AI Act and Mandatory AI Training: What Article 4 Requires
Since 2 February 2025, Article 4 of Regulation EU 2024/1689 (the AI Act) has required every organisation that uses artificial intelligence to ensure a sufficient level of AI literacy among its staff. No certification is mandated, but the obligation is real and must be documented. National penalties become applicable on 2 August 2026.
In practical terms, if your employees use ChatGPT, Copilot or any other AI tool in their work, you fall within the scope of the text. This article explains what Article 4 actually requires, who is concerned, and how to reach compliance without turning the subject into a bureaucratic maze. For the full picture on funding and certification, see our complete guide to AI training for business.
What Article 4 of the AI Act Actually Says
Article 4 requires providers and deployers of AI systems to ensure a sufficient level of AI literacy among their staff. The text specifies that measures must take into account the technical knowledge, experience, education and training of the people involved, as well as the context in which the systems are used.
Two words matter here. "Deployer" means any organisation that uses an AI system as part of its activity, which covers the vast majority of SMEs. "AI literacy" does not mean knowing how to code a model: it means understanding what the tool does, its limits, its risks and how to use it properly.
Article 4 sets an obligation of means, not of result. You must take reasonable and proportionate measures. A salesperson drafting emails with an assistant does not need the same level as a manager deploying a CV-screening tool.
Who Is Concerned: Why Your SME Probably Is
Any company that uses an AI tool in its activity is concerned, regardless of size. There is no exemption for micro-businesses or SMEs. A five-person team that uses generative AI to produce content or screen applications is a deployer within the meaning of the regulation.
The most common confusion is to believe that only AI software vendors are targeted. That is wrong. The provider (who designs the system) and the deployer (who uses it) each have obligations. If you have deployed a chatbot for your customer service, you are a deployer.
Non-profits are not spared either, as soon as they use these tools in their activities. The logic of the text is deliberately broad: whenever an AI system influences a decision or an output, the people operating it must understand what they are handling. If you are still weighing the value of training your teams, we set out the reasons to train your teams on AI in 2026.
What "AI Literacy" Means in Practice
AI literacy is a baseline of understanding, not technical expertise. The goal is for an employee to use an AI tool in an informed way and to grasp its risks.
In practice, a useful awareness programme covers:
- the basic workings of a language model (see LLM) and its limits, in particular factual errors and made-up answers
- data protection and the link with the GDPR, to prevent an employee from pasting client data into a public tool
- possible biases and the situations where human review remains essential
- the company's internal rules on what may, or may not, be handed to an AI tool
The level of detail depends on the role. A director needs a view of the stakes and risks. An operational team needs concrete reflexes for its own tasks. That is exactly why the format should be adapted, a topic we cover in our comparison of in-person versus remote training.
The Timeline: Two Dates to Remember
The AI literacy obligation already applies, but the penalty regime comes later. Here are the two deadlines that shape your compliance planning.
| Date | What changes |
|---|---|
| 2 February 2025 | Article 4 takes effect: the AI literacy obligation is in force, along with the prohibited practices |
| 2 August 2026 | The penalties set by Member States become applicable |
In other words, the obligation has existed since February 2025. The August 2026 date does not delay the obligation: it marks the point at which non-compliance can be penalised under national law. Waiting until the last minute would be a poor calculation, because a training initiative takes time to organise and document.
Penalties: What You Actually Risk
Article 4 does not carry a dedicated fine, but a lack of training becomes an aggravating factor. It is worth being precise here, because many articles circulate with approximate figures.
The AI Act penalty regime, set out in Article 99, provides for high ceilings for the most serious breaches, such as the use of prohibited practices. AI literacy does not fall into a specific fine category: it is the Member States that set the detail of applicable penalties, in line with the principles of the regulation.
In short, a regulator is unlikely to penalise an SME solely for a lack of training. The real risk is indirect. In the event of an incident, for example a data leak through an AI tool or a contested automated decision, the authority will examine whether your staff had been properly trained. The absence of any documented effort will then work against you. Conversely, a traced training record demonstrates your good faith.
How to Reach Compliance in Practice
Compliance with Article 4 comes down to three actions: identify, train, document. No need to aim for perfection; aim for a coherent and provable approach.
- Identify the people concerned. List who uses AI tools and for which tasks. Distinguish low-stakes uses from sensitive ones, such as processing personal data or supporting decisions.
- Deploy adapted training. Content and duration must match real uses. Half a day of awareness training is often enough for everyday use; more advanced use calls for a longer format. To calibrate, see our benchmark on how long AI training should last.
- Keep the proof. Certificates, attendance sheets, teaching materials and programmes form your compliance file. This is where Qualiopi-certified training makes full sense: it automatically produces this traceability and offers a high level of proof.
Good news on the budget: this type of training is fundable. Depending on your situation, you can draw on your OPCO or the FNE-Formation scheme, which sharply reduces the real cost. We detail the amounts in our article on the cost of AI training.
Mistakes to Avoid
The main mistake is to confuse compliance with individual certification. Article 4 does not require anyone to earn a diploma. Documented awareness training, adapted to the role, is enough.
Three other traps come up often. Believing that company size exempts you from the obligation: it does not. Thinking that a simple internal memo replaces training: a document with no follow-up proves little. Handing compliance to a provider without checking its credentials: we have listed the points to check when choosing a provider.
Frequently Asked Questions
Does Article 4 of the AI Act make AI training mandatory? Yes. Since 2 February 2025, it requires ensuring a sufficient level of AI literacy for people who use AI systems. It is an obligation of means, to be adapted to each role.
Is my SME with fewer than 50 employees really concerned? Yes. There is no size-based exemption. As soon as you use an AI tool in your activity, you are a deployer and the obligation applies.
Do I need a certification to be compliant? No. No individual certification is required. Training that is documented and proportionate to use is enough. Qualiopi-certified training simply makes the proof easier.
What level of training should I plan for? It depends on the uses. Short awareness training suits simple use. Sensitive use, such as processing personal data, calls for deeper content and particular attention to the GDPR.
What do we risk in an inspection? Article 4 has no fine of its own. The real risk is that, in the event of an incident, the absence of documented training becomes an aggravating factor. The national penalties provided for by the regulation apply from 2 August 2026.
How do we prove we are compliant? By keeping a file: list of people trained, certificates, attendance sheets, materials and programmes. Certified training produces these elements automatically.
How GrowthPerf Supports You
GrowthPerf is a Qualiopi-certified training organisation specialised in AI and automation for SMEs and non-profits. We build paths adapted to your real uses: an awareness session to set the foundations and bring all teams up to speed, then more operational modules for the people who use AI day to day.
Our AI awareness training for business covers exactly the baseline expected by Article 4: understanding the tools, their limits, their risks, good practices and the GDPR framework. Each session produces the documentation needed for your compliance, and the cost can be covered through existing funding schemes. To place this within a complete training strategy, return to our complete guide to AI training for business.
If you want to take stock of your situation, we offer a compliance audit to identify who needs training and the right level for each role.