Since 2 February 2025, Article 4 of the AI Act has required companies to ensure sufficient AI literacy among staff who use AI systems at work. That includes the colleague drafting texts with ChatGPT in the office. In Germany, the Federal Network Agency (Bundesnetzagentur) has been designated as the central supervisory authority for the AI Act since 29 July 2026. Article 4 does not require a certificate. What matters is that you can show what you have done.
Who is affected?
Companies that provide AI systems or use them professionally are affected. That ranges from a chatbot on the website to an AI assistant your team uses for emails. According to the Federal Network Agency's guidance, the obligation also extends to people working with AI on the company's behalf, such as service providers or freelancers. Private use is not covered.
What does "sufficient AI literacy" mean?
The law does not set a fixed number of hours. What is sufficient depends on who uses which AI and for what:
- For everyone using AI day to day: how language models basically work, that they can give convincing but wrong answers, which data does not belong in public tools and when a result has to be checked.
- For everyone setting up AI or basing decisions on it: additional knowledge about limits, risks, data protection and their own obligations under the AI Act.
Is a certificate required?
No. The European Commission has confirmed in its guidance that Article 4 does not require a certificate. Many offers of a "mandatory certificate" suggest otherwise. What counts is that the measures fit your company and are documented.
What happens if you do nothing?
Article 4 has no fine of its own in the AI Act. Experts disagree on whether and how a breach can be sanctioned directly, and there is hardly any supervisory practice yet. The bigger risk lies elsewhere: if uninformed use of AI causes damage, such as a data leak or wrong information given to customers, missing training quickly becomes a liability issue.
Five steps to AI literacy
- Take stock: which AI tools does who use, and for what? Ask openly; it is often more than you think.
- AI policy: define which tools are allowed and which data must not go into them, for example customer data or contracts in public chatbots.
- Training by role: basics for everyone, deeper knowledge for those who set up or use AI intensively.
- Documentation: record who received which training or briefing and when.
- Refresh: adapt the policy and training when new tools or new uses come along.
A useful side effect: a dedicated AI chat on your own server removes your team's reason to switch to public tools. How that works is described in Local AI instead of the cloud. For data protection, see our checklist on AI and data protection.
This article is not legal advice. For your specific case, contact your legal advisor or data protection officer.
Sources
- IHK Hannover: AI Act obligations: securing AI literacy in the company (German)
- Bundesnetzagentur: Guidance on AI literacy under Article 4 AI Act (June 2025, German)
- German AI Market Surveillance and Innovation Act (KI-MIG) (German)
- ITMR: AI Regulation, Art. 4 (German)
