AI Literacy under EU AI Act Article 4: Putting the Training Obligation into Practice (2026)

Short answer: What Article 4 of the EU AI Act requires

Article 4 of the EU AI Act (Regulation (EU) 2024/1689) has, since 2 February 2025, required all providers and deployers of AI systems to ensure a sufficient level of AI literacy among their staff and all persons who work with AI systems on their behalf. There is no prescribed certification and no minimum number of hours – what is required is risk- and role-appropriate training that matches the knowledge, experience and context of use of the employees. For SMEs, this concretely means: a documented, recurring basic training plus in-depth modules for everyone actively using AI.

Who is affected – and from when?

The obligation applies to every company that operates AI systems (“deployer”) – not just tech firms. Anyone whose team uses ChatGPT, Microsoft Copilot, Gemini, Perplexity, DeepL, an AI CRM feature or automations with AI building blocks falls under it.

• Affected: marketing agencies (text, image, campaign AI), real estate offices (listing generation, lead scoring), law firms and tax advisors (document analysis, research), any service business with AI-supported workflows.
• Timeline: The AI Act entered into force on 1 August 2024. Article 4 has applied since 2 February 2025. The member states' governance and sanction structures have been in place since 2 August 2025; market surveillance is picking up speed in 2026.
• No exception for micro-enterprises: The AI Act provides SMEs with relief on documentation and fees, but not an exemption from the AI literacy obligation. The scope may, however, remain appropriately small.

What “sufficient AI literacy” means in practice

Article 3 No. 56 defines AI literacy as the skills, knowledge and understanding that enable an informed use of AI systems as well as awareness of opportunities, risks and possible harm. For SMEs, this translates into four core competencies:

1. Basic understanding: What is an AI/LLM system, how are answers generated, why do models “hallucinate”?
2. Risk awareness: data protection (GDPR), confidentiality, bias, fallibility, copyright.
3. Legal framework: prohibited practices (Art. 5), transparency obligations (e.g. labelling AI-generated content), handling high-risk applications.
4. Practical application skills: safe prompting, reviewing outputs (human-in-the-loop), selecting GDPR-compliant tools.

Legally compliant implementation in 6 steps

Step 1: Create an AI inventory

List all AI tools used in the company – officially approved and informally used (“shadow AI”). For each tool, record: purpose, data categories, provider, server location, legal basis.

Step 2: Define roles and risk levels

Not everyone needs the same depth. A proven role model:

• All employees: 60–90 min. basic training.
• Active AI users: an additional 1–2 hrs. application and prompting module.
• AI officers/admins: in-depth training on compliance, tool approval, GDPR/DPA.
• Management: short briefing on obligations, liability and governance.

Step 3: Define training content

Use the four core competencies above as your curriculum. Enrich them with company-specific examples – for instance: “No client data in public chatbots” or “Always fact-check AI-generated property listings”.

Step 4: Deliver and document

What matters is the evidence. The AI Act does not require external certification, but market surveillance authorities can request proof. Document: list of participants, date, content, duration, trainer, and the result of a short comprehension test.

Step 5: Anchor an AI policy

A short internal AI usage policy (2–4 pages) makes the training binding: permitted tools, data taboos, labelling obligations, escalation paths.

Step 6: Repeat and update

AI evolves quickly. Plan an annual refresher plus ad-hoc updates when new tools or rules arrive. Onboarding of new employees must include the basic training.

Template: AI literacy training for SMEs (copy-ready)

Use this framework as documentation evidence. Fill in the fields, sign, archive.

Part A – Record sheet

• Company / department: ____________
• Date & duration: ____________
• Delivered by: ____________
• Participants (name, role, signature): ____________
• Materials used / version: ____________

Part B – Mandatory curriculum (all employees)

1. What is AI/an LLM? How do answers and hallucinations arise?
2. The EU AI Act in 10 minutes: purpose, risk classes, Article 4.
3. Prohibited practices (Art. 5) – in everyday examples.
4. GDPR & confidentiality: which data must never go into an AI tool?
5. Transparency: labelling AI-generated content.
6. Human-in-the-loop: always review and take responsibility for outputs.

Part C – Deep dive (active AI users)

1. Approved tools and their safe use.
2. Fundamentals of effective prompting.
3. Recognising bias, errors, copyright risks.
4. Company-specific use cases and limits.

Part D – Comprehension test (5 short questions)

Example: “Name two types of data that never belong in a public AI tool.” – passed with 4/5 correct answers.

Sanctions: What happens if you ignore it?

Article 4 itself is not backed by its own fixed fine – unlike the prohibited practices of Article 5 (up to EUR 35 million or 7% of worldwide annual turnover). Still, underestimating it is risky:

• National market surveillance authorities can treat missing AI literacy as an aggravating factor during audits and in the context of other violations.
• In the event of AI-related damage, inadequate training can increase civil liability and breaches of duty of care.
• In Germany, the market surveillance structure (Bundesnetzagentur as the coordinating body) is gradually stepping up enforcement in 2026.

In short: the best protection is a clean, dated record – not hoping for a missing fine.

GDPR-compliant AI workflows as the foundation

AI literacy and data protection go hand in hand. For DACH companies, we recommend:

• Data processing agreements (DPAs) with every AI provider that processes personal data.
• Prefer EU data residency or enterprise plans with model training disabled.
• RAG instead of raw data: instead of pasting sensitive documents into public chats, connect them in a controlled way via retrieval-augmented generation over secured, internal sources.
• Design automations (e.g. with Make or n8n) so that data does not leave the EU unnecessarily.

Mindflows implements such GDPR-compliant AI and automation workflows for agencies, real estate offices and law firms in Frankfurt and the DACH region – including training and documentation templates.

FAQ