AI literacy under Article 4 of the AI Act: measures and records after the 2026 amendment

Summary

Article 4 of the AI Act has applied since 2 February 2025 to all providers and deployers of AI systems, including a company whose staff write advertising copy with ChatGPT [7][8]. Since the amendment in July 2026, it requires measures to "support the development" of AI literacy, and it states that nobody has to guarantee a specific level [2]. According to the Federal Network Agency (Bundesnetzagentur), Article 4 does not require a certificate, an AI officer or a fixed training format, and the Commission likewise requires neither a certificate nor a specific governance structure [8][133]. Both advise working by role, system and risk, and the Federal Network Agency recommends documenting the measures [8][133]. At the end you will find a role matrix and a short template for that record.

Note: This article is expressly not legal advice. It describes what the legal texts say, as of 31 October 2026. Whether and how an obligation applies to your organisation is something to clarify with a lawyer.

70 percent train, two thirds still see gaps

70 percent of companies in Germany now train their staff in the use of AI: 11 percent train everyone, 22 percent most staff, 37 percent selected staff [126]. A quarter offer no training at all, down from 43 percent the year before [126]. Bitkom Research surveyed 603 companies with 20 or more employees by telephone in summer 2026 [126][139]. In the same survey, 66 percent of companies rate the AI skills of their staff as low and 28 percent as high [126][139].

So training is happening, and confidence is still missing. Official statistics point the same way. Of the companies in Germany that considered AI in 2025 but did not use it, 72 percent named a lack of relevant expertise as a reason, against 70 percent across the EU [128]. Eurostat does not publish a figure on AI training as such. The closest indicator is training in ICT skills: in 2024, 26 percent of companies in Germany with ten or more persons employed provided training to their personnel to develop their ICT skills, against 22 percent across the EU [137][138]. Both Eurostat figures cover enterprises in NACE sections C to N except the financial sector (section K), plus repair of computers and communication equipment (group 95.1) [128][137][138]. Besides financial and insurance activities, they leave out agriculture, mining, public administration, education, health and social work, among others [138]. ICT skills are not the same as AI literacy, and the figure cannot be compared with the Bitkom result because the question, the sample and the year differ.

What Article 4 means in practice shows up in one question from the Commission's Q&A: does a company whose staff use ChatGPT for advertising copy or translations have to comply with Article 4? The answer is yes. Staff should be informed about the specific risks, for example hallucination [8]. Article 4 can therefore concern almost any team that uses AI tools, not only high-risk systems in large groups.

Article 4 before and after

In the original 2024 text, providers and deployers had to take measures "to ensure, to their best extent, a sufficient level of AI literacy" of their staff and other persons acting on their behalf [1].

Regulation (EU) 2026/1744 replaced Article 4. Paragraph 1 now reads: "Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf" [2]. Technical knowledge, experience, education and training, the context of use and the persons on whom the systems are used have to be taken into account [2]. A new sentence follows: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." [2]

Paragraphs 2 and 3 are also new. The Commission and the Member States support providers and deployers, "in particular SMEs", and the Commission publishes practical examples on a single information platform [2]. The AI Board adopts recommendations to support the Commission and the Member States in promoting AI literacy, including by setting out common objectives [2].

If you read the German text yourself: recital 8 of the German version of the amending regulation uses the verb "fördern" (promote), while the article itself says "unterstützen" (support) [2]. When you quote the new obligation, quote the article.

The definition in Article 3(56) has not changed. AI literacy means the skills, knowledge and understanding that allow providers, deployers and affected persons "to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause" [1][7].

Article 4 sits in Chapter I, and Chapter I has applied since 2 February 2025 [7]. The amending regulation replaced Article 113, third paragraph, point (a), and kept 2 February 2025 for Chapters I and II [2]. It was published in the Official Journal on 24 July 2026 and entered into force on the third day after publication, which is 27 July 2026 [2]. It sets no separate date of application for the new Article 4 [2]. Our reading is therefore: the new wording has applied since 27 July 2026. The old wording applied before that.

What support without a guaranteed level means in daily work

The obligation remains. According to the Commission, AI literacy remains an obligation for providers and deployers, but no specific or "sufficient" level is mandated any more [8]. Article 4 does not require you to measure what your staff know about AI, the Commission says [8].

A circular email with a link to the instructions will hardly be enough, though. The Commission writes that simply relying on the instructions for use, or asking staff to read them, might be ineffective in many cases [8]. The Federal Network Agency lists what Article 4 does not require: guaranteed AI literacy levels for individuals, formalised or standardised training measures, (external) certification of the measures taken, and the appointment of an AI officer [133].

Our reading: you do not owe test results. You owe measures that fit your systems and your people, and you should be able to explain why you chose them. The Federal Network Agency puts it briefly: the decision should be plausible and comprehensible [133].

The group also includes people who are not your employees. Article 4 covers other persons dealing with AI systems on your behalf [2]. The Commission gives contractors, service providers and clients as examples [8]. People working for you as a service provider need the AI skills their task requires, just like your own employees [8].

High-risk systems come with more, for systems under Annex III from 2 December 2027 [7]. From then on, deployers of such systems "shall assign human oversight to natural persons who have the necessary competence, training and authority" (Article 26(2)) [7]. The Commission stresses that this obligation remains in place after the amendment [8]. When the high-risk obligations apply is covered in the article on AI Act deadlines after the amendment.

Plan by role, not one course for everyone

One mandatory course for everyone, once a year, with the same slides: easy to organise, but rarely a match for what Article 4 describes. The article ties measures to knowledge, experience and the context of use [2]. The Commission suggests four steps [8]:

1. Build a general understanding of AI in the organisation: what is AI, which AI do we use, what are the opportunities and dangers?
2. Clarify your role: does the organisation develop AI systems, or does it use systems developed by others?
3. Look at the risk of the systems: what do people need to know about each system and its risks?
4. Build the measures on that analysis, matched to prior knowledge and the context of use.

Different levels are expressly possible. The Commission considers different levels of training or learning approaches appropriate where systems and prior knowledge differ [8]. The Federal Network Agency writes that there is simply no "one-size-fits-all" solution [133]. It recommends three building blocks: identify needs, design measures, then document, evaluate and refresh [133].

The first building block is an inventory. The Federal Network Agency frames it as four questions: who develops, operates or uses AI systems? Which systems are they? For what purpose? What risks and opportunities come with them [133]? Once you have written this down for your team, half of the role matrix below is already filled in.

Specialists belong on the list as well. People who have developed AI or are trained in it are normally considered literate, the Commission says. It depends on the tool and the qualification, though, and legal and ethical aspects may still be missing [8].

On the role of your organisation: a deployer under Article 3(4) is anyone "using an AI system under its authority", except for personal non-professional use [7]. A provider under Article 3(3) develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge [7]. Whether an internal tool you built yourself makes you a provider is a legal question. Clarify it with a lawyer.

How far AI literacy can reach beyond the legal duty is the subject of the article No AI team? Why AI literacy for everyone works better. If AI agents already work in your team, the article on AI agents in operations covers permissions and approvals.

What the Commission and the Federal Network Agency provide

The Commission maintains a Q&A on Article 4, last updated on 20 October 2026 [8]. There is also a living repository, a collection of examples from companies and organisations [131][132]. The Commission plans to draw on it for the practical examples under Article 4(2). Replicating the practices collected there does not, however, automatically grant a presumption of compliance with Article 4 [131].

The Federal Network Agency has a page on AI literacy that already reflects the amended Article 4 [133]. It suggests content in stages and points to free offers [133]. Its guidance paper of June 2025 is still based on the old wording and speaks of "Sicherstellung" (ensuring) of AI literacy [135]. Check the date when you read such papers.

If you want to draft an AI policy for your organisation, the AI governance toolkit on this site helps with a first version.

Who is responsible and what the texts say about infringements

In Germany, the AI Market Surveillance and Innovation Promotion Act (KI-MIG, our translation), Article 1 of the act implementing the AI Regulation, makes the Federal Network Agency the competent market surveillance authority, "unless otherwise provided in this Act" (section 2(1) KI-MIG, our translation) [13]. According to the Commission, supervision of Article 4 lies with national authorities, not the EU AI Office, and starts on 2 August 2026 [8].

On penalties, here are the texts side by side, without our assessment:

• Article 99(1) requires Member States to lay down rules on penalties and other enforcement measures "applicable to any infringement of this Regulation by operators" [2]. The original text read "applicable to infringements of this Regulation by operators" [1]. New in this sentence are the word "any" and the express reference to administrative fines [1][2].
• The list in Article 99(4) names Articles 16, 26 and 50 among others; it does not name Article 4 [7].
• Section 15 KI-MIG refers to obligations under Articles 21, 27, 45 and 86 of the AI Act; Article 4 does not appear in it [13].
• Section 16 KI-MIG applies the German Act on Regulatory Offences to infringements under Article 99(3) to (5) of the AI Act, and section 17 KI-MIG names the authorities competent for fine proceedings. Article 4 appears in neither [13].
• The Commission writes that national authorities could sanction infringements of Article 4 on the basis of national law, and that any sanction must be proportionate [8].
• The Federal Network Agency writes that a lack of AI literacy can be regarded as a breach of the duty of care, especially where it causes damage [133].

What follows from this for your organisation is for a lawyer to assess.

Article 4 leaves open who inside the organisation is responsible. It addresses providers and deployers, that is the organisation [2]. According to the Commission, it does not mandate any specific governance structure [8]. The Federal Network Agency recommends setting objectives and responsibilities [133]. Our reading: management sets the frame and assigns responsibility. Team leads know the systems and tasks of their people and supply the entries for the matrix and the record.

Working aid: role matrix

The matrix is an example. Replace the rows with the roles and systems in your organisation. The risk column describes what can go wrong in daily work. Whether a system legally counts as high-risk is something to have checked.

Working aid: template for the record

The Commission sees no need for a certificate; an internal record of trainings and other guiding initiatives is enough [8]. The Federal Network Agency names the type of measures, their content and duration and the participants as contents of the record, and recommends regular evaluation and refreshers [133]. That gives a template with a few fields, one line per measure:

• Measure: type and format, for example workshop, self-study course, on-the-job briefing
• Role or team: who the measure is for
• AI systems: which tools it covers
• Content: key topics
• Period and scope: date and duration
• Participants: names or a list in the annex
• Reason: why this measure fits this role
• Effect checked: when and how, for example a team check-in or a sample
• Next refresher: date or trigger, such as a new system
• Responsible: who keeps the line up to date

A spreadsheet on your shared drive is enough. More important than the format is keeping it current when new systems or new people arrive.

Sources

1. European Parliament and Council; published by the Publications Office of the EU: Regulation (EU) 2024/1689 of 13 June 2024 (AI Act), OJ L, 12.7.2024, original version, accessed on 25.10.2026
2. European Parliament and Council; published by the Publications Office of the EU: Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L, 24.7.2026, accessed on 25.10.2026
7. Publications Office of the EU (EUR-Lex): Regulation (EU) 2024/1689, consolidated version (as of 27.07.2026), CELEX 02024R1689-20260727, accessed on 25.10.2026
8. European Commission, Shaping Europe’s digital future: AI Literacy: Questions & Answers, accessed on 25.10.2026
13. Federal Law Gazette of Germany (recht.bund.de): Gesetz zur Durchführung der Verordnung über künstliche Intelligenz (act implementing the AI Regulation), BGBl. 2026 I No. 223, German only, accessed on 25.10.2026
126. Bitkom e. V.: Erstmals nutzt Mehrheit der Unternehmen KI (for the first time, a majority of companies use AI), German only, accessed on 26.10.2026
128. Eurostat: Dataset isoc_eb_ai: Artificial intelligence by size class of enterprise, accessed on 26.10.2026
131. European Commission, Shaping Europe’s digital future (DG CNECT): Living repository to foster learning and exchange on AI literacy, accessed on 30.10.2026
132. European Commission, Shaping Europe’s digital future: AI literacy practices (database of practice examples), accessed on 30.10.2026
133. Federal Network Agency (Bundesnetzagentur): KI-Kompetenz (AI literacy), AI Service Desk, German only, accessed on 30.10.2026
135. Federal Network Agency (Bundesnetzagentur): Hinweispapier KI-Kompetenzen nach Artikel 4 KI-Verordnung (guidance paper on AI literacy under Article 4), June 2025, German only, accessed on 30.10.2026
137. Eurostat: Enterprises that provided training to develop/upgrade ICT skills of their personnel by size class of enterprise (isoc_ske_itts), accessed on 30.10.2026
138. Eurostat: ICT usage in enterprises (isoc_e), Reference Metadata (ESMS), accessed on 30.10.2026
139. Bitkom e. V. / Bitkom Research: KI in der deutschen Wirtschaft: Status quo und Ausblick (AI in the German economy: status quo and outlook, 2026), presentation, German only, accessed on 30.10.2026