AI literacy under Article 4 of the AI Act: a training plan for grid, sales and IT

What the Omnibus changed in Article 4

An obligation of result has become an obligation of effort. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has applied since 27 July. Its Article 1(5) gives Article 4 new wording.

What stayed the same matters more in practice than the new formula. Same circle of people: your own staff plus everyone dealing with the operation and use of AI systems on your behalf. Same yardsticks, too: technical knowledge, experience, education and training, the context of use, and the people the AI is used on.

Two new paragraphs address the other side. Commission and Member States are to support the effort, SMEs in particular, and the Commission will publish practical examples on a central information platform. The AI Board is to adopt recommendations with common objectives. According to the Commission's questions and answers, both were still pending at the end of July 2026.

In its proposal of 19 November 2025, the Commission wanted to go further and replace the companies' duty with a promotion mandate for the EU and the Member States. Parliament and Council kept it. Weaker, but kept. How that compromise came about is covered in our piece on the AI Act Omnibus.

What "taking measures" means in practice

Lighter doesn't mean optional. If you use AI, you have to do something and be able to show it; you just don't owe a result per person. On 27 July 2026 the European Commission updated its questions and answers on AI literacy to the new wording. It lists four points a programme should at least consider.

• Does the organisation understand what AI is, which AI it uses, and where the opportunities and dangers lie?
• Is it a provider that develops its own systems, or a deployer using systems built by others?
• What risks do the systems in use carry, and what do employees need to know about them?
• Which measures fit people's prior knowledge and the context of use, meaning sector and purpose?

Three statements in the same document dispose of common assumptions. Article 4 "does not entail an obligation to measure the knowledge of AI of employees". A certificate isn't needed; an internal record of trainings and other initiatives is enough. And no AI officer or governance board is mandated.

A fourth statement points the other way, and it tends to be overlooked. In many cases, simply relying on the instructions for use or asking staff to read them "might be ineffective". So the circular with the vendor's manual attached isn't a measure in the Commission's sense.

How low the threshold sits shows in one of the Commission's own examples. A company whose staff use ChatGPT for advertising copy or translations falls under Article 4, and people should be told about risks such as hallucination. For a utility: the writing assistant in sales is enough to be in scope.

Supervision and consequences in Germany

Since 29 July 2026 the Federal Network Agency has been responsible, as market surveillance authority under Section 2(1) of the German KI-MIG. According to the Commission's questions and answers, national authorities have supervised Article 4 since 2 August 2026. What else the agency may do and how it is set up is explained in our piece on the KI-MIG and the Bundesnetzagentur.

And a fine? Section 15 KI-MIG lists the administrative offences Germany has defined itself: breaches of specific duties under four articles of the regulation, among them the fundamental rights impact assessment under Article 27, with fines of up to 50,000 euros. Article 4 is not on the list.

That doesn't mean a missing programme has no consequences. The Commission writes that sanctions under national law must be proportionate and depend on the individual case, but become more likely if an incident can be traced back to a lack of training and guidance. The Federal Network Agency puts it this way on its AI literacy page: "A lack of AI literacy can be regarded as a breach of the duty of care, particularly if damage results" (our translation). It recommends documenting the measures well.

So here's where things stand. No fine for the gap as such, but an authority that can ask questions, and a body of evidence that works against the utility that wrote nothing down once something goes wrong.

Legislator versus Bundesrat

The weakening was contested, and the dispute wasn't settled. It was outvoted.

Parliament and Council justify the new wording in recital 8 of the regulation of 8 July 2026. Stakeholder experience showed, they write, that strict obligations to ensure a sufficient level of AI literacy were "not suitable for all types of providers and deployers". Such obligations added compliance burden "especially for smaller companies", while AI literacy "should be a strategic priority regardless of legal obligations and possible sanctions" (our translation of the German text).

On 16 March 2026, the committees of the Bundesrat, Germany's chamber of the federal states, had recommended the opposite. Even the old duty had been too narrow, they argued, because it only looked inward. "The proposed new wording weakens this safeguard considerably. The Bundesrat therefore asks that the amendment be dropped." From a consumer protection perspective, the reform pointed "in the wrong direction" (printed paper 33/1/26, our translation).

The Federal Network Agency, which now supervises the result, doesn't take a side. It calls AI literacy a matter of companies' own interest and reminds them of the duty of care in the same breath.

Who's right? The legislator is betting that companies will train because it pays off. The federal states doubt it happens without a duty. Figures from the sector support either reading.

Who at a utility needs what

Target groups follow from contact with AI, not from the org chart. A utility with a grid, a sales arm and metering has five typical groups, plus its service providers. PwC's study on AI in the energy industry (ZfK, 13 April 2026) shows where systems run today: customer service 29 percent, support functions 21, sales 12, with the technical core well behind.

AI runs less often in the control room than in customer service, according to PwC, but a mistake there weighs more than anywhere else in the company. In July 2025 the Power Engineering Society of the VDE (ETG) published an introduction model for AI in grid control technology, built around technical safety management and an ISMS. A role module for shift supervisors follows the same logic: controlled operation also means the people at the desk know when not to trust the number.

Customer service carries a different risk. Here the AI talks to customers directly, and since 2 August 2026 the disclosure duty under Article 50 applies. How utilities use chatbots and churn models today is covered in our piece on AI in customer service; market communication gets its own article on AI for exception cases.

That leaves outsiders. Article 4 covers people working with the utility's AI on its behalf, and the Commission names contractors and service providers explicitly. A call centre that takes over the chat at peak times is one of them.

A training plan in three layers

A plan that fits both the law and the size of a utility has three layers: a short baseline for everyone with AI access, one module per target group, and a briefing on each individual system. The Federal Network Agency suggests a similar staged structure, from basics through advanced content to role-specific training, explicitly as a suggestion rather than a requirement.

Most programmes get too long at the baseline. It has to cover what AI is, which tools are allowed in the company, which data must stay out, and what typical failures look like. Nothing more. Two days at this level and you lose the people who only use AI now and then.

Role modules carry the programme. They work with cases from the team's own area: a wrong chatbot answer about an instalment, a forecast that missed on a public holiday, an exception case the AI sorted into the wrong queue. Every department has such cases in its own tickets.

System briefings follow the rollout, not the calendar. When a new system goes live or its purpose changes, the briefing comes, with the vendor's documents as a basis and not as a substitute. For high-risk systems, Article 26(2) backs exactly this layer from December 2027.

Where the content comes from matters less. In-house, external, e-learning or classroom: the Federal Network Agency allows all of it. The Commission's living repository collects examples from other organisations, though in the Commission's words copying them does not automatically grant a presumption of compliance with Article 4.

Records, documentation, co-determination

An internal record is enough, and it needn't be complicated. The Federal Network Agency lists what belongs in it: the type of measure, its scope in content and time, and who took part, plus a regular check on whether the measure works and a refresh when needed.

We'd tie the record to the AI register. If the register shows which target group uses each system, it follows who needs which module, and a new system entered in the register triggers its briefing. Our AI governance building blocks show how such a register can be set up.

Here's what many programmes forget. Under German law, AI training is in-house vocational training within the meaning of Sections 96 to 98 of the Works Constitution Act (BetrVG). The works council co-determines how it is carried out (Section 98(1)). If introducing an AI system changes jobs so much that existing skills no longer suffice, it also co-determines whether training is introduced at all (Section 97(2)). And a learning platform that evaluates results per person touches Section 87(1) no. 6.

That creates a practical tension. The Commission requires no tests, the Federal Network Agency recommends evaluation. Evaluate without grading individuals, through anonymous feedback or spot checks within a team, and part of the negotiation goes away.

Municipal enterprises and public-law institutions fall under the staff representation law of their federal state instead of the BetrVG. The logic is similar; procedures differ from state to state.

Two existing duties make good anchors. Under Section 38(3) of the BSI Act, management of essential and important entities must regularly attend training on IT security, and data protection briefings run anyway. Adding an AI part to both is cheaper than creating a third format.

Municipal utility with 150, group with 5,000 employees

Same duty, different machinery. Article 4 has no size threshold, and the new paragraph 2 promises SMEs support, not an exemption. The sizes below are generic examples, not companies.

A municipal utility has the shorter path and thinner staffing. It can be done within weeks if one person owns the job. A group already has the learning platform but needs months for alignment and co-determination. And it faces a problem the smaller utility doesn't know: the same AI in five companies with five works councils.

Both face a gap the sector names itself. In the PwC study, 28 percent of utilities cite missing skills as a hurdle for AI. According to the Digital@EVU study by BDEW, VSE, Kearney and IMP³ROVE of 14 April 2026, 56 percent have a clear idea of the future skills they need, yet only 29 percent have an HR strategy for building them.

What utilities should do now

Start with what has already happened since February 2025. Many companies trained people without filing it under Article 4, and that can be added to the record after the fact.

Five steps to a programme that holds up

1. Take stock

   Which AI systems run, who uses them, which tools are used without approval? Without that list, any training plan is guesswork. Shadow AI belongs on it and is often the larger share, as our piece on shadow AI shows.

2. Set target groups and modules

   The groups follow from the list. Baseline, role module, briefing, each with scope and format per group.

3. Bring in the employee representatives

   Before the first session runs.

4. Deliver and record

   Type, scope, participants, date. Whatever has run since February 2025 goes into the same record with its date, service providers with their own evidence. A spreadsheet will do for a start, as long as someone maintains it. More important than the tool is that someone owns it and could hand it over within two days if the Federal Network Agency asks.

5. Tie refreshers to change

   New system, new purpose, new model: retrain then. A fixed annual date can come on top, but it doesn't replace that.

The wider legal frame, meaning everything that applies after the Omnibus, is summarised in our article on the EU AI Act for energy utilities. All articles on the subject are collected in the topic area AI in the energy industry. If you want to run the register and the training as one programme with clear owners, our service AI governance for utilities describes how we approach it.

Further reading

Frequently asked questions