AI Flash: AI literacy Under Article 4 of the AI Act: A Look at the New (Old) Questions

Following our report on the GEMA v. Suno case in our last AI Flash, we would like to continue providing you with regular legal insights into current developments in AI law.

Today’s topic: AI literacy under Article 4 of the AI Act

Hardly any provision of the AI Regulation affects as many companies in practice as Article 4 of the AI Act on so-called “AI literacy.” It applies regardless of risk class or industry and thus to anyone who offers or operates AI systems. This is already relevant simply when using ChatGPT, Copilot, or comparable tools in everyday work. The provision has now been amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744 of July 8, 2026, in effect since July 27, 2026). This is reason enough to take another detailed look at the regulation.

I. What Has Changed?

In its original version, Article 4 of the Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence  (AI Act) required providers and operators to ensure, to the best of their ability, that their personnel possessed a sufficient level of AI literacy. This wording faced criticism for implying a success that companies could hardly guarantee reliably.

The Digital Omnibus on AI has made adjustments. Article 4 AI Act now states:

(1) Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

(2) The Commission and the Member States shall support and facilitate the efforts of providers and deployers of AI systems, in particular SMEs, in fulfilling their obligation under paragraph 1 of this Article. For that purpose, the Commission shall publish practical examples of how to comply with that obligation on the single information platform referred to in Article 62(3), point (b).

(3) The Board shall adopt recommendations, taking into account European competence frameworks, to support the Commission and Member States in the promotion of AI literacy required under paragraph 1, including by setting out common objectives.

Thus, the obligation has shifted from "ensuring" a level of competence to supporting the development of AI literacy through appropriate measures - explicitly without guaranteeing a specific individual competence level. 

Notably, what was not included in the new version of the regulation is significant: the original Commission proposal aimed to largely shift the responsibility for promoting AI literacy to the EU and the Member States. This fundamental realignment did not prevail in the trilogue. The obligation remains-albeit mitigated-with the providers and operators themselves. The only new aspect is the accompanying support from the Commission, Member States, and the AI Committee (paragraphs 2 and 3).

II. What Does "AI literacy" Actually Mean?

The term "AI literacy" is not defined in Article 4 AI Act but is elaborated in the definition provided in Article 3 No. 56 AI Act. According to this, AI literacy refers to the "skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause."

Thus, AI literacy is not merely technical niche knowledge but a bundle of technical understanding, risk awareness, and legal and ethical basic understanding. It addresses all actors along the AI value chain - from developers and operational staff to individuals who use AI systems on behalf of the company, such as external service providers.

Importantly for practice: Article 4 AI Act does not prescribe a specific training format, certification, or a dedicated "AI Officer." Internal training, e-learning, workshops, or external training are all permissible-what matters is that the measures fit the technical knowledge level, experience, context of use, and risk profile of the respective target group. Both the Federal Network Agency and the AI Service Center Austria of the RTR explicitly recommend documenting the measures taken (type of training, content, timing, affected groups) to demonstrate compliance with Article 4 AI Act if necessary, even though no legally mandated proof standard currently exists.

III. The (Highly Problematic) Question of Sanctions

The question remains, particularly contentious in practice: What happens if a company fails to promote AI literacy?

1. No Immediate Fine Under Article 99 AI Act

First, the good news: Article 99 AI Act lists the provisions subject to fines exhaustively. Article 4 AI Act is not mentioned there. Therefore, the regulation does not provide for an immediate fine specifically for violations of the AI literacy obligation - this is confirmed by both the Austrian AI Service Center of the RTR and the Federal Network Agency.

However, a violation is not without consequences. Some literature suggests that national market surveillance authorities - in Germany, the Federal Network Agency - can address violations of Article 4 AI Act based on national regulations with other enforcement measures. Moreover, and practically more significant, Article 4 AI Act exerts its effect mainly indirectly, through general civil and corporate law.

2. Employer Liability Under § 278 BGB

If a company uses AI systems, it bears the entrepreneurial risk as an operator and is responsible for the proper organization of operations and work equipment. If damage occurs to customers or business partners - due to incorrect operation of an AI system, unverified adoption of erroneous AI outputs, or inputting business secrets into an external AI system - the employer is liable under § 278 BGB for the fault of its employees as vicarious agents. Article 4 AI Act reinforces an existing duty of care and effectively becomes the benchmark against which the appropriateness of the organizational measures taken is assessed. If there is a complete lack of a traceable training and governance structure, the assumption of a breach of duty of care is likely.

3. Recourse Against Employees

Conversely, a company that suffers damage can seek recourse from responsible employees under the principles of internal damage compensation. Here, an interesting interaction emerges: in cases of slight negligence, the employee is typically not liable; in cases of moderate negligence, only partially; full liability generally only arises in cases of gross negligence or intent. Literature suggests that the success of a recourse claim may depend on whether the employer has fulfilled its training obligation under Article 4 AI Act. A company without a robust training concept may find itself at a disadvantage in a serious case - even with potentially gross negligence on the part of employees.

4. Liability of Management and Board

Finally, the question also concerns the management level itself. Managing directors of a GmbH (§ 43 Abs. 1 GmbHG) and board members of an AG (§§ 76, 93 Abs. 1 AktG) are obliged to take the necessary organizational measures to ensure compliance with legal behavior within the company - such as through a compliance management system that also incorporates the AI literacy obligation. If they violate this obligation culpably and the company suffers damage as a result, internal liability under § 43 Abs. 2 GmbHG or § 93 Abs. 2 S. 1 AktG may apply. The recognized business judgment rule in German law provides only limited assistance here: whether or not to establish a compliance system with a training concept is not a matter of entrepreneurial discretion but is legally mandated. Entrepreneurial discretion exists only regarding the specific design - as long as an appropriate minimum standard is maintained.

Interim Conclusion: While Article 4 AI Act is not subject to fines, it is by no means without consequences. The actual "sanctioning" occurs through the backdoor of general liability law - and this makes the norm more relevant for business practice than the absence of a fine might initially suggest.

IV. Looking Beyond the Obligation: Added Value in Practice

While the legal discussion of liability risks is certainly justified, our consulting practice with numerous in-house training sessions and workshops on AI literacy reveals another often underestimated effect: the real value does not arise only in disputes but already in the training room itself. In almost every format we have facilitated, most of the staff's open questions - from responsibility for AI outputs to handling confidential data and copyright issues - could be clarified through direct exchange.

Practical uncertainties in daily interactions with AI tools can often be resolved easily before they become actual problems. Moreover, through shared exchange, a collective awareness within the company is created. AI literacy is then not perceived as an abstract compliance requirement but as a jointly developed standard that the staff supports.

V. Conclusion and Outlook

The Digital Omnibus on AI has made Article 4 AI Act more practical without abandoning the obligation itself. The absence of a fine does not change the fact that deficiencies in AI literacy can become relevant under general civil, labor, and corporate law - for the company, for employees in recourse cases, and for the management level alike. Those who take this framework seriously and simultaneously leverage the practical value of training and workshops not only create legal certainty but also foster a sense of shared sovereignty in dealing with AI within the company.

SKW Schwarz is happy to assist you in designing suitable training programs and accompanying you in conducting initial workshops on AI literacy in your company. Please feel free to contact us so that we can jointly create the greatest possible value for your business.