AI literacy as the skills, knowledge and understanding that enable people to use AI systems knowledgeably and to recognise their effects. In practice, this means employees — appropriate to their role — should understand:
- how AI systems work in principle, where their limits lie and why they can produce errors;
- what opportunities and risks are associated with the specific use, including biases, so-called "hallucinations" and data protection issues;
- how AI outputs can be critically assessed, questioned and corrected where necessary;
- which legal and ethical frameworks — in particular the EU AI Act — apply to their own working environment.
Literacy is not a one-off state, but an ongoing process: new AI tools require new assessments. Training should therefore be repeated and updated on a regular basis.
How do companies fulfil the obligation?
The law does not prescribe a specific format. Two things are decisive: the measures must be appropriate and they must be demonstrably documented. A documented training course with a knowledge assessment and an individual certificate has proven effective. The AI-Konform training covers the relevant subject areas in four lessons: AI basics, the EU AI Act, safe use of AI and AI in everyday work. The format is deliberately compact at 30 to 60 minutes per person, so that even large teams can meet the obligation without lengthy training downtime. After the final quiz, participants receive a personal certificate; the company automatically receives an ISO 27001-compliant audit report and a Compliance Score as proof for authorities and auditors.
- Record AI use in the company and identify the relevant roles.
- Train employees in a role-appropriate way and in their preferred language.
- Archive participation, test results and certificates in a verifiable manner.
What are the consequences of non-compliance?
Failure to comply with the AI literacy obligation under Article 4 risks fines at the middle penalty tier of the EU AI Act: up to €15 million or 3 per cent of global annual turnover, whichever is higher. For SMEs and start-ups, the lower of the two amounts applies as the cap. The highest fine tier (up to €35 million or 7 %) is reserved exclusively for infringements of the prohibited practices under Article 5 and expressly does not apply to literacy violations. All three fine tiers and the corresponding offences are explained in detail on the fines page.
Frequently asked questions about the AI literacy obligation
Do employees need to become AI experts?
No. Article 4 requires a sufficient level of competence, proportionate to the relevant role and the AI system in use. A clerk who occasionally uses an AI writing assistant does not need in-depth technical knowledge. What matters is that they know the tool's limits, can assess outputs critically and are aware of where the legal boundaries lie. A compact training course with a knowledge assessment and an individual certificate is generally sufficient, and is at the same time the proof required by law.
Does the obligation apply even if we only use AI occasionally?
Yes. The law does not depend on the frequency of use, but on professional deployment. Anyone who uses an AI system even occasionally in a professional context qualifies as a deployer and must ensure that the relevant individuals are sufficiently competent. Further answers to common questions about the EU AI Act, deadlines and training obligations can be found on our FAQ page.
Train your team now Explore the training
Note: this article is for general information only and does not constitute legal advice.