AI Literacy Obligation:
What your team needs to know now

What Article 4 of the AI Act regulates

The AI Act (Regulation (EU) 2024/1689) defines AI literacy in Article 3 No. 56 as the skills, knowledge, and understanding to deploy AI systems in an informed manner and to be aware of the opportunities, risks, and potential harms.

Article 4 is addressed to two groups:

• Providers, i.e., anyone who develops an AI system or offers it under their own name.
• Deployers, i.e., anyone who uses an AI system professionally under their own responsibility.

If your department or team uses ChatGPT or Copilot to draft proposals, designs social media posts with AI, or uses a chatbot to answer customer questions on your website, you are a deployer according to the EU AI Act. The EU Commission clarifies in its Q on AI literacy that the use of ChatGPT in daily work also falls under this. Even freelancers without employees are affected as soon as they use AI professionally.

According to the Federal Statistical Office, around 26 percent of companies with ten or more employees were already using Artificial Intelligence in 2025, compared to around 20 percent a year earlier. In September 2026, the industry association Bitkom found that around 57 percent of companies with 20 or more employees were using it.

What changed in July 2026

In November 2025, the EU Commission proposed a relief package for the AI Act, the so-called Digital Omnibus. Originally, the obligation for AI literacy was supposed to shift from companies to the Commission and Member States. That is not what happened.

Regulation (EU) 2026/1744 was adopted. It entered into force on July 27, 2026, and reformulated Article 4:

• Until July 2026: Companies had to take measures to “ensure to their best efforts” that their personnel “possess a sufficient level of AI literacy.”
• Since July 27, 2026: Companies take measures to “support the development of AI literacy” of their personnel. They explicitly do not have to guarantee a “certain level of AI literacy.”
• Also new: The Commission and Member States should support companies, “in particular SMEs.”

An obligation to achieve a result has become an obligation to make a verifiable effort. For small businesses, this is a real relief. You don’t have to prove to anyone that your team has specific knowledge. But you must be able to show that you have done something to support it.

Fines, Liability, Supervision

There is no direct fine. The fine provisions of the AI Act in Article 99 do not mention Article 4. The German AI Market Surveillance Act (KI-MIG), which has been in force since July 29, 2026, also does not provide for a fine for lack of AI literacy in Section 15.

However, this is not without consequences. Since July 29, 2026, the Federal Network Agency has been the responsible market surveillance authority and complaints body for the AI Act. It points out that a lack of AI literacy can be considered a breach of the duty of care.

This becomes relevant if an AI error harms a customer. In that case, damages are determined by German law. The question will be what you did to prevent the error. The EU Commission also expects sanctions primarily when an incident is due to a lack of staff instruction. Those who can then present their “AI rules” and team instructions will be in a much better position.

What AI literacy means in concrete terms

The law does not prescribe a curriculum or mandatory training. Nevertheless, the following points can be derived from the EU Commission’s Q and the Federal Network Agency’s guidance. Anyone working with AI on your behalf should:

1. roughly understand how the tool works, including that language models can invent facts (hallucinations),
2. know what it is used for and what it is not, such as not putting customer data into a freely accessible tool,
3. check results before they are sent out.

How much of this is necessary depends on the application. Someone using AI to draft an appointment confirmation needs less than someone pre-sorting and classifying job applications.

The Commission explicitly emphasizes that no certificate is required. The law also does not demand an AI officer, knowledge tests, or external training. It is sufficient to record internally what you have done.

Usage rules instead of training folders

The easiest way to fulfill the obligation is to briefly write down how each AI application is regulated. Five questions are enough for this:

1. Purpose: What are we using the AI for?
2. Limits: What data and sources is it allowed to use, and what is strictly forbidden?
3. Tone: How does it present itself to customers?
4. Handover: When does a human take over?
5. Control: Who checks the results, and how often?

A fictional but typical example: A plumbing business from Hamburg with six people uses AI for two things.

Use Case 1: Proposal texts

• Purpose: Pre-formulating service descriptions for proposals.
• Limits: No customer names or addresses in the tool, no prices from the AI, only own service list as a basis.
• Tone: Objective, understandable for laypeople.
• Handover: Special cases like water damage are written by the master plumber himself.
• Control: Every proposal is read before being sent.

Use Case 2: Chatbot on the website

• Purpose: Answering questions about services, service area, and appointments.
• Limits: No commitments on prices or dates, no remote diagnoses.
• Tone: Friendly, brief, using ‘du’ or ‘Sie’ as on the website.
• Handover: Emergencies and complaints go immediately to the office, with a phone number.
• Control: Ten chat logs are read once a month.

That’s two half-pages. Anyone new to the team reads them on their first day. This documents the instruction, and you can explain how your AI works at any time.

Website, Chatbot, Marketing: Article 50 also applies

In addition to Article 4, the transparency obligations from Article 50 of the AI Act have been in force since August 2, 2026. These are often more important for your website and marketing because violations here are subject to fines.

• Chatbots: Anyone chatting with an AI chatbot must be informed that they are speaking with an AI, unless it is already obvious. Formally, this duty falls on the provider of the chatbot. If you set up the bot yourself or operate it under your name, ensure there is a clear notice in the chat window anyway. It costs nothing and preempts any discussion.
• Deepfakes: Images, videos, or audio recordings that deceptively mimic real people, places, or events must be labeled as AI-generated.
• AI Texts: Texts intended to inform the public about matters of public interest must be labeled if they have not been editorially reviewed and accounted for by a human.

For SEO texts, blog posts, and social media posts, this means in practice: A human proofreads, checks the facts, and stands by it with their name. This exact review is also what Article 4 means when it speaks of AI literacy.

How to get started

1. List all AI uses: email drafts, translations, image editing, social media, chatbot. Ask the team; often someone is using a tool that no one else knows about.
2. Answer the five questions for each use case. A shared document is sufficient.
3. Read the rules together and note the date and participants. This is your documentation.
4. Set a date to review the rules: once a year or whenever a new tool is added.

Free help is available: The Federal Network Agency operates an AI Service Desk.

Conclusion

The AI literacy obligation has been easier to fulfill than feared since July 2026. You must be able to prove that you are looking after your team’s AI knowledge; you do not have to guarantee a specific level. Anyone who writes down their AI uses, sets limits, and checks results has taken care of it.

You should take Article 50 more seriously: A chatbot on your website without an AI notice or an unlabeled deepfake in advertising has been a real risk since August 2026.