Short answer

The EU AI Act training obligation has applied since 2 February 2025. Article 4 requires providers and deployers to take measures that support the development of AI literacy among staff and other people operating or using AI systems on their behalf. German businesses should use proportionate, role-based guidance and retain evidence of what they implemented.

• Article 4 covers providers and deployers of AI systems, including businesses using third-party AI tools.
• The duty is not limited to high-risk AI, but the measures should reflect each tool, role, and use context.
• The amended rule does not prescribe a course, certificate, fixed duration, or guaranteed literacy level.
• German businesses should document their AI inventory, target groups, guidance, training, and review cycle.

The EU AI Act training obligation has applied since 2 February 2025 to providers and deployers of AI systems, including German businesses that use third-party AI tools. Article 4 of Regulation (EU) 2024/1689 requires them to take measures that support the development of AI literacy among staff and other people operating or using AI systems on their behalf. The appropriate response is proportionate and role-based: the law does not prescribe one course or certificate, but informal, undocumented AI use is a poor compliance strategy.

The rule is broader than high-risk AI. A German company can be a deployer when its employees use generative AI for drafting, translation, coding, customer service, research, or internal analysis. Following the July 2026 amendment by Regulation (EU) 2026/1744, Article 4 no longer requires organisations to guarantee a specific or “sufficient” literacy level; it requires measures that support the development of literacy while taking account of knowledge, experience, education, training, use context, and affected people.

For the wider timetable, see our EU AI Act deadline checklist for German businesses. Privacy and vendor reviews should also connect the programme to AI Act and GDPR legal advisory, GDPR AI procurement, and EU AI Act procurement requirements for German enterprises.

What is the EU AI Act training obligation?

The phrase AI Act training obligation is useful shorthand, but Article 4 is not a statutory requirement to buy a particular training product. The consolidated EU AI Act requires providers and deployers to take measures supporting the development of AI literacy among their staff and other people dealing with the operation and use of AI systems on their behalf.

Those measures must take account of:

• the relevant people’s technical knowledge, experience, education, and training
• the context in which the AI systems are used
• the people or groups on whom the systems are used

The definition of AI literacy in Article 3(56) remains important. It covers the skills, knowledge, and understanding that help providers, deployers, and affected people make informed AI deployments and recognise the opportunities, risks, and possible harm associated with AI.

The practical result is a flexible but real governance duty. A low-impact writing assistant may call for concise safe-use rules and output checking. An AI tool used in recruitment, worker management, lending, health, or regulated customer communications demands deeper, role-specific measures.

Key entities for AI Act implementation in Germany

• AI literacy: Article 3(56) describes the skills, knowledge, and understanding that support informed AI deployment and awareness of opportunities, risks, and possible harm. Under the amended Article 4, providers and deployers must take measures that support its development in the relevant work context.
• Deployer obligations: A deployer uses an AI system under its authority in a professional context. Its duties depend on the system, role, risk classification, and actual use; buying a third-party tool does not automatically transfer every AI Act responsibility to the vendor.
• Works-council co-determination for AI: Section 87(1) no. 6 BetrVG can apply when a technical system is intended to monitor employee conduct or performance. German employers should assess the actual functions before a pilot or rollout and involve the works council where required.

Who must comply with Article 4?

Article 4 applies to both providers and deployers. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its name or trademark. A deployer uses an AI system under its authority, except for personal, non-professional activity.

Most German businesses buying AI-enabled software will act as deployers. The category includes a GmbH using a third-party chatbot, a startup integrating an AI assistant into operations, an employer adopting an HR tool, and an enterprise rolling out copilots across departments. A business may also become a provider where it offers an AI system under its own name or makes changes that bring it within the provider rules.

Staff and relevant contractors are in scope

The AI Act employee training requirement is not limited to employees with technical job titles. The correct question is who operates, uses, supervises, selects, or relies on an AI system on the organisation’s behalf.

Depending on the deployment, the relevant people can include:

• managers approving AI use or relying on AI-supported decisions
• HR teams using tools for recruitment, evaluation, or workforce planning
• procurement teams assessing vendors and contractual safeguards
• legal, privacy, risk, and compliance functions
• IT, security, data, and product teams configuring systems
• customer-facing teams using AI-generated recommendations or communications
• contractors and service providers operating the system for the business

The European Commission’s AI literacy Q&A confirms that contractors should have skills appropriate to their tasks. The company should therefore address relevant external personnel in onboarding, instructions, contractual allocation, or training rather than assuming Article 4 stops at the payroll boundary.

The obligation is not limited to high-risk AI

The Article 4 AI Act training duty applies to AI systems generally. The Commission specifically uses employees working with ChatGPT for advertising text or translations as an example and says they should be informed of risks such as hallucination.

High-risk status still matters. A higher-impact use case normally needs more intensive literacy measures, and separate high-risk obligations may require trained human oversight. But the amended dates for high-risk compliance do not delay the already-applicable Article 4 duty.

What does AI literacy mean in practice?

Effective EU AI Act AI literacy combines understanding of the technology with concrete workplace rules. It should help people recognise what a system can and cannot do, use it within approved boundaries, review outputs intelligently, and escalate problems.

Know the system and its limitations

Users should understand the actual tool they work with, not merely receive a generic definition of artificial intelligence. Relevant topics include the system’s purpose, permitted use cases, data sources where known, output limitations, and recurring failure modes such as hallucination, bias, automation bias, or outdated information.

This knowledge should be tailored. A developer using a coding assistant needs different examples from an HR manager reviewing a ranking, and a procurement professional needs different depth from a customer-service agent.

Apply human oversight and escalation rules

People should know when an output needs human verification, which decisions may not be delegated to a tool, and who owns exceptions. Training should explain how to report unsafe behaviour, discriminatory results, data leakage, misleading content, or a material mismatch between the approved purpose and actual use.

Understand the legal and organisational context

AI literacy does not make every employee a lawyer. It gives people enough context to spot when specialised review is required. For German businesses, this commonly includes the EU AI Act, the GDPR, confidentiality and trade-secret protection, intellectual property, sector rules, and employment-law or works-council issues.

Use proportional, role-based measures

After the 2026 amendment, Article 4 expressly avoids requiring a guaranteed level of knowledge for every individual. That makes a documented, risk-based approach more important, not less. Organisations should be able to explain why a particular group received a short guide, workshop, simulation, policy briefing, technical module, or combination of measures.

What should companies implement now?

A workable AI literacy compliance programme in Germany should connect training with the systems the business actually uses.

Build and maintain an AI inventory

Record approved AI systems, embedded AI features in SaaS products, pilots, and known departmental use. For each entry, note the vendor, business purpose, users, internal owner, affected people, data categories, and whether outputs influence consequential decisions.

An inventory prevents generic training and reveals shadow AI. It also supplies the factual base for privacy, procurement, security, and AI Act classification work.

Create a role-based training matrix

Map each tool or use-case category to the people who use, approve, supervise, or procure it. Then define the learning objective and delivery method for each group. A useful matrix records:

1. the tool or use case
2. the relevant user and oversight roles
3. the main technical, legal, and human-impact risks
4. the required literacy measure
5. the responsible owner
6. the completion and review dates

Put approved-use rules in writing

Training is more actionable when it points to a clear internal policy. Staff should know which tools are approved, which information may not be entered, when output verification is mandatory, when an AI interaction or generated content must be disclosed, and when legal, privacy, HR, security, or works-council review is required.

Retain proportionate evidence

The Commission says Article 4 does not demand a particular certificate. Internal records are still valuable evidence that measures were selected and implemented deliberately. Retain training materials, attendance or completion records, role-specific guidance, policy acknowledgements, decision logs, named owners, and version histories.

Establish triggers for refresh

AI literacy is not a one-off project. Review the programme when the business approves a new tool, a system gains a material feature, the use case changes, an incident occurs, or legal guidance changes. A scheduled annual review can provide a baseline, but event-driven updates keep the content connected to real risks.

How does Article 4 connect to GDPR and employment law?

Article 4 is an AI Act duty, but many German deployments engage other rules at the same time.

Under the GDPR, personal-data use may require a lawful basis, transparency, data minimisation, security, processor terms, transfer safeguards, retention rules, and sometimes a data protection impact assessment. AI literacy should translate those requirements into usable instructions—for example, whether staff may paste customer records, contracts, support tickets, or applicant data into an external model.

Employee-facing AI can also raise German employment and co-determination issues. Section 26 of the Federal Data Protection Act (BDSG) can be relevant to employee data processing. Section 87(1) no. 6 of the Works Constitution Act (BetrVG) may trigger works-council participation where technical systems are intended to monitor employee behaviour or performance. Training cannot replace the necessary legal analysis or involvement of employee representatives.

Procurement is the connecting control point. Vendor due diligence and contracts should tell internal teams what the tool is approved to do, what evidence the vendor provides, which configurations are required, and which responsibilities remain with the deployer.

Deadlines, enforcement, and risk if you do nothing

Article 4 has applied since 2 February 2025. The July 2026 Digital Omnibus amended how the duty is expressed but did not remove it or reset that application date. The EU framework for supervision and enforcement has applied since 2 August 2026, and national market-surveillance authorities can enforce Article 4 under the applicable European and national rules.

In Germany, the Bundesnetzagentur took on a central role under the national AI market-surveillance framework in July 2026, including as a point of contact and complaints body, while established sector authorities retain responsibilities in their fields. The precise competent authority can therefore depend on the system and sector.

Avoid simplistic penalty claims. Article 4 does not contain a dedicated fixed fine for missing a webinar. Enforcement measures and penalties depend on the legal basis, national rules, and facts of the case, with proportionality, severity, and negligent or intentional conduct among the relevant considerations.

The more immediate business risks are practical:

• staff use tools without confidentiality or data-handling boundaries
• teams rely on inaccurate, biased, or misleading output without review
• procurement buys an AI feature without identifying deployer responsibilities
• sensitive HR or customer workflows lack escalation ownership
• the company cannot evidence which Article 4 measures it selected or why

An incident linked to missing guidance can make an undocumented approach substantially harder to defend.

Article 4 compliance checklist for German businesses

Use this eight-step checklist to implement the AI Act training obligation in Germany:

1. Inventory every AI system. Include approved tools, embedded features, pilots, and known departmental use.
2. Classify each use context. Record the purpose, affected people, data involved, and potential harm.
3. Map relevant roles. Identify staff, managers, oversight functions, and contractors operating on your behalf.
4. Set role-based learning objectives. Match the required knowledge to the tool, task, and risk.
5. Deliver practical literacy measures. Combine baseline awareness with tool-specific guidance where necessary.
6. Publish use and escalation rules. Define approved tools, prohibited inputs, human review, and escalation owners.
7. Document implementation. Retain materials, attendance, acknowledgements, owners, and decision records.
8. Review and refresh. Update measures when systems, use cases, incidents, guidance, or legal requirements change.

Build an Article 4 programme that fits your business

Compound Law advises German businesses on EU AI Act compliance, AI governance, procurement, GDPR overlap, and employment-sensitive deployments. We can help scope an AI inventory, design a proportionate Article 4 programme, review internal policies, and connect literacy measures with vendor and workforce governance. Contact our team for a focused legal review.

This guide provides general information and does not constitute legal advice. The measures required in a specific case depend on the AI system, organisational role, users, affected people, and applicable sector rules.