AI Literacy Under Art. 4: What Content Employee Training Must Cover

Article 4 of the EU AI Act requires companies to promote the AI competence of their staff, but deliberately does not specify in detail which content a training must cover. Good guidance comes from the official recommendations of the BMDS (Federal Ministry for Digital Affairs and State Modernisation) / Advisory Centre for Artificial Intelligence (BeKI). This results in four content areas.

1. Basic knowledge

• What is AI and how does it work (including large language models)?
• Where is AI used within your own organization?
• What opportunities and risks exist?
• What legal and ethical framework applies?

(Source: BMDS/BeKI, "Content of the training," topic area basic knowledge.)

2. Role-based classification

Do we develop or integrate AI ourselves (the role of "provider") or do we use third-party systems (the role of "deployer")? Who bears which responsibility? This distinction shapes the obligations under the AI Regulation (source: BMDS/BeKI; EUR-Lex, Regulation (EU) 2024/1689, definitions in Art. 3).

3. Risk classification of the AI system

Employees should be able to assess the risk of the specific AI they use: is this a high-risk application? What specific risks exist and how can they be reduced? The AI Regulation distinguishes, among other things, prohibited practices (Art. 5), high-risk systems (Annex III) and transparency obligations (Art. 50) (source: EUR-Lex, Regulation (EU) 2024/1689).

4. Audience-specific differentiation

The BMDS recommends differentiating content by prior knowledge and role:

• General users (e.g., case workers): focus on use, risks, ethical understanding.
• Technical staff: architecture, security, monitoring.
• Executives: strategic use, legal framework, responsibilities, role-model function.
• Legal & compliance: AI Regulation, GDPR, BDSG (German Federal Data Protection Act), copyright law, internal governance.

(Source: BMDS/BeKI, "Target groups.")

And what about data protection?

AI use almost always touches personal data. A training should therefore cover which data may be entered into which tools, and which may not. Data protection violations can be fined under the GDPR with up to 20 million EUR or 4% of worldwide annual turnover (source: GDPR, Art. 83).

Conclusion

A basic training for general users primarily covers the "basic knowledge" area. For particularly high-risk or role-specific applications, the employer remains responsible for providing additional training. Our AI competence certificate bundles the fundamentals, understanding AI, using it safely, data protection and GDPR, the EU AI Act, and AI in daily work, into one compact online course with an exam.

Sources

• Regulation (EU) 2024/1689 (AI Regulation / EU AI Act), EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj
• European Commission, "AI literacy: Questions & Answers": digital-strategy.ec.europa.eu
• BMDS (Federal Ministry for Digital Affairs and State Modernisation) / Advisory Centre for Artificial Intelligence (BeKI): "Building AI competence under Art. 4 AI Act (AI Regulation), guidance for basic training" (Oct. 2025): bmds.bund.de

This article is general information and does not replace legal advice.