AI Literacy Training: What Article 4 of the EU AI Act Requires in 2026

No law requires an AI literacy certificate. Since 27 July 2026, Article 4 of the EU AI Act requires companies that use AI to take measures to support the development of AI literacy among their staff. They do not have to guarantee any specific level, and no certificate is prescribed. Structured AI literacy training, in German-speaking countries often called a “KI-Führerschein” (AI driving licence), is a practical way to implement and document those measures. It is only worth it, though, if it builds and tests real understanding instead of just collecting attendance.

Many guides on the “AI training obligation” still describe the original wording of Article 4 from February 2025. The Digital Omnibus changed that wording, and since August 2026 national authorities supervise it. In Germany that is the Federal Network Agency (Bundesnetzagentur). In this article you will learn:

• what Article 4 requires in its new wording, and what it no longer requires,
• who enforces it and what actually happens if you ignore it,
• which common assumptions about AI literacy are wrong,
• what good AI literacy training should cover and how to document it,
• and why a hands-on task with follow-up questions proves more than a multiple-choice quiz.

What does Article 4 require after the Digital Omnibus?

The EU AI Act entered into force on 1 August 2024 and applies in stages. Article 4 on AI literacy was among the first obligations and has applied since 2 February 2025. Regulation (EU) 2026/1744, the Digital Omnibus on AI, rewrote it. The amendment was published in the Official Journal on 24 July 2026 and has applied since 27 July 2026 (EUR-Lex).

In substance, the new first sentence says providers and deployers “take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”, taking into account their technical knowledge, experience, education and the context of use. The second sentence clarifies that this obligation does not require them to guarantee any specific level of AI literacy of any individual.

What this means in practice: the duty has not been deleted. It has moved from an obligation of result to an obligation of effort. If you use AI professionally, you still have to act and be able to show what you did. The pressure to prove a “sufficient” level for every single person is gone.

Who counts as a “deployer”?

Under the AI Act, a deployer is any organisation that uses an AI system under its own authority in a professional context. Size and industry do not matter. If you give employees ChatGPT, Claude or Microsoft Copilot, have switched on AI features in your software or run an AI agent, you are a deployer. Only purely personal, non-professional use is excluded.

The duty covers not only employees but also “other persons” using AI on your behalf: freelancers, temporary staff, contractors working inside your processes. The European Commission already said so in its AI literacy questions and answers in 2025.

Who enforces AI literacy, and what happens if you ignore it?

Article 4 is supervised by national market surveillance authorities, since 2 August 2026. In Germany, the act on AI market surveillance (KI-MIG) took effect on 29 July 2026 and made the Bundesnetzagentur the central market surveillance authority, single point of contact and complaints office for the AI Act (Bundesnetzagentur). Some sectors keep their own regulators, for example BaFin for financial services.

What this means for you:

• No dedicated fine. As of today, neither Article 99 of the AI Act nor the German KI-MIG lists a specific fine for breaching Article 4. The multi-million fines often quoted apply to other duties, such as prohibited practices or transparency obligations.
• Authorities can ask for evidence. They can request records and order measures. Having nothing to show is a problem even without a fine.
• Liability and duty of care. If damage results from employees using AI without the necessary understanding, a lack of AI literacy can count as a breach of the duty of care. In practice, that is the bigger risk.

The Bundesnetzagentur publishes non-binding guidance on building AI literacy. It shows what supervisors look for: assess needs, design measures, document them. This overview reflects the situation on 4 November 2026 and is not legal advice.

AI literacy myths vs. facts

Why the topic is not getting smaller

The legal duty is softer; the practical gap is not. A Bitkom survey of 603 German companies from September 2026 found that 57 percent of companies with 20 or more employees now use AI, up from 36 percent a year earlier. 70 percent train at least some staff, a quarter none at all. And 66 percent rate their employees’ AI literacy as low (Bitkom).

AI adoption is outpacing AI literacy. With AI automation, agents and vibe coding, employees no longer just use AI to draft text; they let it act: move data, send emails, write code. The more an AI does, the more expensive it gets when nobody can judge its output.

What AI literacy training should cover

“KI-Führerschein” is not a legal term but a format: a compact training that combines fundamentals, rules and practice and ends with an internal record. To implement Article 4 well, it should be tiered by role. Our grid from practice:

Higher-risk areas deserve their own deep dive. AI in HR, for instance for screening applications, will fall under the AI Act’s high-risk rules. After the Omnibus, those apply to Annex III systems from 2 December 2027. If you use AI there, build up the literacy of everyone involved much more thoroughly, starting now.

The AI policy is part of it

Training without rules fades fast. At minimum, one page should state which tools may be used with which data. A simple traffic light works well: green for public or non-critical content, amber for internal information only in approved company tools, red for personal data, trade secrets and customer data, processed only in specifically vetted systems. Plus one person who decides when in doubt.

Test understanding, not attendance

The most common mistake in AI literacy training is not the content but the evidence. A multiple-choice quiz at the end shows that someone attended and memorised a few terms. It does not show whether that person can tell when an AI is wrong.

Our founder Joshua Heller is seeing the same problem at university. Since autumn 2026 he has been teaching web engineering at DHBW Karlsruhe, a cooperative state university. The programme director gave him the real challenge up front: students use AI heavily but often do not understand the fundamentals. Banning AI would make as little sense at a university as in a company. His approach:

• Set tasks and walk through the solutions live together. The path counts, not just the result.
• Understanding before speed. Quickly generated code is worthless if nobody can explain why it works.
• Exams as presentations with targeted follow-up questions. If you can explain why your code looks the way it does, you understood it. If you just handed in what the AI produced, it shows by the third question.

We apply the same logic in companies. The best evidence of AI literacy is a real task from someone’s own work, solved with AI and then explained. Why is the result correct? What could the AI have got wrong here? How would you have noticed? People who can answer these questions use AI critically instead of trusting it blindly. That is the point of Article 4, with or without the Omnibus.

This matters most for teams that build software with AI. What to check before AI-built apps go live is covered in Vibe coding to production.

Six steps to Article 4 evidence

1. Take stock. Which AI tools are used, officially and unofficially? Who uses them for what? Private ChatGPT accounts used for work count.
2. Map roles. Assign people to the Basics, Applied, Build and Decide levels. Do not forget external staff using AI on your behalf.
3. Set the AI policy. The traffic light for tools and data, one owner, one channel for questions and incidents.
4. Train. Basics for everyone, depth by role. On real tasks from daily work, not generic examples.
5. Check effectiveness. A hands-on task with follow-up questions instead of an attendance list.
6. Document and refresh. Record who completed which measure, when, with what content. Plan an update whenever new tools, new hires or new use cases come in.

A simple table in your HR system or a shared file is enough for documentation. The Bundesnetzagentur recommends recording the type, content and scope of each measure and who took part. In projects we add two columns: the role and the result of the hands-on task. That way you can show not only that training happened, but that it fits each role.

How well is your AI literacy documented?

How we run AI literacy training at TAISC

Our AI literacy training is a compact format for employees from every department: fundamentals, limits and hallucinations, data protection and house rules, live demos of the relevant tools and group work on tasks from their own jobs. It ends with an internal record covering Article 4 and a list of concrete use-case ideas.

The part we consider most important comes afterwards. In the AI literacy training for WM aquatec, group work produced ideas for marketing, support and sales, including a dealer search that can be automated with n8n. In the AI seminar with a use-case workshop for Amphenol Precision Optics, the focus from day one was which processes could be improved with automation and AI agents.

That is our core as an AI agency from Karlsruhe, Germany: we do not just train, we build the automations and agents that come out of the training and run them in production. How we approach n8n in companies is described in n8n workflows in the enterprise, and why tools without adoption end up as shelfware in Software nobody uses. All ways of working with us are on our services page.

Frequently asked questions about AI literacy under the EU AI Act

Is AI literacy training mandatory under the EU AI Act?

Article 4 requires providers and deployers of AI systems to take measures to support the AI literacy of their staff. Since 27 July 2026 they no longer have to ensure a sufficient level, and no specific training format or certificate is prescribed. Structured training is the most common way to implement and document those measures.

Did the Digital Omnibus remove the AI literacy obligation?

No. Regulation (EU) 2026/1744 rewrote Article 4 but kept the obligation for providers and deployers. Instead of ensuring a sufficient level, they must take measures to support AI literacy, and they expressly do not have to guarantee any specific level for any individual.

Do employees need an AI literacy certificate?

No. Neither the AI Act nor the European Commission nor the German Bundesnetzagentur requires certificates or external certification. Internal records showing who completed which measure, when, with what content and scope, are recommended.

Who enforces Article 4?

National market surveillance authorities have supervised Article 4 since 2 August 2026. In Germany, the Bundesnetzagentur became the central authority for the AI Act when the KI-MIG took effect on 29 July 2026. Some sectors, such as financial services, keep their own regulators.

What are the penalties for not training staff?

As of November 2026 there is no specific fine for Article 4, neither in the AI Act nor in German implementing law. Authorities can still request evidence and order measures, and a lack of AI literacy can count as a breach of the duty of care if damage occurs.

Does Article 4 apply to freelancers and contractors?

Yes, as far as they deal with AI systems on your behalf. Article 4 explicitly covers staff and other persons dealing with the operation and use of AI systems on behalf of the provider or deployer.

How often should AI literacy training be refreshed?

The law sets no fixed interval. An update makes sense whenever new tools, new hires or new use cases come in, plus an annual check that the policy and content still fit.

Conclusion

The Digital Omnibus softened Article 4 of the AI Act: companies must take and document measures but need not guarantee any level of AI literacy. Certificates are not required and there is no dedicated fine. That reduces paperwork, but it is no reason to drop the topic. More than half of German companies now use AI, two thirds rate their staff’s AI literacy as low, and AI increasingly performs tasks instead of only suggesting text.

Good AI literacy training does both: it documents the measures Article 4 asks for, and it builds the ability to judge AI output. What matters is not an attendance list at the end, but employees who can explain what the AI did for them.

Want to train your team and identify the first automations along the way? Book a free intro call. Together we will work out which levels you need and what your evidence should look like.