What does the AI literacy obligation mean?
The term, KI-Schulungspflicht in German, refers to Article 4 of the AI Act, Regulation (EU) 2024/1689. Article 4 does not prescribe training as such. It requires measures through which a company supports the AI literacy of the people who work with AI systems on its behalf. A training course is one such measure; a briefing or a usage policy are others.
AI literacy, under Article 3(56) of the AI Act, means the skills, knowledge and understanding that allow an informed deployment of AI systems and create awareness of their opportunities, risks and possible harm. Anyone who uses an AI system should therefore also know its limits, such as invented content, bias and the handling of confidential data.
What does Article 4 require since the Digital Omnibus?
Since July 27, 2026, Article 4 applies as amended by Regulation (EU) 2026/1744. Under paragraph 1, providers and deployers take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The yardstick is their technical knowledge, experience, education and training, the context of use and the persons on whom the system is used.
Sentence 2 makes clear that the obligation does not require providers or deployers to guarantee a particular level of AI literacy for any person. The 2024 version still required them to ensure, "to their best extent", a "sufficient level" of AI literacy.
Paragraphs 2 and 3 address the Commission, the Member States and the AI Board. The Commission publishes practical examples of how to meet the obligation on the information platform referred to in Article 62(3)(b), and the AI Board adopts recommendations. The EU AI Act guide shows how Article 4 fits with the regulation's other duties.
Who has to build AI literacy?
The duty applies to all providers and deployers of AI systems within the scope of the AI Act, regardless of sector, size and the risk level of the system. Under Article 3(4) of the AI Act, a deployer is anyone using an AI system under its own authority, except in the course of a personal, non-professional activity. If staff use an AI assistant at work for texts, translations or analysis, the company is a deployer and falls under Article 4.
Besides the company's own employees, the duty covers people who work with AI systems on its behalf. The German Federal Network Agency (Bundesnetzagentur) names contractors and service providers as examples in its guidance paper on AI literacy; the paper dates from June 2025 and refers to the version before the Digital Omnibus. If service providers work with AI systems for you, address the topic in the contract as well. The article on roles and obligations under the AI Act explains how providers and deployers differ.
What belongs in the measures?
In its questions and answers on AI literacy, the European Commission names four steps that providers and deployers should consider at a minimum:
- Build a general understanding: what AI is, how it works, which AI systems the company uses, and what opportunities and dangers they bring.
- Clarify the company's role: does it develop AI systems or deploy systems built by others?
- Consider the risk of the systems: what staff need to know about the specific system, and which risks and mitigations they should be aware of.
- Build the measures on that analysis: by the target groups' prior knowledge, the purpose of use, the sector and the persons affected.
According to the Commission, legal and ethical questions are part of this, including the AI Act itself. The Bundesnetzagentur recommends an interdisciplinary, step-by-step structure. One possible split by audience, as an example rather than a requirement of the regulation:
| Audience | Possible content |
|---|---|
| all staff with access to AI | approved tools, handling of confidential and personal data, checking results |
| specialist users of a particular system | purpose and limits of the system, known failure patterns, escalation path |
| development and product teams (providers) | data quality, testing, documentation, transparency obligations under Article 50 |
| management and team leads | roles under the AI Act, risk levels, responsibilities |
What does Article 4 not require?
Article 4 sets neither the format nor the content nor the duration of the measures. The Commission states that no strict requirements or mandatory trainings are imposed and that no certificate is needed. According to the Bundesnetzagentur's paper, Article 4 does not require formalized or standardized training, external certification of the measures, the appointment of an AI officer or regular prior checks by supervisory authorities.
How do you document AI literacy measures?
According to the Commission, an internal record of trainings and other measures is enough. The Bundesnetzagentur recommends recording the type, the scope of content and time, and the participants. It also points out that a lack of AI literacy can be seen as a breach of the duty of care, especially when damage results.
Fictional example of an entry; the details are invented for illustration:
| Field | Entry |
|---|---|
| AI system and purpose | writing assistant for customer service replies |
| Owner | head of customer service |
| Audience and prior knowledge | 14 customer service employees, no previous work with AI systems |
| Measure | 60-minute briefing by the team lead, plus the AI usage policy |
| Content | which customer data may be entered, recognizing invented content, checking every reply before sending, escalating complaints |
| Date and attendance | October 6, 2026, 13 of 14 employees; make-up session on October 20, 2026 |
| Acknowledgment of the policy | confirmed by all 14 employees |
| Next refresher | with a new model, a new purpose of use or after twelve months at the latest |
Keep one such entry per AI system and audience. When you introduce a new system, create the entry before its first use at work.
Who enforces Article 4, and are there fines?
According to the Commission, national market surveillance authorities supervise Article 4, not the AI Office, and have enforced it since August 2, 2026 (as of October 2026). The fine catalogs in Article 99(3) to (5) of the AI Act do not list Article 4. Under Article 99(1), however, Member States lay down penalties and other enforcement measures for infringements of the regulation, so national law governs this point.
Article 26(2) of the AI Act goes further: deployers of high-risk AI systems assign human oversight to natural persons who have the necessary competence, training and authority. This duty is in the fine catalog of Article 99(4). It applies with the high-risk requirements, which after the Digital Omnibus start on December 2, 2027 for Annex III systems and on August 2, 2028 for Annex I systems.
AI systems and briefings in Rizzqo
Rizzqo holds the AI Act as a taxonomy module in the asset register: an AI system your staff use is recorded as a supporting asset and classified under this taxonomy. An owner can be assigned to each asset. That establishes which systems are in use and who is responsible for them, which is where the audiences for a briefing come from. A briefing per system runs as a task that syncs both ways with Jira.