Is AI literacy training for employees mandatory? What EU AI Act Article 4 requires after the Digital Omnibus

Is AI literacy training for employees mandatory?

Yes. Article 4 of the AI Act requires providers and deployers of AI systems to take measures on the AI literacy of their staff. A deployer is any company that uses an AI system under its own authority. The obligation has applied since 2 February 2025, regardless of sector and company size, and it also applies to general-purpose systems such as chatbots.

The date follows from Article 113 of the regulation. Under it, Chapters I and II have applied since 2 February 2025, and Article 4 sits in Chapter I. That makes it one of the first provisions of the regulation to take effect at all, half a year before the rules for general-purpose AI models and long before the obligations for high-risk systems.

Article 3(56) defines what AI literacy means: the skills, knowledge and understanding that allow people to make an informed deployment of AI systems and to gain awareness of the opportunities, risks and possible harm. That is deliberately broad. It refers to judgement in handling the tool; it does not require training as a programmer. Someone who copies an AI summary into a personnel file without checking it lacks exactly this judgement.

The most common misjudgement in mid-sized companies is: we have not introduced AI, so this does not concern us. The European Commission addresses exactly this case in its questions and answers on Article 4. A company whose employees use ChatGPT for advertising copy or translations must comply with Article 4. The employees should then at least be informed about the specific risks, such as fabricated content. How to deal with use that is already happening without approval is covered in the article What to do when employees use AI without approval.

The group of people is wider than the core workforce. Article 4 covers the company's own staff and other persons dealing with the operation and use of AI systems on its behalf. The Federal Network Agency (Bundesnetzagentur), Germany's market surveillance authority for AI, explicitly names contractors and service providers. For HR, this means that the external recruiter who works in your applicant tracking system and the interim manager who drafts employment references with your Copilot belong in the plan.

Evidence123

What the Digital Omnibus changed in Article 4

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It reworded Article 4. Before, companies had to ensure, to their best extent, a sufficient level of AI literacy. Now they must take measures to support the development of AI literacy, and they explicitly do not guarantee a specific level for individual persons.

This is more than a question of style. The old version could be read as an obligation of result: at the end there had to be a sufficient level, and the word sufficient could have been argued over in court. The new version describes an obligation of effort. The Future of Privacy Forum sees it as a move away from a strict, measurable obligation. The law firm Gibson Dunn sums up the outcome in two words: retained, but weakened.

Retained is the more important part. In its Omnibus proposal of 19 November 2025, the Commission had suggested shifting the obligation from companies to the member states and the Commission. That did not go through. After adoption by the Parliament on 16 June 2026 and the Council on 29 June 2026, AI literacy remains an obligation of providers and deployers. Anyone who read that the training obligation was being dropped read a proposal, not the law.

Two new paragraphs are meant to relieve companies. Under Article 4(2), the Commission and the member states support companies, especially small and medium-sized ones, and the Commission publishes practical examples on a central information platform. Under Article 4(3), the AI Board adopts recommendations with common objectives, drawing on European competence frameworks. The explanatory memorandum of the Omnibus names the DigComp framework as an example.

For HR teams, a second point of the Omnibus matters more than the wording. The obligations for high-risk systems under Annex III, which include AI in recruiting and performance assessment, no longer apply from 2 August 2026 but from 2 December 2027. The transparency obligations under Article 50, such as disclosing that someone is communicating with an AI, have applied unchanged since 2 August 2026. The full overview of deadlines is on the page EU AI Act for HR.

Evidence456732

How far German companies have come

Most companies now train, but rarely everyone. According to the September 2026 survey by Bitkom, the German digital industry association, 70 percent of companies with 20 or more employees train their workforce in the use of AI. Only 11 percent train all employees, 22 percent train a large share and 37 percent train selected people. 25 percent offer no training at all, down from 43 percent the year before.

The direction is clear. In November 2024, before Article 4 started to apply, only 5 percent of companies trained all employees on AI according to Bitkom, and 48 percent offered no AI training at all. At the same time, 61 percent of working people wanted AI training. So employees wanted the training before the law required it.

Use has grown in parallel. In 2026, according to Bitkom, 57 percent of companies with 20 or more employees use AI, up from 36 percent the year before and 20 percent two years earlier. Official statistics count more narrowly: Destatis, the Federal Statistical Office, arrives at 26 percent of all companies for 2025, 36 percent for companies with 50 to 249 employees and 57 percent for those with 250 or more. Across Europe, according to Eurostat, 20.0 percent of companies with ten or more employees used AI in 2025, up from 13.5 percent the year before.

The self-assessment is sobering. 66 percent of companies rate the AI skills of their employees as low, only 28 percent as high. The international comparative study by KPMG and the University of Melbourne found in 2025 that 20 percent of people in Germany had completed any AI training at all, against 39 percent worldwide. In self-assessed AI literacy, Germany ranked second to last of 47 countries.

The reasons companies give for not using AI are revealing. Among companies that considered AI but did not introduce it, 72 percent cited a lack of knowledge according to Destatis, and 62 percent cited uncertainty about the legal consequences. Training is therefore also the precondition for anyone starting with AI in the first place.

Evidence89101112

Who needs AI literacy training, and how deep

Everyone who uses AI on the company's behalf, but not everyone to the same degree. The Commission explicitly considers different training levels for different target groups permissible and appropriate. According to the wording of Article 4, the yardstick is the technical knowledge, experience, education and training of the people involved, the context of use and the persons on whom the AI is used.

The last point makes HR a special case. If a marketing team uses AI for copy, a mistake affects an advertising text. If HR uses AI to pre-screen applications, a mistake affects a person. Annex III point 4 of the AI Act therefore classifies as high-risk AI used for job ads, analysing and filtering applications, evaluating candidates, decisions on promotion and dismissal, allocating tasks based on behaviour or personal traits, and monitoring and evaluating performance. The page AI in candidate screening describes which criteria AI screening may use at all.

For these applications, Article 26(2) requires a second, stricter competence obligation. Deployers must assign human oversight to people who have the necessary competence, training and authority. The Commission makes clear that the Omnibus leaves this obligation untouched and that the instructions for use alone are not enough. It becomes applicable together with the other high-risk obligations on 2 December 2027. If you introduce a screening tool before then, it makes sense to train the people overseeing it at the same time.

AI is now built into almost all HR software, usually without the company ever having decided on it as an AI project. My own survey of 203 AI tools for HR, as of 30 September 2026, counts 736 documented AI features, an average of 3.6 per tool. Only 37 of the 203 vendors comment publicly on the AI Act. If you rely on the vendor to provide the instruction, you will wait in vain with most of them.

This results in simple tiers. The broad workforce needs the basics and clear rules for the approved tools. Heavy users need knowledge of the limits of their specific tool. HR, managers who make personnel decisions and everyone overseeing high-risk applications need the deepest level. According to the Commission, people with a degree or experience in AI development are normally considered competent, but that too depends on the specific tool.

Evidence31314

What belongs in AI literacy training

The Commission names four building blocks as minimum content. First, a general understanding of AI: what AI is, how it works, which AI is in use in your own company and what opportunities and dangers it brings. Then your own role as provider or deployer, the risks of the specific systems in use, and measures built on that according to prior knowledge and context of use. Legal and ethical questions are part of it.

The Commission deliberately leaves open what the measure looks like. There is no one-size-fits-all solution, no strict requirements and no mandatory courses; whether training is needed depends on the context. One sentence is still worth remembering for HR teams: according to the Commission, reading the instructions for use or pointing employees to them is ineffective in many cases. A link to the vendor's manual usually does not meet the obligation.

The Federal Network Agency recommends an approach built on three pillars. First assess the need, then design the measures, and finally document, evaluate and update. As formats, it names self-study programmes, workshops and multi-stage courses, internal or external. HR knows this from every rollout: training without an inventory often reaches the wrong people with the wrong content.

The Federal Network Agency is just as clear about what Article 4 does not require: no formalised or standardised training, no external certification, no AI officer and no regular prior checks by authorities. Anyone trying to sell you a mandatory Article 4 certificate is selling something the law does not require. A good external offer can still be useful; it is simply not a requirement.

Public templates for the content now exist. The living repository of the Commission's AI Office collects more than 40 AI literacy initiatives from companies and the public sector. Adopting these practices does not, however, create a presumption that the obligation has been met. For small and medium-sized companies there are also more than 200 European Digital Innovation Hubs, 9 out of 10 of which already offer AI services such as training and workshops, according to the Commission.

Practice adds something no guideline mentions: train on your own cases. An hour on neural networks does not stick. An hour in which the team writes a real, anonymised job ad with the approved tool, checks the result and finds the invented qualification requirement in it does stick. The rules on what may go into which tool belong in an AI policy for HR teams, and the training is where they are explained.

Evidence31516

Works council, working time and costs

AI training is an in-house training measure, and under Section 98(1) BetrVG (Works Constitution Act), the works council has co-determination rights over how it is carried out. It can also propose who takes part. If no agreement is reached, the conciliation board (Einigungsstelle), a body with a neutral chair that settles disputes between employer and works council, decides. The law firm Noerr explicitly points out that works councils must be involved under Sections 96 et seq. BetrVG in training to implement Article 4.

Involvement starts earlier than the training itself. Under Section 96(1) BetrVG, the employer must, at the works council's request, determine the need for vocational training and consult with it. If jobs change so that employees' knowledge is no longer sufficient, the works council has co-determination rights under Section 97(2) as early as the introduction of the training measure. That fits an AI rollout that changes workflows almost word for word.

On top of this come the rights relating to the tool itself. Section 90(1) no. 3 BetrVG requires the employer to inform the works council in good time about the planning of work procedures, including the use of artificial intelligence. If the works council has to assess an AI rollout, an expert under Section 80(3) is deemed necessary. And for the tool, co-determination under Section 87(1) no. 6 BetrVG regularly applies. The page Co-determination on AI under Section 87 BetrVG describes how this works in practice. The most sensible route is to negotiate tool, policy and training in one procedure instead of three.

On working time, the legal position is less clear than is often claimed. A general principle from the Federal Labour Court (Bundesarbeitsgericht, BAG) that every mandatory training session counts as working time cannot be verified. In 2018, the court ruled that travel time to and from employer-mandated training had to be credited as paid working time because participation was solely in the employer's interest. That case, however, concerned a collective agreement. In practical terms: training that the company orders to meet its own legal obligation belongs in working time. Anything else invites a dispute.

Do not count on public funding for a pure Article 4 training. Funding for further training under Section 82 SGB III (Social Code Book III, which governs employment promotion) requires, among other things, that the measure goes beyond short-term adaptation training and lasts more than 120 hours. Measures the employer is legally obliged to provide are excluded. The picture is different for genuine retraining: there, a company with 50 to 499 employees usually pays 50 percent of the course costs, and a works agreement on further training reduces that share by 5 percentage points.

The costs themselves are more manageable than the debate suggests. According to Bitkom, 19 percent of AI users say that training employees causes high costs. The largest item is usually the working time of the participants, not a trainer's fee. That is why the tiers from the previous section pay off: if you train everyone to the same depth, you pay for the most expensive level for people who do not need it.

Evidence171819202122623248

What the record looks like

You do not need a certificate. The Commission makes clear that companies can keep an internal record of training and other measures and that no specific governance structure is prescribed. The Federal Network Agency recommends recording three things: the type of measure, its scope in terms of content and duration, and the participants. On top of that, regular evaluation and refreshers as needed.

In practice, the system HR already uses for mandatory safety briefings is enough. One line per measure with date, format, content outline and duration, a list of participants, a reference to the approved tools. If you have a learning management system, set up the measure there. If you do not, use a spreadsheet. What matters is that the list is updated with every new tool and every new hire.

The Federal Network Agency itself explains why the record matters despite the softer wording: a lack of AI literacy can be treated as a breach of a duty of care, especially if damage results from it. The record is therefore meant less for the authority than for the day a rejected applicant asks how the pre-selection came about, or a personnel file contains an incorrect AI-generated transcript.

One point is regularly forgotten in the documentation: people outside the core workforce. If external recruiters, service providers or interim staff work with AI on your behalf, they belong in the record. This can be solved contractually, with the service provider documenting its own training, or practically, with external staff joining your instruction sessions.

Evidence3152

What a programme for 200 employees can look like

For a mid-sized company, an Article 4 literacy programme fits on a few pages and into a few weeks. The following example is deliberately simple: a fictional machinery manufacturer with 200 employees, a works council, one approved chat assistant, an applicant tracking system with AI features and an HR team of three. It shows one possible split, not a template you must follow.

It starts with a short inventory. HR asks the heads of department which AI tools are in use, and IT supplies the list of software with AI features. This often turns up more tools than management expects, such as translation services, transcription in video calls and the text suggestions in the applicant tracking system. This list is also the basis for informing the works council under Section 90 BetrVG.

Then comes the tiering. All employees with a computer workstation get a basic unit: what the approved tools can do, where they make mistakes, which data must not go into them and whom to ask. Production staff who do not use AI get a short briefing instead of training, because Article 4 is tied to use. Heavy users in sales, purchasing and engineering get a second unit on the limits of their tool, based on their own examples.

The deepest level concerns HR and the managers who make personnel decisions. Here the question is what an AI feature in the applicant tracking system actually does, whether it sorts or evaluates applications and who checks the result. Anyone using these features is close to Annex III. This group should also know that from 2 December 2027, the deployer obligations require named, trained oversight.

In parallel, HR negotiates with the works council. A sensible option is an agreement that covers tool, usage rules and training together: which tools are approved, which data are off limits, that training takes place during working time and who selects the participants. The works council gets what it is entitled to under Sections 96 to 98 BetrVG anyway, and the company avoids three separate procedures.

Documentation comes last, and it is the smallest part of the work. A spreadsheet with measure, date, content, duration and participants, updated with every new hire and every new tool. Once a year, HR checks whether the content still matches the tools. Article 4 does not require more. Anything less would look thin at the first enquiry from the authority or a court.

Evidence2013

What happens if a company does nothing

There is no direct fine for Article 4. The AI Act's list of fines in Article 99(4), which provides for up to EUR 15 million or 3 percent of worldwide annual turnover, names a number of articles, but not Article 4. The German fine provision in Section 15 KI-MIG, with up to EUR 50,000, does not cover Article 4 either.

In Germany, the Federal Network Agency is responsible. The AI Market Surveillance and Innovation Promotion Act (KI-Marktüberwachungs- und Innovationsförderungsgesetz, KI-MIG for short), the German act implementing the AI Act's market surveillance, was signed on 22 July 2026 and entered into force on 29 July 2026. Under its Section 2, the Federal Network Agency is the market surveillance authority unless otherwise provided, for example BaFin, the financial supervisory authority, for financial companies. The Bundestag had passed the act on 11 June 2026. According to the Commission, national authorities have been enforcing the rules since August 2026.

Doing nothing still has consequences. The Commission writes that authorities could sanction breaches of Article 4 proportionately on the basis of national law, and that this is more likely if an incident can be shown to result from a lack of training. The AI Act does not create its own claim for damages; liability follows national law. That is exactly where the Federal Network Agency and the law firm Noerr point to the duty of care.

And the next stage is in sight. If you use AI in recruiting, promotion or performance assessment, from 2 December 2027 you must assign human oversight to trained and authorised people and, under Article 26(7), inform employee representatives and employees before the system is put into use. The fine range of Article 99(4) applies to deployers' high-risk obligations. A literacy programme that is in place today is then the foundation rather than a rush job.

On balance, the Omnibus has taken the pressure off Article 4. The obligation remains. If you have done nothing so far, you do not have to fear a fine, but you have a gap that becomes visible with every incident. If you already train, you do not need to start over. You need to document properly. And if you are planning HR applications in the high-risk area, December 2027 gives you a fixed date to work towards.

Evidence25262731415