EU AI Act training for employees step by step. How to meet Article 4 in your company

EU AI Act training for employees is the most common way of meeting Article 4 of the regulation: the company must take measures that build AI literacy among the people who use AI on its behalf. The obligation has applied since 2 February 2025, and since 27 July 2026 in the wording amended by the Digital Omnibus.

Below are six steps that take you from a list of people to a training record, with control questions for each.

What exactly does Article 4 require after the July 2026 amendment?

Previously Article 4 required ensuring a sufficient level of AI literacy. It now speaks of measures that support its development, taking into account people's technical knowledge, experience, education and training, the context in which AI is used and the persons on whom the system is used. An obligation of result became an obligation of diligent conduct. The European Commission stresses that no specific level of knowledge and no certificate is required, and that an internal record of actions is enough. Article 4(2) promises support from the Commission and the Member States, in particular for SMEs. The AI Board recommendations under paragraph 3 have not yet been published.

Step 1: People map - who uses what?

Article 4 covers staff and other persons dealing with AI on the company's behalf. The scope of training follows from who uses what, so the list of people has to be linked to the list of tools.

Control questions: Who in the company uses AI, even occasionally? Which tools does each group use? Are contractors, interns and subcontractors acting on our behalf on the list? Is the tool list up to date?

If the company has no tool list, start with the AI system register.

Step 2: Context and risk - what does this group need to hear?

The law requires taking into account the context of use and the people affected by AI outputs. An accountant using an assistant to format tables needs different knowledge from a recruiter whose tool suggests which candidates to pick.

Control questions: What data goes into AI tools in this group? Does the AI output influence decisions about people? Does the group publish content created with AI? Could any use case fall under the prohibited practices or high risk?

The answers set the scope: what has to be covered and what this group can skip.

Step 3: Tracks - one programme or several?

A sensible model is a shared foundation for everyone with extensions for higher-risk groups. The foundation covers what AI is, its limits, what not to paste into tools and the company's own rules.

Control questions: Does everyone complete the shared foundation? Do HR, marketing, IT and the board have extensions matched to their tools? Does the material reflect the wording of Article 4 after 27 July 2026? Does the training cover the rules that apply in our company, not just general knowledge?

One recording for the whole company rarely explains why HR and marketing got the same scope.

Step 4: Check - how do we know it was understood?

Article 4 does not require an exam. "Watched the recording", however, says little about whether someone can use a tool safely. A short test or practical task is the simplest evidence that the training worked.

Control questions: Does the training end with a test or a task? Do the questions reflect situations from this group's work? What happens to someone who does not pass? Is the result recorded against the name?

The test result is useful in step 5, because it shows the company checks the effect of its measures, not just that they happened.

Step 5: Record - what to write down after training?

The European Commission says an internal record of training and other actions is enough. Its value depends on whether it links the person to the tool and justifies the scope.

Control questions: Does each person have a role, tool, assigned scope and date? Can you see which version of the material was used? Is the test result linked to the entry? Can the record be shown within minutes when a client or an authority asks?

We explain how a record differs from a certificate in is an AI Act training certificate required.

Step 6: Upkeep - when does training need repeating?

The law does not set a frequency; it sets a criterion: the context of AI use. When the context changes, the training stops fitting it. After this step the company should have:

• a rule that new hires are trained during onboarding;
• a rule that a new AI tool means extra training for its users;
• a date to review the material after changes in the law;
• a person who looks after the record;
• a date for the next review of the whole programme.

On your own or with a ready programme?

Training can be prepared in-house: a presentation, a test in a form and a spreadsheet record. The trouble comes with updates, because every change in the law or in the tools means changes to the material and the record.

That is how we built EU AI Act training for companies at AI TrustCERT: a programme in several tracks, an exam and a completion certificate for every employee, and a record of completed training kept on the platform. The courses support meeting Article 4, and from 10 people the AI Governance platform is included in the licence. To see which obligations may apply to you, start with the free AI Ready Check.

Summary

EU AI Act training for employees comes down to six steps. Establish who uses what. Identify the context and risk in each group. Build a shared foundation and extensions. Check understanding with a test. Record everything. Decide when training is repeated.

Article 4 has applied since February 2025 and since July 2026 has been an obligation of diligent conduct. This means the company does not have to show a set level of knowledge in everyone, but it must show that its measures were matched to people and tools. A record with that information weighs more than a pile of certificates. The whole path for preparing a company is in the EU AI Act in your company step by step.

✦ This article was written with the help of artificial intelligence and reviewed before publication by the author, who takes editorial responsibility for it.