EU AI Act and AI literacy
The EU AI Act classifies AI systems by their risk. Art. 4 has applied since 2 February 2025 and, since 27 July 2026, requires measures to promote the AI literacy of staff. This learning path from module 2 explains the legal status, the roles and the risk classes.
- Module
- 2 of 10, law with the EU AI Act, GDPR and compliance
- Learning texts
- Units 11 to 24, freely accessible, in German
- Legal status
- October 2026
The legal status with dates
The AI Regulation (EU) 2024/1689 applies in stages. Two dates matter for AI literacy, 2 February 2025 and 27 July 2026.
1 August 2024
Entry into force
Regulation (EU) 2024/1689 enters into force. The rules apply in stages.
2 February 2025
Art. 4 and Art. 5 apply
The rule on AI literacy and the prohibition of certain AI practices apply to providers and deployers.
2 August 2025
General purpose AI models
Rules for large foundation models and supervision by the AI Office take effect.
27 July 2026
Amendment of Art. 4
Under Regulation (EU) 2026/1744, Art. 4 requires measures to promote the AI literacy of staff.
29 July 2026
Point of contact in Germany
The Federal Network Agency is the point of contact for the EU AI Act.
2 August 2026
Market surveillance
Market surveillance under the EU AI Act begins.
High risk systems have their own staggered deadlines. Whether and from when they affect your application is something to clarify case by case with your legal advisers.
Provider or deployer
The EU AI Act distinguishes two roles. Most companies are deployers, because they use AI systems professionally without developing them. Deployers have their own tasks that no software contract takes off their hands.
| Task | Provider | Deployer |
|---|---|---|
| Who | Develops an AI system or places it on the market under its own name. | Uses an AI system professionally under its own responsibility. |
| AI literacy under Art. 4 | Measures to promote the AI literacy of its own staff. | Measures to promote the AI literacy of its own staff. |
| For high risk systems | Conformity assessment, CE marking, technical documentation, instructions for use, risk management across the lifecycle and registration in the EU database. | Use according to the instructions, human oversight by trained persons, logging, reporting of serious incidents and informing affected persons under Art. 26. |
Anyone who substantially modifies an AI system or uses it for a purpose other than the intended one can legally become a provider and then takes on the provider's tasks.
Which risk class is your application in?
The sequence of questions from unit 16 of the knowledge base. Answer up to three questions with yes or no. If no question is answered yes, minimal risk applies.
Question 1 / 3
Does the system fall under one of the prohibited practices in Art. 5?
For example social scoring, subliminal manipulation of behaviour, emotion recognition in the workplace or untargeted scraping of facial images.
Prohibited
Unacceptable risk under Art. 5
This practice is prohibited in the EU, regardless of benefit or consent.
Stop the use or do not start it.
High risk
High risk under Annex I or Annex III
Use is permitted and strictly regulated. The tasks under Art. 26 apply to deployers.
Check the provider's documents, carry out a fundamental rights impact assessment where required, set up human oversight, train users on the system, keep logs.
Limited risk
Transparency under Art. 50
People must be able to recognise that they are talking to AI or seeing AI content.
Ensure labelling, such as a notice in the chatbot and labelling of images, plus measures to promote AI literacy under Art. 4.
Minimal risk
No question answered yes
The EU AI Act sets no specific requirements. GDPR, protection of trade secrets and liability law continue to apply.
Art. 4 remains, with measures to promote AI literacy for all users.
The risk class depends on the use, not on the tool. The same language model is minimal risk in marketing and high risk in candidate selection. If in doubt, assume the higher class. This sequence of questions does not replace legal advice in the individual case.
Art. 4 in everyday work
Art. 4 does not prescribe a fixed curriculum. Measures that match the role, prior knowledge and the systems in use make sense. Five steps turn this into a programme that works in everyday work and can be documented.
AI inventory
Record all AI tools in use, including use without approval. For each application, the purpose, data, user group and risk class.
Assign roles and levels
Each role gets a target level. Foundation for all users, Intermediate for regular users, Advanced for AI leads and the oversight of high risk systems.
Plan measures
Self learning on the fundamentals, training on real tasks and accompanied practice instead of a single seminar. The 120 teaching units of the knowledge base provide the content.
Document measures
For each person the date, content, level and duration, plus an overview of roles and the assignment of systems to their risk class.
Refresh
A fixed rhythm for refreshers and training for new tools, changed systems or new guidelines.
Which role needs which level
| Role | Typical AI use | Risk class | Target level |
|---|---|---|---|
| Assistants | Text assistant for drafts | Minimal | Foundation |
| Clerical staff | Internal AI assistant for documents and email | Minimal or limited | Foundation to Intermediate |
| Marketing and communication | Generated texts, images and campaigns | Limited under Art. 50 | Intermediate |
| HR and recruiting | AI supported preselection of applications | High risk under Annex III | Advanced plus training on the system under Art. 26 |
| AI lead and compliance | Steering all systems | All classes | Advanced |
The overview justifies the assignment, in other words which system, which risk class, which level and when training or a refresher took place.
Approval in three stages
A traffic light model from the knowledge base. Instead of discussing every request individually, you assign AI applications to one of three approval stages that every department understands.
Green, open use
No individual approval for non critical tasks, without personal data and without trade secrets.
Yellow, use with conditions
Only after review and with organisational measures, for tools that may touch personal or confidential data.
Red, blocked until approved
Only with the consent of compliance, data protection and, where applicable, the works council, for high risk applications and sensitive data.
The traffic light model governs who may use what and defines which level an approval requires.
The teaching units of module 2
Fourteen learning texts on law, data protection and compliance, freely accessible and without registration.
The learning texts are available in German.
- 11AI maturity models for companies
- 12Progress check 1 with quiz and reflection
- 13GDPR basics in the AI context
- 14Avoiding personal data in prompts
- 15EU AI Act, structure, timeline and addressees
- 16Risk classes of the EU AI Act
- 17Tasks for deployers under Art. 26 EU AI Act
- 18AI literacy under Art. 4 EU AI Act
- 19Copyright and AI content
- 20Trade secrets and confidentiality in the AI context
- 21Ethics frameworks of the OECD, the EU HLEG and Asilomar
- 22Bias, fairness and discrimination through AI
- 23Works agreement on AI
- 24Case study on the legal assessment of a use case
Frequently asked questions on the EU AI Act
Does the EU AI Act also apply to companies that only use AI?
Yes. Anyone who uses an AI system professionally under their own responsibility is a deployer within the meaning of the regulation. Art. 4 on AI literacy applies to deployers. Depending on the use, transparency under Art. 50 or the tasks for high risk systems under Art. 26 are added.
Does the EU AI Act also apply to small and medium sized companies?
Yes. Art. 4 and the prohibitions under Art. 5 apply regardless of company size. Relief for small companies exists only in specific places, for example in the technical documentation of small providers.
What has Art. 4 required since 27 July 2026?
Under Regulation (EU) 2026/1744, Art. 4 requires measures to promote the AI literacy of staff. It does not prescribe a particular course format or an examination. It makes sense to document the measures carried out, so that it remains clear internally who learned which content and when.
Is a single training session enough?
AI tools change constantly. An annual refresher has proven useful, plus additional training for new tools, changed systems or new guidelines from the European Commission and the AI Office.
What is the difference between Art. 4 and Art. 26?
Art. 4 concerns everyone who works with AI, regardless of risk. Art. 26 additionally governs the use of high risk systems, including human oversight by persons trained on the specific system.
The provider complies with the EU AI Act. Is that enough?
No. The provider's conformity is a prerequisite and does not replace the deployer's tasks. Use as intended, human oversight, training, logging and incident reporting remain with you.
Enablement made to measure, on real tasks for each role
- Call
- Enablement Call, 30 minutes, online
- Result
- Needs for each role and a plan for an Enablement Day on real tasks, which also documents the measures to promote AI literacy under Art. 4.
- Entry offer
- Enablement Day. One day with up to 15 participants, working on their own tasks.