The Training Obligation Under Article 4 of the EU AI Act

The training obligation in one sentence

Article 4 of the EU AI Act requires providers and deployers of AI systems to make their best effort to ensure that their staff have a sufficient level of AI literacy — measured against each person's prior knowledge, task, and context of use.

This obligation has applied since February 2, 2025 making it one of the first parts of the regulation to actually take effect. It doesn't depend on a risk class: even if you only use harmless applications, you're still covered. The regulation's underlying structure is explained in the article The EU AI Act Explained Simply.

> Note: This article provides orientation, not legal advice. How much training is appropriate for your company depends on the specific use case and should be reviewed by legal counsel if in doubt.

Who is affected?

The obligation applies to providers and deployers of AI systems. “Deployer” simply means: you use AI professionally. That covers practically every company where staff use an AI assistant for writing, research, analysis, or customer communication.

There's no minimum threshold by company size. Even a five-person agency is covered as soon as AI appears in everyday work. Also covered are people who work with the systems on your behalf — meaning freelancers, working students, and service providers with access to your tools.

Purely private use outside professional activity isn't covered. And: the obligation applies to people who work with the systems, not to everyone in the company. If you never come into professional contact with AI, you don't need training either — though that group gets smaller every year.

What “adequate AI literacy” means

The legal text deliberately doesn't specify a curriculum or number of hours. Instead, it defines AI literacy as the ability to use AI systems competently and to assess the opportunities, risks, and potential harm involved — the scope then depends on four factors:

• technical knowledge and experience of the individual
• Education and prior training
• Context, in which the systems are used
• Groups of people, among whom the systems are used

The result is a risk-based principle: a marketing team generating draft copy needs a different level than an HR department pre-screening applications. That's good news — nobody has to train half the workforce as AI engineers. But it's also uncomfortable news: you can't hide behind a standard course; you need to be able to justify why the chosen level matches the task.

What content does it cover?

A solid training program typically covers five areas. The depth varies by role; the list of topics itself barely does.

The content basis for the first two points is covered by How Does AI Work? and AI Hallucinations; the legal part, besides this article, is covered above all by AI and Data Protection .

What proof of training looks like

The AI Act doesn't prescribe any specific certificate and doesn't name a certification body. There's no authority that issues or recognizes a certificate. What counts is the documentation of the measures taken — and you should have that ready before anyone asks.

A solid record of proof usually consists of four building blocks:

1. A training concept. A short document recording which roles in the company work with AI, what level of competence is appropriate for each, and which formats are used to achieve it. Two pages are enough, as long as the reasoning is traceable.

2. Proof of participation per person. Who completed which training and when? This can be a certificate, a dated course completion, or a signed attendance list from an internal training session.

3. The training materials themselves. Slides, handouts, or course modules, so it can later be verified what content was actually taught.

4. A refresher rule. AI literacy goes out of date quickly. Record how often refreshers happen and how new hires are brought up to speed during onboarding.

Formats that generate this kind of proof are varied: internal workshops with an attendance list, online courses with a completion certificate, chamber-of-commerce certificate programs, or structured self-study paths with documented completion. The learning levels in this knowledge area, with their completion certificates, can also be hung on such a concept as one building block — they don't replace role-specific onboarding, but they credibly document the foundational part. What other formats work well, and how to build a skills matrix for your team, is shown in AI Skills Training: Paths to AI Knowledge.

What happens if you don't comply?

Honesty beats scaremongering here: Article 4 has no dedicated fine provision. The regulation's penalty catalog doesn't list it among the directly fined obligations. So ignoring the training obligation doesn't automatically trigger a fine under the AI Act.

That doesn't mean it's consequence-free, though. There are three ways it comes back around:

• Market surveillance. National supervisory authorities can check compliance and order measures. A lack of AI literacy is treated as a sign of inadequate organization.
• Liability. If an AI error causes harm, the qualification of the people involved quickly becomes central. Demonstrable training works in your favor; its absence works against you.
• Other areas of law. Data protection violations from untrained use are sanctioned under the GDPR — and there, the fines can be substantial.

The best reason for training remains a practical one, though: untrained teams make mistakes faster with AI, copy confidential data into third-party systems, and adopt fabricated facts as true. The compliance obligation is more a welcome occasion than the actual point.

Implemented in four steps

1. Identify who works with AI. Not just the officially rolled-out tools — also the ones individual teams have adopted on their own.
2. Assign competence levels. Basics for everyone, in-depth training for roles with sensitive applications such as HR, finance, or customer communication.
3. Choose suitable formats and document completion. More important than the provider's prestige is that a dated record exists at the end.
4. Anchor the rules in writing. An internal AI policy records which tools are allowed and what data may go into them — how to structure one is shown in An AI Policy for Your Company.

Conclusion

The training obligation under Article 4 is one of the most accessible requirements in the EU AI Act: no prescribed curriculum, no certification body, no dedicated fine provision — but a clear expectation that people understand what they're working with. Anyone who writes a short training concept, qualifies their team according to role, and keeps clean records has fulfilled the obligation. And, as a side effect, has a team that gets better results with AI.