EU AI Act: What AI Literacy Obligations Do Employers Have?
Since 2 February 2025, Article 4 of the EU AI Act obliges every company that uses AI systems to ensure its employees have "sufficient AI literacy". The obligation applies not only to AI vendors but to virtually every employer using AI in day-to-day work. Enforcement and sanctions begin on 3 August 2026 — but preparation should start now.
What exactly does the law say?
Article 4 of the EU AI Act requires companies to "take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf".
The key phrases are "to their best extent" and "sufficient": the law prescribes no specific format, no certification and no minimum number of hours. Instead, measures should match employees’ technical knowledge, experience and education as well as the specific context in which the AI is used.
Who does the obligation apply to?
To providers (those who develop or supply AI systems) and deployers (those who use AI systems within their own organization). The second point is the decisive one: as soon as AI tools are used in your company — from generative assistants to AI-supported software in recruiting or customer service — you are a deployer within the meaning of the law and therefore obligated.
What does "sufficient AI literacy" mean in practice?
The goal is not to turn everyone into an AI expert. What is meant is role-appropriate understanding: employees should be able to assess the capabilities and limits of the AI in use, recognize risks such as faulty outputs or data protection issues, and operate the systems responsibly. A manager needs a different level than a case worker — that is exactly what "appropriate to the context" means.
When do consequences kick in?
The obligation has applied since 2 February 2025. It becomes enforceable on 3 August 2026, once national market surveillance authorities are established and can impose fines. Member states define the sanction rules in national law. In other words: there is a limited window to build structures — anyone starting in 2026 is already late.
What employers should do now
- Take stock: Which AI systems are actually used in the company — officially and unofficially?
- Define target groups: Who works with what? Leadership, departments and power users need different depth.
- Assess current competence: Where does the workforce stand today — before you invest in measures?
- Design role-appropriate measures: From short awareness formats to in-depth enablement, matched to the risk.
- Document: Record which measures you have taken — that is your evidence of acting "to your best extent".
The biggest lever is almost always step 3: without an honest baseline, every training programme becomes guesswork.
Frequently asked questions
Does the obligation also apply to small companies?
Yes. Article 4 does not distinguish by company size. What matters is whether AI systems are used.
Do we have to buy a certified training programme?
No. The law does not prescribe any specific training format or certification. What matters are appropriate, documented measures matched to role and context.
Is distributing a PDF enough?
Probably not. "Sufficient AI literacy" means demonstrable capability, not mere information. The required depth depends on the risk of the specific AI use case.
Where should we start?
With a baseline assessment: which AI do we use, who works with it, and how competent is the workforce today?
This article provides general information about the EU AI Act and does not constitute legal advice. For a binding assessment of your specific situation, please seek qualified legal counsel.