The AI training obligation is no longer a distant prospect. Since February 2, 2025, Article 4 of the EU AI Act has required companies to do their best to enable their employees to use artificial intelligence competently. From August 2, 2026, the national market surveillance authorities begin enforcement - and that is exactly when you must be able to prove that you have taken this obligation seriously.
Practically every company that uses AI in its day-to-day work is affected. Anyone using ChatGPT for text drafts, Microsoft Copilot in Office, Gemini or specialized industry solutions falls under the rule. A recent assessment shows the problem clearly: around 56 percent of German companies already use tools like ChatGPT or Copilot, but only about 27 percent have set up any training at all. There is a considerable need for action here, especially in the SME sector.
What Article 4 of the EU AI Act actually requires
Article 4 requires providers and deployers of AI systems to ensure that their staff and any other persons working with AI on their behalf have sufficient AI literacy. The legislator deliberately does not prescribe a fixed curriculum. Instead, the competence is meant to fit the context: the type of systems in use, the technical background of the employees and the groups of people the AI is used on or with.
Important to know: the AI literacy obligation under Article 4 is not affected by the postponements of the so-called Digital Omnibus. In May 2026, the Council and the European Parliament provisionally agreed to postpone many high-risk obligations of the AI Act by around 16 months to December 2, 2027. The training obligation, however, remains explicitly untouched and has applied unchanged since February 2025. It is thus the first tangible obligation of the AI Act that affects almost all SMEs.
The term AI literacy is defined in Article 3 of the regulation. It means the skills, knowledge and understanding that enable the persons involved to deploy AI systems knowledgeably and to be aware of the opportunities and risks. So it is not just about knowing how to operate the tools, but about having a realistic picture of what AI can do and where its limits lie.
Why the AI training obligation affects every SME
Many management teams assume the AI Act only concerns big tech corporations or developers of their own AI models. That is a mistake. Merely using freely available tools already makes your company a deployer within the meaning of the regulation. That triggers the obligation under Article 4 - regardless of headcount or revenue.
The financial framework underlines the seriousness of the situation. The AI Act's fine regime has been applicable since August 2025. Violations of high-risk requirements carry fines of up to 15 million euros or 3 percent of global annual revenue, and prohibited practices up to 35 million euros or 7 percent. Even though the training obligation is not in the top fine bracket, SMEs should not take the matter lightly.
Added to this is an often overlooked liability risk beyond the fines. If an untrained employee enters confidential customer data into a public AI tool or adopts a faulty AI answer unchecked, this can lead to data protection violations, breaches of contract or reputational damage. Solid training is therefore not just a regulatory obligation but active risk management for your company.
What belongs in an effective AI training
A good AI training is not limited to prompting tips. It combines basic technical understanding with legal and ethical knowledge. You should cover the following topics:
- Fundamentals: How do generative AI models work and where are their limits?
- Recognizing hallucinations and critically checking results
- Data protection: Which data must never be entered into an AI tool?
- Confidentiality and trade secrets when dealing with cloud AI
- Copyright and liability for AI-generated content
- Internal policies: Which tools are approved, which are not?
The key is that the content matches the tools actually in use. A sales team using Copilot for quotes needs different priorities than the accounting department.
Which training formats work well
The regulation does not prescribe a specific format. That gives SMEs room to choose a solution that fits the size of the company. Several approaches have proven themselves in practice and can also be combined:
- In-person or online workshops for a shared introduction
- E-learning modules everyone completes at their own pace
- Short, regular refreshers on concrete use cases
- A written AI policy as a binding foundation
For small teams, a well-prepared workshop followed by a policy is often enough. Larger businesses benefit from scalable e-learning offerings that new employees complete automatically. In both cases, it is important that participation is documented.
Setting up proof and documentation correctly
A specific training format is not prescribed, but proof very much is. From August 2026, you should be able to demonstrate on request that you have equipped your workforce. A combination of several building blocks has proven itself.
Practical documentation building blocks
- Attendance lists and training dates
- Training materials and agenda
- A binding AI usage policy for the company
- A register of the AI systems in use (AI register)
- Refreshers when new tools or features arrive
The AI register pays off twice: it serves as proof and is at the same time the basis for the later high-risk analysis that may become relevant by December 2027.
Your roadmap until August 2, 2026
The remaining time is enough if you proceed in a structured way. First, get an overview of which AI tools are actually being used in the company - often more than expected. Then establish an AI usage policy, train your teams by role and document everything cleanly. Also schedule fixed dates for refreshers, because AI tools evolve rapidly.
Mistakes to avoid
In practice, the same pitfalls keep coming up when implementing the AI training obligation. Knowing them saves time and trouble:
- Ignoring shadow AI: employees often use free tools on their own initiative that nobody has recorded
- One-off training without refreshers: a single session in 2025 is no longer enough in 2026
- No documentation: without attendance records, you cannot prove compliance
- Purely technical training: data protection, copyright and liability must not be missing
- Unclear responsibility: it should be clear who steers AI compliance in-house
Shadow AI in particular is an underestimated problem. An anonymous team survey often reveals that far more AI services are in use than management assumes. Only once you know this reality can you train and steer effectively.
Also clarify who is in charge. In smaller companies nobody needs to create a dedicated position, but one person should own the topic and coordinate AI compliance. They maintain the AI register, plan the trainings and keep an eye on new tools and regulatory developments. This keeps the AI training obligation fulfilled on a lasting basis instead of becoming a one-off box-ticking exercise.
Conclusion
The AI training obligation is the first obligation under the EU AI Act that directly affects almost every SME. Anyone already using AI must act by August 2026 and be able to prove the competence building. The good news: with a clear policy, practical training and clean documentation, the requirement is well within reach - and at the same time you make your workforce more productive and safer in dealing with artificial intelligence.
Unsure which of your tools fall under the obligation and what legally sound training looks like? Cryon supports SMEs in Leipzig and the surrounding area in mapping your AI landscape, creating an AI usage policy and delivering practical training for your teams. Get in touch - we will get you on track in time.
Introducing AI in your company in a legally sound way?
We accompany you from tool selection to secure rollout: hands-on and tailored to your team.
