Mandatory AI Training Under Article 4 of the AI Act: What Companies Must Provide Their Employees Starting in July 2026

Do we now have to train all employees in AI, and do they need a certificate for that? Many companies have been asking themselves this question since February 2025, when the AI competency requirement under Article 4 of the AI Act took effect. Most of the answers available online are now outdated. On July 27, 2026, the EU amended the article, and while the requirement has been significantly relaxed, it has not been eliminated.

For this guide, we compared the old and new wording in the Official Journal, reviewed the European Commission’s questions and answers as of October 20, 2026, examined the German implementing law and the guidelines from the Federal Network Agency, and analyzed the 2026 surveys conducted by Bitkom and the TÜV Association. Dustin Tatarowicz from marschfahrt.de personally completed the “AI Competency (IHK)” certificate course at the Rhein-Neckar Chamber of Industry and Commerce (IHK) in 2026 (certificate). At the end, you’ll receive a template for an AI competency plan with proof of training, available as a Word file and a PDF.

In a nutshell (as of October 2026)

The AI training requirement remains in effect: Every company whose employees use AI in their work must take steps to develop their AI proficiency. A specific level of proficiency, a certificate, or external training is not required. This also applies if the office “only” uses ChatGPT or Copilot. Since the amendment of July 27, 2026, the law states “support” instead of “ensure,” and explicitly, no one is required to guarantee a specific level of proficiency. There is no separate fine for violations of Article 4 in Germany. Since July 29, 2026, the Federal Network Agency has been responsible for enforcement, and it recommends documenting every measure taken. In practice, this means: identifying tools, defining roles, providing appropriate training for each role, documenting everything in a record, and—as we recommend—refreshing this annually. The template for the AI Competency Plan takes care of the structure for you.

What Changed on July 27, 2026

Instead of ensuring an adequate level of AI competence, you must now support its development. Until July 26, 2026, Article 4 required providers and operators to “make every effort to ensure” that their staff “have an adequate level of AI competence.” Since the amendment by Regulation (EU) 2026/1744—the so-called Digital Omnibus on AI—the first paragraph now reads: Providers and operators “shall take measures to support the development of AI competence among their staff and other individuals.” The following sentence has been newly added: “This obligation does not require providers or operators to guarantee a specific level of AI competence for any person.”

The old and new wording of Article 4, paragraph 1, side by side. What has remained the same is whose knowledge and in what operational context must be taken into account.

The rationale is set forth in Recital 8 of the amending regulation. Strict obligations “to ensure a sufficient level of AI competence” are “not suitable for all types of providers and operators” and impose an additional burden “especially on smaller companies.” At the same time, AI competence should “be a strategic priority, regardless of legal obligations and possible sanctions.” The legislature has thus softened the requirement but deliberately retained it.

What is noteworthy is what did not happen. In November 2025, the Commission had proposed removing the obligation from companies entirely and instead requiring the Commission and member states to promote AI literacy. A middle ground prevailed: Companies remain responsible, and according to the new paragraph 2, the Commission and member states are to support them—“in particular” small and medium-sized enterprises. Anyone who still reads today that the AI training requirement has been “abolished” has confused the proposal with the final outcome.

The European Commission’s AI Act Service Desk displays Article 4 in the consolidated version dated July 27, 2026, and marks each paragraph as “AMENDED” (1). The new sentence regarding the level is highlighted (2).

The date is clear, even though the Commission refers to “mid-July 2026” in its Questions and Answers. The regulation was published in the Official Journal on July 24, 2026, and, in accordance with its final provision, entered into force on the third day thereafter, that is, on July 27, 2026. There is no transition period for the new Article 4. The obligation itself has been in effect without interruption since February 2, 2025, because Article 4 is located in Chapter I, and that chapter has been applicable since that date.

Who's Responsible: The Office and ChatGPT, Too

An “operator” is any company that “uses an AI system under its own responsibility,” and that includes ordinary office tools. The definition in Article 3(4) excludes only use “in the context of a personal and non-professional activity.” In its Q&A on AI literacy, the Commission answers the question of whether a company is affected if its employees use ChatGPT —for example, for advertising copy or translations—with a clear “Yes”: Employees should be informed about the specific risks, “for example, hallucination.” There is no specific statement regarding Copilot, Gemini, DeepL, or AI features in accounting software, but the logic of the definition applies equally.

This is no longer a niche group. According to Bitkom, 57 percent of companies with 20 or more employees use AI; a year ago, that figure was 36 percent. The TÜV Association estimates that 56 percent of companies use applications such as ChatGPT, Gemini, or Copilot in their day-to-day work, rising to 68 percent among large companies. It is not legally clear whether a company is also liable for AI use that it has not authorized. It is safer to be aware of and regulate this use; more on this in Step 1.

This does not refer only to employees. Article 4 refers to “their staff and other persons” who work with AI on behalf of the company. The Commission cites as examples “a contractor, a service provider, a client”—that is, freelancers, service providers, and, in some cases, clients who work with your systems. The Federal Network Agency also includes contractors and service providers in this category. In practice, we recommend the following: If you have an agency, a translator, or a call center working for you using AI tools, you should specify in the contract how they train their staff.

What is expressly not required is

No certificate, no AI officer, no mandatory course, and no minimum proficiency level. Regarding the question of proof, the Commission states: “There is no need for a certificate.” Instead, companies could maintain “an internal record of training and/or other guiding initiatives.” The German-language responses from the AI Act Service Desk state that there is “no obligation for external training or certification,” and the law does not require “companies to appoint AI officers.”

The Federal Network Agency summarizes this on its page on AI competence as follows: “The AI Regulation does not specify how this support should be provided. No standardized training measures are prescribed.” A little further down, it states: “The AI Regulation does not require certification for training or qualification measures that are undertaken. These measures can be carried out both internally and externally.”

The Federal Network Agency’s “AI Competence” page: no specific level required per person (1), no mandatory certification, and both internal and external measures are possible (2), documentation is recommended (3).

This is important because the market paints a different picture. Some training providers advertise their courses as offering “officially recognized certification.” There is no such thing as officially recognized certification, neither from the EU nor from the Federal Network Agency. A certificate can still be useful, for example, as a way to assess learning or for professional development. It’s just not a requirement for fulfilling the obligation.

The rules remain stricter for high-risk AI. Anyone operating a high-risk system—such as one used for candidate selection—must, under Article 26, employ personnel with the necessary expertise to provide human oversight. This is a separate obligation in addition to Article 4, and the Commission emphasizes that it “remains in place.” According to the Omnibus Regulation, it will apply to systems listed in Annex III as of December 2, 2027, and to those listed in Annex I as of August 2, 2028.

What happens if you do nothing?

There is no specific fine for Article 4 in Germany; the risk lies elsewhere. The lists of fines in Article 99, paragraphs 3 through 5, of the AI Regulation do not mention Article 4, and the German AI Market Surveillance and Innovation Promotion Act (KI-MIG) of July 22, 2026, also does not mention AI competence in its provisions on fines. Although the Commission states that national authorities “could impose penalties,” this would require a national legal basis. Based on our review of the AI-MIG (as of October 2026), Germany has not established such a basis for Article 4.

Supervision is still in place. According to Section 2 of the KI-MIG, the Federal Network Agency has been the competent market surveillance authority since July 29, 2026, and according to the Commission, the rules on supervision and enforcement apply as of August 2, 2026. In our assessment, the authority can require a company to demonstrate or implement measures, even without imposing a fine. There is no solid experience with this yet.

The real risk becomes apparent after an incident occurs. The Federal Network Agency states: “A lack of AI expertise can be considered a breach of the duty of care.” The Commission considers sanctions more likely “if there is proof of an incident due to a lack of appropriate training and guidance for employees.” Suppose a sales representative copies customer data into a freely available chat tool, or a quote contains legal advice generated by AI. Without documented training and clear rules, you will then lack evidence that you took your duty of care seriously. The AI Regulation does not create a separate right to damages; claims, if any, arise from other laws, such as general civil law.

Where German Companies Stand Right Now

Most companies are taking some action, but rarely for everyone. According to Bitkom, by 2026, 70 percent of companies with 20 or more employees will be training their staff in the use of AI. More specifically: 11 percent will train everyone, 22 percent will train the majority, and 37 percent will train selected employees. 25 percent will not offer any training at all; last year, that figure was 43 percent, and in 2024, it was still 48 percent. Among companies that use AI, 91 percent provide training. Nevertheless, 66 percent rate their workforce’s AI competence as low.

Percentage of companies with 20 or more employees that provide training on AI, 2024 and 2026. Source: Bitkom Research, 602 and 603 surveyed companies, respectively.

The TÜV Association measures something else—namely, whether employees have already received training—and estimates that by early 2026, 27 percent of companies will have done so, more than twice the 12 percent recorded in 2024. Among large companies, the figure is 49 percent, while for businesses with 20 to 49 employees, it is 21 percent. Currently, 45 percent see no need for such training, and only 29 percent have a written continuing education strategy. These two figures are not contradictory: Many companies offer training programs, but by no means have all employees completed them yet.

For a larger company, the conclusion is clear. An offering for “selected employees” isn’t enough if chat tools are used throughout the entire organization. So the question isn’t so much whether you provide training, but rather whether every person who uses AI has received training appropriate to their role—and whether you can demonstrate that.

Step 1: Identify which AI technologies are actually in use

Start with a list of tools, not a course. The Commission identifies the first step of a program as establishing a general understanding of AI within the organization, followed by an assessment of the role and risks of the systems in use. To do this, you need an overview: Which AI systems do you use, who uses them, for what purposes, and with what data? In its checklist, the Rostock Chamber of Commerce and Industry asks quite directly: “Which employees work directly with these systems?”

Don’t forget about the tools that nobody asked for. According to a Forsa survey conducted for the TÜV Association in October 2025, as reported by ingenieur.de, only 32 percent of working adults surveyed are aware of specific AI guidelines from their employer, while 54 percent have neither rules nor a ban in place. Where there are no rules, there’s a high risk that employees will use personal accounts. So, conduct a brief, anonymous survey instead of just checking the IT department’s license list.

• Available Tools: Chat assistants with a business account, Copilot in Office, translation, transcription

• Built-in AI: Features in CRM, accounting, ticketing systems, and image editing that are often added via updates

• In-house applications: Chatbot on the website, internal knowledge search, automations using AI-powered steps

• Unauthorized use: personal accounts, browser extensions, free online tools

Step 2: Define roles instead of training everyone the same way

Divide employees into roles and assign each role the appropriate level, as Article 4 requires that prior knowledge, experience, and the context of use be taken into account. A one-size-fits-all training program is therefore not wrong, but it is insufficient for most and excessive for some. The Federal Network Agency proposes three levels, which are explicitly neither mandatory nor exhaustive: “Fundamentals of Data and AI,” followed by “Technical Aspects” and “Specific Opportunities and Risks and the Legal Classification of the AI Used,” and finally “Role-Specific Training with Individual Focus Areas, e.g., Technology, Law, Ethics.”

For companies with 50 or more employees, we suggest dividing roles into five categories. The matrix shows which level requires which role. This is our recommendation, not an official requirement.

Role Matrix for AI Competency: Levels based on the proposal by the Federal Network Agency; roles and scope based on the proposal by marschfahrt.de.

• All Employees with AI Access: What AI Can and Cannot Do, Hallucinations, Which Data Is Off-Limits, Which Tools Are Approved, and When AI Content Must Be Labeled

• Business users: Employees who use AI on a daily basis for texts, analyses, or customer interactions need specific tools, clear instructions, and a way to verify results

• IT and Development: Anyone who sets up, integrates, or builds AI features on their own needs technology, security, data, and an understanding of their obligations as a potential provider

• Managers: Operational Decisions, Risks, Responsibility, Rules for the Team

• Human Resources, Data Protection, and the Works Council: Co-determination, Data Protection, and High-Risk Cases Such as Candidate Selection

Step 3: Choose actions that fit the role

Choose a format for each role that suits its tools and tasks; the law does not specify one. According to the Federal Network Agency, the format can “range from self-paced learning programs to workshops and training sessions to multi-level continuing education programs.” In the European Commission’s list of examples, several large companies rely on a two-tier approach. Booking.com, for example, describes “foundational training for all employees, starting with a video training series,” while Collibra outlines basic training for all employees plus training for technical teams. Generali uses a group-wide learning platform for all employees. However, according to the Commission, simply following an example does not automatically fulfill the obligation.

What a basic module should cover for everyone, at a minimum, is set forth in the definition in Article 3, No. 56: to “use AI systems competently” and to be “aware of the opportunities and risks of AI and potential harm.” Specifically:

• How Language Models work and why they can give convincingly incorrect answers

• Data: anything that should never be entered into an AI tool—such as customer data, employee data, and trade secrets—except in explicitly authorized environments

• Verify: Check sources and figures before a result leaves the company

• Rights: Copyright for images and text; transparency requirements under Article 50, such as for chatbots and deepfakes

• Your rules: which tools are approved and who to ask

There is a wide range of costs. The TÜV Academy offers an online training course on AI skills starting at 25 euros net per person, while TÜV NORD offers an e-learning course with four modules starting at 85 euros net for one year. A two-day in-person seminar on AI fundamentals at the Haufe Academy costs 1,540 euros net. E-learning is well-suited for the basic module. In our experience, for specialized users, a workshop using their own tools and real-world tasks from their daily work is significantly more beneficial because people end up working differently afterward—rather than just passing a test. That’s how we structure our AI workshop for teams: one day, one specific use case per person.

Step 4: Provide proof of training

Document every measure in writing, as recommended by the Federal Network Agency. Companies should “document their measures thoroughly,” because “this allows them to demonstrate at any time that they meet the requirements of Article 4.” According to the agency, the type of measure, its content and duration, as well as the participants, must be recorded. The Commission refers to this as an internal training log.

We recommend including a few additional fields, because they will later help answer questions that no one else will be able to answer: the date, the AI system in question, the role, the format, who provided the training, whether there was an assessment, and when the next refresher training is due. These fields are our recommendation, not the official wording from the regulatory agency.

Excerpt from the template: Training certificate with the fields specified by the Federal Network Agency and our additions.

The documentation doesn't have to be complicated. A table in the HR system or in a separate file is sufficient, as long as it is complete and up to date. Our template, available as a Word file (and also as a PDF), combines the tool list, role matrix, training plan, and documentation into a single document. The completed example shows the plan for a fictional company with 180 employees.

Step 5: Refresh when something changes

Be sure to schedule refresher courses, because training completed in 2025 will hardly be relevant by 2027. The Federal Network Agency states: “Building AI expertise is an ongoing process. AI skills should be refreshed regularly and adapted to technological developments.” The tools change faster than almost any other software in the company, and with them, the risks change as well.

We recommend specific occasions and an annual review:

• New Employees: Basic Onboarding Module Before They Gain Access to AI Tools

• New tool or feature: a brief orientation for the relevant role, such as when an assistant suddenly gains access to emails or files

• Incident or Near-Miss: Discuss the case as a team and adjust the rules

• Once a year: Review the basic module and check the tool list

Involve the Works Council and Data Protection Early On

Any company with a works council should plan the implementation of AI and AI training with the council from the very beginning. According to Section 90(1)(3) of the Works Constitution Act (BetrVG), the works council must be informed about the planning of work processes “including the use of artificial intelligence,” and, according to Section 90(2), must be consulted in a timely manner so that its proposals can still be taken into account. If the works council is required to assess the use of AI, Section 80(3), second sentence, of the Works Constitution Act (BetrVG) stipulates that the consultation of an expert is necessary. If a tool tracks behavior or performance—for example, through usage logs—co-determination under Section 87(1)(6) of the Works Constitution Act (BetrVG) may apply. In January 2024, the Hamburg Labor Court ruled in summary proceedings (24 BVGa 1/24) that there was no right to co-determination regarding the use of ChatGPT because employees were using private accounts in their browsers. This is an isolated case that you should not rely on once you provide your own licenses and accounts. The court did not rule on training programs.

Sections 96 through 98 of the Works Constitution Act (BetrVG) on vocational training apply to the training programs themselves. At the request of the works council, the employer must assess training needs, and the works council has a say in the implementation of company-sponsored training programs. It has not been definitively clarified whether every AI training program falls under Article 4. The law firm Noerr recommends observing these co-determination rights. This is not legal advice; in the event of a dispute, seek advice from an employment law attorney.

The data protection officer should also be included in the discussions. According to Article 39 of the GDPR, the data protection officer is responsible, among other things, for overseeing the “awareness-raising and training” of employees who process personal data. The rules regarding data in the AI module and the data protection training should be aligned. According to the Commission and the Service Desk, having a dedicated AI officer is not mandatory; therefore, this responsibility can fall to the data protection, IT, or human resources departments.

Funding: Why the Usual Programs Are Largely Ineffective

For typical training courses under Article 4, there is usually no funding from the government. The Employment Agency’s funding for continuing education under Section 82 of SGB III requires that the training course comprise “more than 120 hours,” be accredited, and go beyond “purely job-related, short-term refresher training.” A two-hour session or a one-day workshop does not meet these requirements. Furthermore, for companies with 500 or more employees, the agency covers only 25 percent of the course costs.

The Employment Agency's requirements for employee subsidies: more than 120 hours of continuing education (1) and grants based on company size (2).

The NRW 2.0 Education Check covers 50 percent of the costs, up to a maximum of 500 euros; however, it is “available exclusively to individuals” and applies only to those with a taxable annual income of up to 50,000 euros, or 100,000 euros in the case of joint filing. It is not suitable for corporate programs. To find out what programs are available for AI projects—such as consulting grants or promotional loans for implementation—see our guide “Getting Funding for AI in Your Company.” The Federal Network Agency also lists free training and information resources on its website that are suitable for the basic module.

Frequently Asked Questions

Five Questions About Mandatory AI Training, Answered Briefly.

Is one e-learning course enough for everyone?

For the basic module, a good e-learning course may be sufficient if it aligns with your tools and guidelines. In our experience, however, this is not enough for employees who use AI on a daily basis or provide results to clients. Article 4 requires that experience and the context of use be taken into account, and a general course does not meet this requirement.

Do we need to train employees who only use AI for personal purposes?

No. Purely personal, non-professional use is not covered by the regulation. The exception applies only to purely private use. Anyone who uses AI for work is not covered, even if they use a personal account. Whether the company is considered the operator depends on whether it is responsible for the use. If in doubt, include these individuals in the plan.

Does this requirement also apply to small businesses?

Yes, for businesses of all sizes. According to Article 4, paragraph 2, small and medium-sized enterprises are to receive special support; they are not exempt. In our view, if a business has only a few employees and uses a single tool, a brief orientation session with a note in the training record is sufficient.

Has Article 4 been repealed by the Digital Omnibus?

No. The Commission had proposed that in November 2025, but it was not adopted. Since July 27, 2026, the requirement has been worded in milder terms, but it remains an obligation for companies.

Who is in charge at the company?

The law does not specify this. In larger companies, planning is usually handled by Human Resources or the HR Development department; the content comes from IT and the data protection team; and management bears the responsibility. It is important that one person keeps track of this and initiates refresher training.

What Has Changed and What That Means for You

The requirement has been in effect continuously since 2025; only its criteria changed in 2026. For more information on the law as a whole, see " The EU AI Act Explained Simply."

February 2, 2025: Article 4 takes effect. Since then, you have been required to implement measures to promote AI literacy, initially with the goal of achieving a sufficient level of AI literacy.

November 19, 2025: The Commission proposes shifting the obligation to the Commission and the member states. This did not initially change anything for you, but some websites prematurely reported that the obligation had ended.

July 27, 2026: The amended version takes effect. You must support the development of AI proficiency, but you are not required to guarantee a specific level. In our assessment, existing training programs will continue to count as measures; you do not need to set up anything new.

July 29, 2026: The AI-MIG takes effect, and the Federal Network Agency becomes the competent authority. The law does not specify a separate fine for Article 4. From now on, it’s a good idea to have the necessary documentation on hand.

August 2, 2026: According to the Commission, the rules on supervision and enforcement by national authorities are now in effect.

December 2, 2027: The requirements for high-risk systems set forth in Annex III will take effect, including the training for human oversight specified in Article 26. This applies to you if you use AI, for example, in the candidate selection process.

Date of this version: October 31, 2026. This article does not constitute legal advice.

Conclusion

The AI competency requirement has been less stringent since July 2026, but it applies to almost every company, and it can be easily met with minimal effort. Identify which AI tools are used in-house, assign roles to employees, assign an appropriate measure to each role, document each training session, and update the documentation when tools change. You don’t need a certificate for this, but you do need a list.

Download the template for the AI Competency Plan and start by listing the tools that are already in use today. If you want to establish clear rules for their use in the next step, you’ll need an AI policy. A separate guide with a template will be available shortly.