AI literacy and training for staff (AI Act Art. 4 as amended by Regulation (EU) 2026/1744)

Your staff already use AI. Some of it you provide (Copilot, DeepL, a chatbot in your ERP). Some of it they found on their own. Since 27 July 2026, Art. 4 of the AI Act, as amended by the Digital Omnibus (Regulation (EU) 2026/1744), requires every provider and deployer to take measures that support the AI literacy of their staff. This guide shows how a German SMB can meet that duty in a few weeks: a lean programme fitted to roles, run with the works council and documented so you can show what you did.

Why it matters

• It is a legal duty, but the bar is reasonable effort. As amended, Art. 4 requires providers and deployers to take measures to support the AI literacy of staff and of others who operate or use AI systems on their behalf. It does not require you to guarantee any particular level of literacy for any person [1][2]. The EU Commission says no certificate is needed, and an internal record of trainings is enough [2].
• Size and sector do not matter. If your company uses ChatGPT, Copilot or an AI feature in standard software, you are a deployer. The duty applies whatever your company size or sector [1][6].
• Enforcement and liability. National market surveillance authorities supervise Art. 4, and their supervision applies from 2 August 2026. The Commission says enforcement is more likely after an incident if staff had no appropriate training [2]. The AI Act itself creates no right to compensation. However, the Bundesnetzagentur notes that missing AI literacy can count as a breach of the duty of care under national law, especially when damage results [1][2].
• Reading the manual is not enough. The Commission states that relying only on the instructions for use, or asking staff to read them, may be ineffective and insufficient [2].
• The business case is bigger than compliance. Untrained users paste customer data into public chatbots, trust invented figures and drop tools after two weeks. Training is the cheapest control against data leaks (GUIDE-013) and the strongest driver of adoption (GUIDE-008).

When you need it

• Now, if staff use any AI tool, approved or not. The original Art. 4 has applied since 2 February 2025 [2].
• Before every new AI rollout or pilot (GUIDE-009). Make a short training on the specific tool part of go-live.
• When a system or its use changes, for example a new model, new data sources or an agent that now acts on its own. The Bundesnetzagentur recommends evaluating and refreshing measures whenever systems, contexts or technology change [1].
• Before 2 December 2027, if you will deploy Annex III high-risk AI, for example in hiring or in employee evaluation. On top of Art. 4, deployers of high-risk systems must assign human oversight to people with the necessary competence and training. The Omnibus kept this duty [2] (see GUIDE-014).

Who is involved

Step by step

1. Build the AI inventory (1–2 days). List every AI system in use: licensed tools, AI features in existing software (M365, DATEV, CRM, ERP), and tools staff use privately for work. A short anonymous survey or a look at proxy and SaaS logs will reveal shadow AI. For each system, record the purpose, the users, the data it touches and the risk. The Bundesnetzagentur puts the needs analysis first: who uses which system, for what purpose, with which risks and opportunities [1]. Also record your role. Most SMBs are deployers only, but building your own chatbot on an API can make you a provider [2].

2. Group staff into role clusters (half a day). Use three or four clusters rather than individual plans: - All staff: Everyone who might touch AI, which in practice means all office staff. - Regular users: Daily users of approved tools such as writing assistants, translation, meeting summaries and RAG assistants. - Power users and builders: People who build automations (n8n, Power Automate), connect APIs or configure agents. - Decision-makers and oversight: Managers, plus anyone who acts on AI output in sensitive areas: HR, finance and, later, high-risk oversight.

Take people's existing technical knowledge, experience and education into account, as Art. 4 expects [2].

3. Involve the works council early (2–6 weeks, run it in parallel). Where an elected works council exists, consult it on in-house training measures (§97(1) BetrVG). Where AI changes jobs so that existing skills no longer suffice, the works council has a co-determination right on introducing training, and a deadlock goes to the conciliation committee (§97(2)) [7]. §98 adds co-determination on how in-house training is carried out. Because the AI tools themselves usually fall under §87(1) no. 6, agree on training as part of the AI works agreement (GUIDE-004). Make sure training records are not used for performance evaluation. In the public sector, the staff council (Personalrat) has comparable rights under the BPersVG and state laws.

4. Design content in three layers (1–2 weeks). The Commission names minimum topics: a general understanding of AI, your organisation's role, the risks of the systems you use and how to mitigate them, and actions tailored to staff knowledge and context [2]. The Bundesnetzagentur suggests a similar structure of basics, organisation-specific knowledge and role-specific depth [1]. In practice: - Basics, 60–90 min, all staff: What generative AI does and doesn't do, hallucinations, bias, what data may go into which tool, how to label AI-generated content, and who to ask. - Tool and process training, 1–3 h per tool: Live demos with your own documents. Show how to check results, what to do when the tool is wrong, and what the AI policy allows (GUIDE-007). - Role depth, half a day to 2 days: Prompt injection and access rights for builders (GUIDE-013), DPIA triggers for HR and the DPO (GUIDE-005), and the AI Act and contract basics for managers (GUIDE-014).

Train on your real use cases. Generic "AI 101" videos alone are the weakest option.

5. Choose formats and providers (1 week). No format is prescribed, and internal or external delivery both work [1]. A typical SMB mix: - Free e-learning for the basics: KI-Campus or appliedAI courses [1][5]. - An internal live session per tool, run by IT or a champion. - Monthly 30-minute office hours. - A one-page cheat sheet beside the AI policy.

Budget roughly 3–6 hours per regular user in year one. External half-day workshops typically cost a few hundred to a few thousand euros. Get quotes, because prices vary.

6. Run it and document it (ongoing). Keep a simple training record: measure, content, date, duration, participants, trainer and the materials version. The Bundesnetzagentur recommends documenting the type, scope, timing and participants of measures, so you can show compliance at any time [1]. A spreadsheet or your LMS is enough. Add the basics module to onboarding (AGENT-009 can automate this).

7. Evaluate and refresh (yearly, and on change). A short quiz or a feedback form at the end of each module will do. Article 4 does not require measuring employees' knowledge [2], so use the results to improve the training, not to grade people. Review content when tools, models or the AI policy change, and at least once a year.

Checklist

• [ ] AI inventory exists, including AI features in standard software and shadow AI
• [ ] Your role is clarified per system (deployer or provider)
• [ ] Role clusters are defined, with the target content and hours for each
• [ ] Works council informed and consulted; training covered in the AI works agreement
• [ ] Basics module delivered to all relevant staff, including part-timers, temps and freelancers using your AI
• [ ] Tool-specific training happens before every go-live
• [ ] AI policy and cheat sheet are linked from the training
• [ ] Training record kept (who, what, when, how long, materials version)
• [ ] Basics module is part of onboarding
• [ ] High-risk plans checked: people named for human oversight and trained before 2 Dec 2027
• [ ] Review date set (at least once a year)

Templates & tools

• EU Commission, AI Literacy Q&A: The official interpretation of Art. 4, including the Omnibus changes [2].
• EU AI Office, living repository of AI literacy practices: Over 40 real programmes from companies and the public sector, linked from the Q&A. Copying them does not automatically mean you comply [2].
• Bundesnetzagentur, KI-Kompetenz page and KI-Service Desk: German guidance, an SMB factsheet, the KI-Compliance Kompass and a list of free training providers [1].
• Mittelstand-Digital Zentren: About 100 AI trainers, free workshops and the KI-Readiness-Check for SMBs [1]. Centre offers are free [3]. Funding periods differ by centre, so check your regional centre before you plan.
• European Digital Innovation Hubs (EDIHs): Support for SMEs and public bodies, including test-before-invest [1].
• KI-Campus (ki-campus.org): Free online courses with free certificates of participation [5].
• IHK guidance: For example, IHK Rostock's guidance on the AI training duty, covering needs analysis, basics for all staff, guidelines and documentation [6]. Many IHKs also run courses.
• Funding, checked October 2026: Employee upskilling under §82 SGB III (Federal Employment Agency) is in force, with high subsidies for firms under 50 employees. However, it only covers approved courses of more than 120 hours, and it excludes training the employer is legally required to provide [4]. So it fits real requalification for AI-changed jobs, not basic Art. 4 training. For more programmes, see GUIDE-012.

Common pitfalls

• Treating it as a one-off e-learning. A click-through video with no link to your tools is exactly what the Commission calls potentially insufficient [2]. Combine it with hands-on tool training.
• Waiting for a "certified" course. No certificate is required [2]. Spend the money on content tailored to your systems.
• Forgetting the AI hidden in standard software. Copilot in Outlook, AI in the CRM and translation plugins all count. Keep the inventory current.
• Bypassing the works council. Training that ignores §97/98 BetrVG, or attendance data that ends up in performance reviews, poisons acceptance and can stop the rollout.
• Training without a policy. Staff learn what AI can do but not what they may do. Ship the training and the AI policy (GUIDE-007) together.
• Forgetting external people. Art. 4 also covers others who use AI systems on your behalf, such as temps, freelancers and service providers [2]. Agree in contracts who trains them.
• No record. Without documentation you cannot show reasonable effort after an incident [1][2].

Sources

1. Bundesnetzagentur: KI-Kompetenz (Art. 4 KI-VO), including building blocks, training layers, documentation and free offers. https://bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/7_Kompetenz/start.html. Accessed 2026-10.
2. European Commission: AI Literacy, Questions & Answers (including Digital Omnibus update). https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers. Accessed 2026-10.
3. IHK Hannover: Mittelstand-Digital Zentrum Hannover geht in die Verlängerung (as of 11.06.2026). https://www.ihk.de/hannover/hauptnavigation/innovation/innovation/technologien-trends/industrie-4-0-und-ki2/mittelstand-digital-zentrum-hannover-geht-in-die-verlaengerung-6175774. Accessed 2026-10.
4. §82 SGB III, Förderung beschäftigter Arbeitnehmer. https://www.gesetze-im-internet.de/sgb_3/__82.html. Accessed 2026-10.
5. KI-Campus, free AI learning platform. https://ki-campus.org. Accessed 2026-10.
6. IHK Rostock: KI-Schulungspflicht – was Unternehmen tun müssen (updated 22.04.2026). https://www.ihk.de/rostock/fachkraeftesicherung-und-digitalisierung/digitalisierung/ki-schulungspflicht-6547800. Accessed 2026-10.
7. §97 BetrVG, Einrichtungen und Maßnahmen der Berufsbildung. https://www.gesetze-im-internet.de/betrvg/__97.html. Accessed 2026-10.