AI Literacy Under Article 4 AI Act

What the AI literacy obligation requires

AI literacy has been a legal obligation for providers and deployers of AI systems since 2 February 2025. Article 4 of the AI Act originally required them to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf.

Since 27 July 2026, a new wording introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744) applies: providers and deployers must "take measures to support the development of AI literacy" of those persons, and the obligation expressly "does not require providers or deployers to guarantee any specific level of AI literacy of any individual".

The amendment softens the standard, but it does not remove the duty. Any company in Germany that uses AI systems in its business — from chatbots and translation tools to AI features in HR or CRM software — is a deployer and must take appropriate measures. The obligation does not depend on the risk class of the AI system, but the measures required depend on the context: a team using generative AI for marketing copy needs different knowledge from a team using AI to screen job applicants.

Who is covered by Article 4

Article 4 applies to providers (who develop an AI system or have it developed and place it on the market or put it into service under their own name) and deployers (who use an AI system under their authority, except for purely personal non-professional activity). The measures must cover staff and "other persons dealing with the operation and use of AI systems on their behalf". According to the European Commission's questions and answers on AI literacy, this can include contractors, service providers and, depending on the risk, clients.

AI literacy is defined in Article 3(56) as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to gain awareness about the opportunities and risks of AI and the possible harm it can cause. The definition goes beyond technical skills: it includes awareness of legal and ethical risks.

What measures are appropriate

Neither the AI Act nor the Commission prescribes a specific format. The Commission's Q&A suggests a risk-based approach in four steps: build a general understanding of AI in the organisation, determine whether the organisation acts as provider or deployer, assess the risks of the AI systems it provides or deploys, and tailor measures to the knowledge of staff and the context of use, including legal and ethical aspects. According to the Q&A, no certificate is needed, and Article 4 does not entail an obligation to measure employees' knowledge of AI.

Typical measures in German companies include:

• Basic training for all employees using AI tools: how generative AI works, its limitations (for example hallucinations and bias), confidentiality and data protection, and the company's AI policy.
• Role-specific training for teams using AI in sensitive contexts, such as HR, finance, legal, customer service and software development.
• In-depth training for those responsible for AI governance, procurement and human oversight.
• Guidelines and policies on permitted tools, input of personal data and trade secrets, labelling of AI-generated content and escalation.
• Ongoing measures such as e-learning updates, internal communities of practice and briefings when new tools are introduced.

Documentation

The AI Act does not require a specific form of documentation. The Commission's Q&A notes that organisations can keep an internal record of training and other guidance initiatives, and that no specific governance structure — such as an AI officer or AI board — is required. In practice, documentation is advisable because it is the only way to prove that measures were taken, and because it supports compliance with related obligations under the GDPR and employment law.

Article 4 and high-risk systems

For high-risk AI systems, more specific obligations apply on top of Article 4. Deployers must assign human oversight to natural persons who have the necessary competence, training and authority (Article 26(2)), and providers must design systems so that they can be effectively overseen (Article 14). These obligations will apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in Annex I products under the amended timeline. Companies planning high-risk use cases, such as AI in recruitment or credit scoring, should build their training programme so that it can be extended to these requirements. See our insight on the AI Act timeline.

Enforcement and liability

According to the Commission's Q&A, national market surveillance authorities supervise Article 4, and the supervision and enforcement rules apply from 2 August 2026. In Germany, the Federal Network Agency is the main market surveillance authority under the AI Market Surveillance and Innovation Promotion Act (KI-MIG) of 22 July 2026. Article 99(4) AI Act, which lists the obligations subject to fines of up to EUR 15 million or 3% of turnover, does not mention Article 4, and the German fine provisions in § 15 KI-MIG do not refer to it either. A direct fine for a lack of AI literacy is therefore unlikely in Germany.

This does not make the obligation irrelevant. A failure to take such measures can be taken into account when authorities assess other infringements, for example of transparency obligations or prohibited practices. It can also be relevant in civil liability where damage results from the careless use of AI by untrained staff, and for management's general duty to organise the company properly. Data protection authorities may also expect staff training when assessing the security of processing involving AI.

There is a close link to data protection compliance. Under Article 39(1)(b) GDPR, the data protection officer's tasks include awareness-raising and training of staff involved in processing operations, and Article 32 GDPR requires appropriate organisational measures to secure processing. Many companies therefore combine data protection training and training on AI tools in one programme, coordinated by the data protection officer and the team responsible for AI governance. This avoids duplication and ensures consistent rules on entering personal data into AI tools.

AI literacy and German employment law

Introducing training measures in Germany involves the works council (Betriebsrat). The employer must inform the works council in good time about the planning of work processes, including the use of artificial intelligence, and consult it (§ 90(1) no. 3 and (2) of the Works Constitution Act, Betriebsverfassungsgesetz, BetrVG).

The works council has co-determination rights over the implementation of in-company vocational training measures under § 98(1) BetrVG, which can cover AI training programmes. Where AI tools are capable of monitoring employee behaviour or performance, the introduction of the tools themselves is subject to co-determination under § 87(1) no. 6 BetrVG. Where the works council has to assess the introduction or use of AI, the involvement of an expert is deemed necessary under § 80(3) BetrVG.

Many companies therefore conclude a framework works agreement on AI that covers permitted tools, data protection, performance monitoring, training and the process for introducing new AI applications. This approach combines training with the co-determination process and avoids having to negotiate each tool separately. Employment contracts and internal policies may also oblige employees to attend training on AI tools they are required to use. See our page on works councils.

External staff and service providers

Article 4 is not limited to employees. Temporary agency workers, freelancers and outsourcing providers who operate AI systems on the company's behalf are also covered. For agency workers, the hiring company is usually best placed to provide tool-specific instruction, because it controls the workplace and the tools. For service providers, contracts should allocate responsibility: the provider should confirm that its personnel have the necessary knowledge and comply with the client's AI policy, and the client should provide information on the systems and their intended use. Purchasing and vendor management templates should be updated accordingly.

Illustration

Illustration (hypothetical): a mid-sized German manufacturer introduces a generative AI assistant for its sales and service teams and an AI-based tool for pre-screening applications in HR. For the sales and service teams, a one-hour e-learning module on how the assistant works, its limits, confidentiality rules and the duty to check outputs may be sufficient, combined with the company's AI policy.

For HR, more is needed: training on the risks of bias and discrimination under the General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, AGG), data protection, how to override the tool's suggestions and, with a view to the high-risk rules applying from December 2027, human oversight. The works council is informed early and the measures are recorded in a framework agreement.

A practical AI literacy programme

1. Create an inventory of AI systems in use, including AI functions embedded in standard software.
2. Clarify the company's role (provider or deployer) for each system.
3. Define target groups and the knowledge each group needs.
4. Adopt an AI policy and communicate it.
5. Deliver training and keep records.
6. Review the programme when new tools, risks or legal requirements arise.

The programme should be owned by a named function — often compliance, HR or the digital team — with a budget and a reporting line to management, so that it does not depend on individual initiative.

Investing in skills is also good risk management: employees who understand the limits of AI tools are less likely to disclose confidential information, rely on incorrect outputs or infringe third-party rights.

How TRW & Co helps with AI literacy

We help companies design AI literacy programmes that meet Article 4 AI Act as amended: AI inventories, role-based training concepts, AI policies and documentation. We negotiate framework works agreements on AI with works councils, advise on data protection and confidentiality in the use of AI tools, and prepare companies for the high-risk obligations to come. See our pages on the AI Act and employment and pensions, or contact us.