“Do we need an AI driving licence now?” We’ve heard this question again and again since early 2025. The background is Article 4 of the European AI Regulation (EU AI Act). It requires companies that use AI to ensure sufficient AI literacy among their staff. This article explains what’s behind it, who the so-called AI training obligation applies to and how to put it into practice pragmatically.
Note: this article gives a practical overview (as of September 2026) and is not legal advice. For binding assessments, please contact qualified experts.
What Article 4 requires
The AI Regulation (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Article 4 has applied since 2 February 2025. In essence, it requires providers and deployers of AI systems to take measures to ensure, to their best extent, that their staff and other persons dealing with AI systems on their behalf have a sufficient level of AI literacy.
This should take into account:
- the technical knowledge, experience, education and training of the people involved,
- the context in which the AI systems are used,
- the persons or groups on whom the AI systems are used.
According to the regulation, AI literacy means the skills, knowledge and understanding needed to use AI systems in an informed way and to be aware of the opportunities and risks as well as possible harm. So it’s not about programming skills, but about safe, critical use in everyday work.
Who it applies to
In short: almost every company where people work with AI. A “deployer” under the regulation is anyone who uses an AI system professionally under their own responsibility. That applies even if you didn’t develop the system yourself – for example when your team uses chat assistants, AI features in Office or Workspace applications or AI-powered business software.
It covers not only permanent employees but also people who work with AI on your behalf, such as freelancers or external service providers. Company size doesn’t matter for the obligation itself – but it does matter for what scope of measures is appropriate.
How to build AI literacy
The regulation doesn’t prescribe a specific format. A four-step approach has proven itself:
- Take stock: which AI tools are used – officially and unofficially? Who uses them for what?
- Differentiate roles: an administrator who drafts texts needs different knowledge than a team that uses AI results for customer decisions.
- Train hands-on: with the tools actually in use and with tasks from your own day-to-day work – including checking results and handling confidential data.
- Set rules: a clear AI usage policy defines which tools are approved, which data doesn’t belong in them and who helps with questions.
What makes good training
A one-off overview webinar is rarely enough. Short, role-specific formats where employees practice themselves are more effective: writing good prompts, checking results for errors and missing sources, recognizing sensitive information. Templates and a dedicated contact person help as well.
Documentation: what you should record
Article 4 doesn’t prescribe a specific form of proof. According to the European Commission’s questions and answers on AI literacy, no certificate is required in particular; internal documentation of the measures is sufficient. Useful items include:
- an overview of the AI systems in use and what they’re used for,
- content, dates and participants of the trainings,
- your AI usage policy, including version and owners,
- planned refreshers, for example when new tools or features arrive.
This helps not only with enquiries, but also creates clarity internally.
Common misconceptions
- “We need a mandatory certificate.” No. What counts are appropriate measures, not a specific certificate. Providers advertising “AI Act-compliant certificates” promise more than the regulation requires.
- “This only applies to AI developers.” No. Companies that use ready-made AI tools are covered as deployers too.
- “Training once is enough.” AI tools change fast. Plan regular, short refreshers.
- “Private accounts are a private matter.” If private AI accounts are used for work tasks, this affects both AI literacy and data privacy. Clear rules are especially important here.
- “The rules are set in stone.” At the end of 2025, the EU proposed changes to the AI Act as part of the so-called Digital Omnibus, which also affect Article 4. Keep an eye on the current status – it doesn’t change the practical need to use AI safely.
Frequently asked questions
Does the AI training obligation apply to small companies too?
Yes. The obligation applies regardless of company size. The scope of measures, however, depends on use and risk – a small team with a few tools doesn’t need an elaborate program.
Is one e-learning course for everyone enough?
It can help as a start. For safe everyday use, role-specific exercises with the tools actually in use are usually more effective.
What happens if we do nothing?
Article 4 has no fine provision of its own. However, a lack of AI literacy can play a role in other violations or in the event of damage. Above all, it increases the risk of mistakes and data breaches in everyday work.
Conclusion
Article 4 doesn’t ask for a mountain of paperwork, but for common sense: if you use AI, make sure your team understands it and uses it safely. With a stocktake, hands-on training, clear rules and lean documentation, you’re well prepared. Read how our AI training for employees is structured and how we support you with AI & data privacy in your team on the respective pages. Or request a workshop directly.
