AI Competence Training: What Article 4 of the EU AI Act Really Requires

Article 4 of the EU AI Act has required companies since 02.02.2025 to ensure sufficient AI competence among their staff. What it does not contain: a certification requirement, a minimum number of hours, or its own fine provision. And since the Digital Omnibus, which the EU signed on 08.07.2026, the provision has been further weakened: companies must support the development of AI competence, a mere best-efforts obligation. Whoever sells you mandatory training with the threat of penalties is selling you fear, not the legal situation.

What does Article 4 actually say?

Providers and deployers of AI systems should make best efforts to ensure that staff working with AI have sufficient AI competence, appropriate to their prior knowledge, context and field of use. The European Commission makes this clear in its official questions and answers on AI Literacy: no mandatory certificate, no prescribed course formats, not an obligation of outcome but an obligation of best effort. The Commission also maintains a Living Repository with over 40 practical examples, but stresses that replicating them does not establish a presumption of conformity.

What changed in 2026?

Two things. First, the national supervisory structure starts on 02.08.2026: in Germany, under the implementation act adopted by the Cabinet in February 2026, the Bundesnetzagentur is to become the central coordination body. A documented enforcement practice for Article 4 does not yet exist. Second, the Digital Omnibus softened the wording: the obligation to ensure competence became the obligation to support its development. The market reality is thus the opposite of many sales arguments: legal pressure has decreased, not increased.

Why train if there is no penalty?

For the same reasons that companies back up their data even without a fine. First, duty of care: if an AI system causes damage, the question will be asked whether staff were adequately trained, and documented measures are then your best defense. Second, efficiency: unsupervised AI use produces silent errors, from an invented source in a proposal to a data protection violation in a prompt. Third, productivity: the difference between a team that merely operates Copilot and one that actually works with it is a matter of training. We described the governance perspective on this in the article EU AI Act for SMEs.

What does sensible AI competence training look like?

• Role-based instead of one-size-fits-all: case handling staff need confident prompting and error detection, management needs deployment decisions and risk assessment, IT needs permissions and data flows.
• At the real workplace: training takes place on the tools the company actually uses, such as Microsoft 365 with Copilot, not on abstract slides.
• Documented: attendance, content and frequency recorded in writing, that is the substance behind the duty of care.
• With refreshers: AI features change every quarter, a one-time training becomes outdated faster than any other form of continuing education.

This is exactly how we build training at NordFlux, hands-on with Microsoft Copilot and the workflows of the respective company, with ongoing support afterward if desired.

Frequently Asked Questions about the AI Competence Obligation

Is AI training legally required for companies?

Article 4 of the EU AI Act has required companies since February 2025 to make efforts toward sufficient AI competence among their staff, but it prescribes neither courses nor certificates. Following the weakening through the Digital Omnibus in 2026, it is a pure obligation to support. Training is the most practical evidence of this effort, but no law specifies hours or formats.

Are there fines if we do not train our staff?

Article 4 has no own fine provision in the AI Act, and as of 2026 no enforcement practice exists. Missing training becomes relevant indirectly: in the event of damage as a possible breach of the duty of care, and from August 2026 within the framework of general market surveillance. Providers who advertise specific penalty amounts for missing AI training are arguing against the actual legal situation.

Do employees need a certificate?

No. The European Commission explicitly clarifies that Article 4 does not require certificates. What makes sense is internal documentation of who was trained when and on which content, appropriate to their role and the AI systems used. A purchased certificate with no connection to daily work fulfills the purpose of the provision worse than a documented hands-on training.

Which companies does Article 4 even apply to?

To all who provide or deploy AI systems within the meaning of the AI Act, regardless of size, so also to SMEs whose team works with Copilot, ChatGPT, or AI features in specialized software, for example. The scope of appropriate measures scales with the context and risk of the use.