EU AI Act: what companies must now be able to prove
Since 2 February 2025, Article 4 of the EU AI Act obliges every company that uses or operates AI to ensure sufficient AI literacy among the people involved. From 2 August 2026, market surveillance begins — at which point you should be able to present evidence. This guide shows what to do in practice and gives you a hands-on proof kit for SMEs.
Last updated: July 2026 — not legal advice
The duty is broad and has no size threshold. It affects not just AI developers but every company that uses AI in its operations:
As soon as you use AI systems — even if it is only ChatGPT, Microsoft Copilot or a website chatbot — Article 4 applies. There is no exemption for small businesses.
The duty hits both providers (who develop or place AI on the market) and deployers (who use AI in their own name). Most SMEs are deployers.
The fact that the AI comes from a vendor does not release you. Your staff must be able to operate the systems in use competently and safely.
The literacy duty already applies. From 2 August 2026, the Bundesnetzagentur takes over market surveillance in Germany and can request evidence.
The AI Act does not require certificates or one uniform training for everyone. Literacy must be appropriate to the risk and the role: someone who only operates an AI assistant needs different knowledge than someone deciding on an AI rollout or running systems technically. The legislator deliberately framed the duty as a best-efforts approach — proportionate to actual AI use.
Staff who use AI tools day to day need the basics: roughly how generative AI works, what hallucinations and limits are, which data must never be entered, and how to check outputs.
Leadership and owners need an overview of the legal framework (AI Act, GDPR), the risk classes, governance and liability — enough to steer AI rollouts cleanly.
Those who build, integrate or operate AI need deeper knowledge: model and data selection, security, bias, monitoring, and technical documentation of the systems in use.
Important: the duty also covers documentation. The AI Act prescribes no particular form, but you should be able to show who was trained, when, and on what. That is exactly what the proof kit below is for.
Here is how to meet the AI literacy duty pragmatically and provably:
Four ready-to-use templates to document the literacy duty: a role/target-group matrix, a learning-objective matrix per role, a training-record template and a pragmatic AI usage policy. No download needed — unlock the kit right here and print it or save it as a PDF.
Article 4 (AI literacy) and Article 50 (labelling) work together: your teams must be competent — and your AI systems must disclose that they are AI. Whoever has both in hand by 2 August 2026 is ready for market surveillance.
To the Article 50 labelling checklistYes. Article 4 has no size threshold. As soon as a company uses or operates AI systems — even just ChatGPT or Microsoft Copilot — it must ensure that the people involved have sufficient AI literacy. The effort for a small business is, however, far lower than for a large corporation.
A video can be part of the training but rarely suffices on its own. Literacy must be appropriate to risk and role and must match the AI systems actually in use. What also counts is the evidence: who was trained, when, and on what content? An anonymous video with no attendance record does not meet that.
Useful items are: which AI systems are in use, which roles work with them, which learning objectives apply per role, plus training records with participant, date, content and confirmation. The AI Act prescribes no particular form — the duty is framed as best-efforts — but provability is the core. That is exactly what the proof kit above is for.
Market surveillance begins on 2 August 2026. In Germany, the Bundesnetzagentur becomes the central supervisory authority for the AI Act. Companies should then be able to present evidence of their AI literacy measures.
The AI Act provides for fines of up to EUR 15 million or 3% of global annual turnover for breaches of obligations. Article 4 is designed to be low-threshold, but a lack of AI literacy can count as an aggravating factor in the event of damage or other breaches.
We train your teams appropriately to their role on the AI systems you actually use, and supply the evidence with it. Pragmatic, in German, without the hype.
AI training is often eligible for SME funding — we check the right programmes with you.
Or start with a structured baseline assessment.
Go to the AI readiness analysis