Staff training
Staff training under the EU AI Act: what Article 4 actually asks for.
The obligation stands, but it asks for something other than most people expect. Not a certificate for everyone, but measures that fit your systems and your people. That is why it starts with a stocktake of your processes.
Legal basis
What the statute says
Article 4 of the EU AI Act is a single sentence. It is often shortened to “staff must be trained”. The wording says something more precise:
Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
Two parts decide everything and are usually skipped: the context the AI systems are to be used in, and the persons or groups of persons on whom they are used. Both must expressly be taken into account. So the question is not whether you train, but whether the measure fits your operation.
Legal status: 29 August 2026. These notes are an editorial summary and not legal advice; they do not replace a lawyer’s review of your particular case.
The core
Why an off-the-shelf training does not meet the obligation
A ready-made online course explains how language models work and where their limits are. That is useful and covers the basics. What it cannot do is what the statute expressly asks for:
It does not know your systems
Whether you run a chatbot in customer service, a pre-filter for applications, or a translation aid makes all the difference to risk and training need.
It does not know your data
Anyone feeding personal data, client files, or engineering data into an AI system needs different content than someone having text drafts phrased.
It does not know your roles
Management, business units, IT, and external providers need different depth. One course for everyone is too much for some and too little for others.
It does not know who is affected
Article 4 expressly names the groups of persons the systems are used on. Deciding about applicants or employees carries a different responsibility.
So our order is the reverse of the usual one: first we look at what runs at your company, then it is clear who has to learn what.
The order
First the stocktake, then the training
Before anyone goes into a course, we look at what actually happens in your company. This is not a preliminary; it is the basis on which the training can meet the obligation at all.
Which AI systems actually run
Not only the ones you bought: also the assistants inside office software, the features in your CRM, and the tools individual departments introduced without asking.
Which processes they sit in
We walk through the processes where AI decides or prepares decisions: applications, quotes, customer contact, quality checks. That is where risk and training need arise.
Who works with them and who is affected
Roles and groups of persons, exactly as Article 4 requires. From that follows who needs which depth, and who needs nothing.
What has to be documented
Records of processing, data protection impact assessment, consents. What is missing gets named; what suffices stays as it is.
This stocktake is the EU AI Act compliance audit. Its result is a training plan saying which group has to learn what, plus a roadmap for the remaining obligations. The training follows: either the AI Literacy course for the basics, or an in-house workshop working with your real processes.
What follows
When the stocktake turns up more than a training need
The stocktake often shows two things: that training is needed in one place, and that a process elsewhere would run better on a system of its own. The most common case is a tool that today receives data which must not leave the building.
That is what AI Implementation is for: introducing AI into a concrete process, with locally operated models on your own infrastructure where required. This is not an upsell but the honest answer when training alone does not solve the problem. The reverse holds as well: where a training is enough, we say so and build nothing.
Training need
Your team works with standard tools and needs confidence in using them.
Obligations unclear
You do not know which of your systems fall under which obligation.
The process does not hold
A process needs a system of its own, often with data that must stay in-house.
Questions
Frequently asked questions.
Legal status: 29 August 2026. These notes are an editorial summary and not legal advice; they do not replace a lawyer’s review of your particular case.
Do we have to train our staff under the EU AI Act?
Article 4 of the EU AI Act has required providers and deployers since 2 February 2025 to take measures supporting the development of AI literacy among their own staff. The Digital Omnibus, Regulation (EU) 2026/1744, has been in force since 27 July 2026 and turned this into a duty of effort: you have to act, but you do not have to guarantee a particular level of competence for any individual. In practice that means a documented training concept, cut to roles and risks, rather than a certificate for everyone. Whoever trains should be able to show who was trained, on what, and when.
Is a ready-made online course for everyone enough?
For the basics yes, for the obligation usually not. The statute requires taking into account the context of use and the groups of persons affected, and a ready-made course can know neither. The usual answer is a combination: basics through the online course, the company-specific part in an in-house workshop built on the stocktake.
What does the stocktake cost?
It runs as the EU AI Act compliance audit with a fixed scope and a fixed price. How large the scope is depends on how many systems and roles have to be looked at. We settle that in a free requirements conversation.
We only use ChatGPT and Copilot. Does this affect us?
Yes. The obligation attaches to use, not to in-house development. Anyone who bought AI in and lets staff work with it is a deployer under the regulation. The measures are usually smaller in scope then, but they are not nothing.
Do participants receive a certificate?
A per-person participation record documenting who was trained, on what, and when. There is no recognised certification scheme for AI literacy, and since the 2026 amendment Article 4 does not ask for one: you do not have to guarantee a particular level of competence, you have to have done something demonstrably.
How long does all of this take?
The stocktake usually takes two to four weeks, depending on how many departments have to be spoken to. The training follows directly: the online course at your own pace, the in-house workshop over one or two days.
Request
Request a stocktake.
Tell us briefly which AI tools are in use at your company and how many people work with them. You will receive a personal reply within 24 hours with a proposal for how to proceed.