# AI Literacy Under Article 4: What Companies Actually Need to Do

> Since the July 2026 AI Omnibus, Article 4 requires measures that support the AI literacy of staff and contractors, not a certificate or a guaranteed level. In practice: map your AI use, train by role, set usage rules and keep records.

Canonical URL: https://www.ruebstudio.de/en/guides/ai-law-and-compliance/ai-literacy-article-4-ai-act  
Author: Dr.-Ing. Marcus Rüb, Founder  
Published: 2026-10-14

The EU's AI literacy rule, Article 4 of the AI Act, has applied since 2 February 2025. In July 2026 the EU's AI Omnibus rewrote it into a lighter duty, and many companies now wonder what is left. This guide explains the position as of October 2026 and shows a proportionate way to comply for a mid-sized company. It is orientation, not legal advice.

## What is the AI literacy requirement?

The AI literacy requirement obliges organisations that build or use AI systems to support their staff and contractors in using AI competently. The aim is that people understand what AI tools can and cannot do, spot errors and judge outputs before acting on them.

[Article 3(56) of the AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689) defines AI literacy as the skills, knowledge and understanding that let people make an informed deployment of AI systems and be aware of their opportunities, risks and possible harm. It is about judgement at work, not coding.

The duty applies to two roles defined in the Act:

- **Providers** develop an AI system, or have one developed, and place it on the market or put it into service under their own name.
- **Deployers** use an AI system under their own authority, other than for purely personal, non-professional activity.

Most mid-sized companies are deployers. If you give employees a chat assistant, a translation tool or an AI agent that drafts quotations, you are one. The [Commission's Q&A](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers) ties the depth of measures to the risk of the system, not the existence of the duty. Germany's market surveillance authority, the [Bundesnetzagentur](https://www.bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/7_Kompetenz/start.html), adds that it applies across sectors and company sizes and includes general-purpose tools such as chatbots.

## What did the AI Omnibus change?

The Omnibus turned an obligation of result into an obligation of effort. The original text asked companies to ensure, to their best extent, a sufficient level of AI literacy. The new text asks them to take measures that support its development and states that no specific level has to be guaranteed for any individual.

The amendment is [Regulation (EU) 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744), dated 8 July 2026 and published in the Official Journal on 24 July 2026. It entered into force on the third day after publication, 27 July 2026. The new Article 4 has three paragraphs:

1. Providers and deployers take measures to support the AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. They take into account technical knowledge, experience, education and training, the context of use, and the people the systems are used on. No specific level of literacy has to be guaranteed.
2. The Commission and Member States support companies, in particular SMEs. The Commission publishes practical examples of compliance on a single information platform.
3. The European AI Board adopts recommendations, including common objectives for promoting AI literacy.

Recital 8 of the Omnibus explains the reasoning: strict obligations to ensure a sufficient level did not suit every provider and deployer and added compliance burden, especially for smaller companies. The same recital says AI literacy should remain a strategic priority regardless of legal duties and penalties.

The Commission's original proposal of November 2025 went further. As the Commission's Q&A describes it, promoting AI literacy would have shifted mainly to the Commission and Member States. The co-legislators kept a duty on companies, just a softer one.

## Who has to be covered?

The duty covers your own staff and anyone who operates or uses your AI systems on your behalf. Employment status is not the test. Contractors and service providers working with your AI systems are included, and the Commission notes that clients can be relevant in some higher-risk situations.

The Commission describes the group as people broadly within the organisation's remit. A practical way to segment it:

- **Regular users.** Sales staff drafting proposals with an AI assistant, service technicians summarising fault reports with AI.
- **Decision makers.** Managers, buyers or HR staff who act on AI-generated analysis.
- **Operators and builders.** IT, developers and external partners who configure, integrate or monitor the systems.
- **Affected people.** Employees or customers whose data an AI system processes. They are not trainees under Article 4, but the new text asks you to consider them when designing your measures.

## How does compliance work? The building blocks

Compliance rests on four building blocks: an inventory of AI use, role-based learning, clear usage rules and records. The Bundesnetzagentur's guidance follows the same logic: identify needs, design measures, then document, evaluate and refresh them.

**Inventory.** List every AI system in use, approved or not, with its purpose, user groups, data types and an owner. Expect surprises, such as personal accounts on public chat services or AI features switched on inside existing office, CRM or ERP software.

**Role-based learning.** Not everyone needs the same depth. The Commission ties the scope of measures to the company's role, the risk of the system, people's existing knowledge and the context of use. The Bundesnetzagentur suggests layers: a baseline for everyone, advanced skills for heavy users, and role-specific training for special tasks.

**Usage rules.** A short acceptable-use policy states which tools are approved, which data must never go into them and when a human must check an output. A clear policy is itself a literacy measure: it turns knowledge into everyday rules.

**Records.** Note the type of measure, its scope, the date and who took part. The Bundesnetzagentur recommends this explicitly so that organisations can show they meet Article 4.

## Which measures fit which role?

Match measures to the mistakes each role can realistically make. People drafting text must recognise fabricated facts. People configuring AI agents must understand permissions and data flows. People deciding on the basis of AI analysis must know where it is unreliable.

A workable split for a mid-sized company:

| Role | Focus | Typical format |
|---|---|---|
| All users | How the tools work, limits, data rules, review duty | 60 to 90 minute session plus the policy |
| Heavy business users | Prompting, checking outputs, process integration | Hands-on workshop on a real process |
| Leadership | Risk, accountability, deployment decisions | Short briefing with worked cases |
| IT and developers | Configuration, access rights, logging, security | Technical training and vendor documentation |

The durations are rules of thumb, not legal requirements; the Act prescribes no length or format. E-learning paths, short internal sessions and documented on-the-job briefings all count as measures under the new wording.

One point from the Commission's Q&A deserves attention: simply pointing staff to the vendor's instructions for use is usually not enough, particularly for high-risk systems. A link to a chatbot's help centre will rarely carry the weight on its own.

In our own operations, sessions built around real work stick far better than generic slides. Watching a model confidently invent a part number in an actual quotation teaches more about checking outputs than any explanation of neural networks.

## What do you need in place first?

The prerequisites are organisational rather than technical: a named owner, an overview of the AI systems in use, an agreed policy and one place to keep the records. A budget for external training helps but is not essential.

**Ownership.** Article 4 does not require an AI officer, as the Bundesnetzagentur confirms. Someone still needs to own the topic, often in IT, quality management or learning and development.

**Employee representation.** Where works councils or unions have rights over workplace technology, involve them early. In Germany, for example, introducing technical systems designed to monitor employee behaviour or performance requires works council co-determination under [section 87(1) no. 6 of the Works Constitution Act](https://www.gesetze-im-internet.de/betrvg/__87.html). Many AI tools log usage, which can bring them into scope.

**Data protection.** AI literacy and data protection overlap heavily. Which personal data may go into which tool belongs in every baseline session. If you want AI systems that can be operated in line with the GDPR, for example on infrastructure you control, see the section on [sovereign AI](https://www.ruebstudio.de/en/sovereign-ai).

**Record keeping.** A list maintained by HR or in your learning management system is enough, as long as it is complete and current.

## A five-step rollout

A mid-sized company can set this up in a few weeks. What matters is not volume but that every measure matches how AI is actually used and that it is recorded. The steps below build on each other and use resources most companies already have.

1. **Build the AI inventory.** Capture every AI system, including AI features inside existing software, with user groups and data types.
2. **Map roles to needs.** For each user group, write down what it must be able to do. This drives your choice of measures and is the first part of your records.
3. **Adopt a policy.** Approved tools, forbidden data, review duties, a contact person. Two or three pages usually suffice.
4. **Run the measures.** A baseline for all, deeper formats for heavy users and owners. Internal and external formats can be combined; one option is a [hands-on AI workshop](https://www.ruebstudio.de/en/workshop) built around your own processes.
5. **Record and refresh.** Log attendance, content and date. Retrain when new systems, new roles or significant model changes arrive, and review the inventory at least once a year.

If you are planning several AI initiatives, tie these steps into your wider roadmap; the [fractional head of AI](https://www.ruebstudio.de/en/fractional-head-of-ai) page describes one way to organise that.

## How is Article 4 enforced?

National market surveillance authorities supervise Article 4, not the EU AI Office. The AI Act sets no dedicated fine tier for it, and penalties depend on national law. In practice the bigger exposure is indirect: after an incident, missing measures make your position weaker.

The details:

- **Timing.** Under [Article 113](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689), Article 4 has applied since 2 February 2025. According to the [Commission](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers), the supervision and enforcement rules apply from August 2026.
- **Authorities.** Each Member State designates its own. In Germany it is generally the Bundesnetzagentur, with special responsibilities for sectors such as financial services.
- **Fines.** Article 99(4) lists the obligations that carry fines of up to 15 million euros or 3% of turnover; Article 4 is not on that list. Member States may still lay down other penalties and enforcement measures under Article 99(1).
- **Indirect effects.** The Commission notes that a lack of appropriate training is more likely to lead to sanctions if something goes wrong. The Bundesnetzagentur treats missing AI literacy as a possible breach of the duty of care, which can matter in liability disputes.

## What extra applies to high-risk AI?

High-risk AI systems carry their own competence requirement on top of Article 4. Deployers must assign human oversight to people with the necessary competence, training and authority. After the Omnibus, this applies to systems listed in Annex III from 2 December 2027.

The rule sits in Article 26(2) of the AI Act. The [Omnibus](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744) postponed the high-risk obligations to 2 December 2027 for Annex III systems, such as certain AI used in recruitment, and to 2 August 2028 for Annex I systems that are part of regulated products. The softer Article 4 does not change these requirements; the Commission stresses that the oversight training obligation remains.

For most mid-sized companies using chat assistants, text generation or AI agents for quotations and service, the general Article 4 is what matters. If you use AI to screen applicants or assess employee performance, check the high-risk classification separately.

## Limits and risks

The softer wording tempts companies to drop the topic altogether. That is risky, because the real damage rarely comes from the regulation. It comes from misuse: confidential data pasted into public services, unchecked figures in customer documents, decisions based on invented sources.

Common gaps:

- **Training detached from use.** A generic online course that ignores the tools people actually use ticks a box but changes little.
- **No records.** Training without documentation cannot be shown later.
- **Shadow AI.** Tools nobody approved never reach the inventory and never get covered.
- **One-off effort.** Tools change quickly. A session from early 2025 may not cover AI agents that take actions on their own.
- **Over-engineering.** Expensive certification programmes for every employee are not legally required. The budget is better spent on heavy users.

This guide reflects the position in October 2026 and is not legal advice. Commission guidance, AI Board recommendations and national enforcement practice will continue to shape how Article 4 is read.

## Where should you start?

Start with the AI inventory, because without it you can neither train sensibly nor document anything. Then adopt a policy, run a baseline session for everyone and add deeper formats for the groups that use AI daily. Record everything in one simple list.

A two-week starter plan:

- Name an owner.
- Work with department heads to list every AI tool, including unofficial ones.
- Draft a policy and agree it, with employee representatives where they exist.
- Schedule a first baseline session and record attendance.
- Plan a practical format for the two or three most intensive user groups.

More articles on AI law and strategy are collected in the [guides section](https://www.ruebstudio.de/en/guides), and terms such as deployer or high-risk AI are explained in the [glossary](https://www.ruebstudio.de/en/glossary).

## Frequently asked questions

### Do employees need an AI literacy certificate?

No. The European Commission's Q&A states plainly that no certificate is needed. Organisations can keep an internal record of training and other measures instead.

### Does Article 4 apply if we only use ChatGPT, Copilot or Claude?

Yes. Using an AI system under your own authority for professional purposes makes you a deployer, whatever your sector or size.

### Is there a fine for ignoring Article 4?

Article 99(4) of the AI Act does not list Article 4 among the obligations with a specific fine tier. National authorities can still act under national law, and missing measures weigh against you after an incident.

### Does the rule apply to companies outside the EU?

It can. Under Article 2, the AI Act covers deployers located in the EU and also non-EU providers and deployers whose AI output is used in the EU, so international groups should check each entity.

### Did the Omnibus remove the AI literacy duty?

No. It softened it. Instead of ensuring a sufficient level of literacy, providers and deployers must now take measures that support its development.

## Sources

- [Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L of 24 July 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744)
- [Regulation (EU) 2024/1689 (AI Act), Articles 2, 3(56), 26, 99 and 113](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689)
- [European Commission: AI Literacy – Questions & Answers](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers)
- [German Works Constitution Act (BetrVG), section 87](https://www.gesetze-im-internet.de/betrvg/__87.html)
- [Bundesnetzagentur (German market surveillance authority): KI-Kompetenz](https://www.bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/7_Kompetenz/start.html)