Guides
AI literacy obligation: what small businesses need to know now
Since February 2025, the EU rule is: anyone using AI in their business must ensure that the people working with it understand it well enough. Sounds like red tape, but it's manageable for small businesses – and worthwhile.
By Marvin Pirner · Last updated: September 2026 · Reading time approx. 3 min.
- Applies since 2 February 2025 to everyone who uses AI professionally – including small businesses.
- Since the amendment by the so-called AI omnibus package 2026, the rule is: take appropriate measures, not guarantee a specific level.
- No certificate is required.
- Worthwhile: a short training session, clear rules, and documenting both.
What does Article 4 say?
Article 4 of the European AI Regulation (AI Act) applies to providers and deployers of AI systems. You're already a "deployer" if you or your staff use an AI program like ChatGPT for work. The obligation: take measures to ensure that these people have sufficient AI literacy – adapted to their prior knowledge, their tasks and the context in which the AI is used. In 2026, the article was amended by the EU's AI omnibus package: the obligation remains, but it's about taking appropriate measures, not about guaranteeing a specific level of competence for each individual.
What does "AI literacy" mean in practice?
For a small business, this mainly means: anyone using AI knows,
- what the programs in use can and can't do,
- that AI makes mistakes and results need to be checked,
- which data doesn't belong in it,
- which programs are allowed in the business and who to ask.
Are there penalties?
Article 4 is not on the list of violations for which the AI Act itself sets specific fines. In 2026, Germany designated the Federal Network Agency (Bundesnetzagentur) as the central supervisory authority for the AI Act. But more important than the question of fines: if AI misuse causes harm – such as a data protection breach – you'll want to be able to show that you trained your team and set clear rules.
How to implement it in four steps
- Take stock: Which AI programs are used in the business, by whom, for what? A simple table is enough.
- Write down rules: One page: approved programs, what doesn't belong in them, checking results, who to contact.
- Brief training: A practical session for everyone who uses AI – working through real tasks from your everyday business.
- Document it: Date, participants, content. Repeat for new staff or new programs.
Checklist
- List of AI programs in use
- One page of AI rules for the business
- Briefing for everyone who uses AI
- Record with date and participants
- Plan to repeat for new people or new programs
How I can help
In AI Integration, we work out the rules for your business and introduce your team in a hands-on way; for larger teams, a workshop is available on request. You'll receive a certificate of participation with the content for your records. → To AI Integration
Frequently asked questions
Does this apply if only I use AI myself?
The obligation targets people working with AI on your behalf. As an owner with no staff, you use AI yourself – but familiarizing yourself with the basics is still worthwhile.
Do I need a certificate?
No, no specific certificate is required. What matters is that the training fits your tasks and is documented.
Is an online video enough?
Maybe as one building block. What matters is that people know afterwards how to use AI safely in their work.
This article is a practical overview, not legal advice. For binding guidance, consult a lawyer or your data protection officer.
Source: Regulation (EU) 2024/1689 (AI Act), Art. 4, as amended by the 2026 AI omnibus; information current as of September 2026.
Prefer to start together?
In the free consultation, we'll look at where to start in your business.