EU AI Act: The Training Obligation in Effect Since February 2025

Last week I was at a business roundtable in the Eifel region. Thirteen people at the table, all running their own companies. I asked: "Who here has heard of the EU AI Act?" Four hands went up. Follow-up question: "And who knows that a training obligation for working with AI has been in effect since February 2025?" Zero hands.

This is not an isolated case. Most small and medium-sized businesses in Germany have no idea this obligation exists. And no, it is not because the obligation is irrelevant. It applies to anyone who uses ChatGPT, Microsoft Copilot, or similar tools in their daily work.

In this article, I explain what Article 4 of the EU AI Act requires, who it affects, and how you can meet the requirements with manageable effort. Including a template for a two-hour training session.

What Article 4 of the EU AI Act Requires

On 2 February 2025, Article 4 of the European AI Regulation came into force. The core message in one sentence: providers and operators of AI systems must ensure that their employees have a sufficient level of AI competence.

The legal text refers to "AI Literacy." What it means: employees should be able to use AI systems in an informed way. They should understand what AI can and cannot do. They should recognize risks. And they should know what damage improper use can cause.

Sounds reasonable, right?

The specific wording gives companies flexibility in implementation. There are no prescribed contents, no certificate, no minimum number of training hours. The legislator says: you must make sure your people know what they are doing. How you accomplish that is up to you.

That sounds like a lot of freedom. It is. But that is exactly what makes it difficult, because many companies do not know where to start.

What Counts as an "AI System" (and What Does Not)

Before we talk about training, we need to clarify whether your company is even affected. The short answer: yes, very likely.

The EU AI Act defines an AI system as a machine-based system that operates with varying degrees of autonomy, can adapt after deployment, and derives outputs such as predictions, recommendations, or decisions from inputs.

In concrete terms: yes, ChatGPT is an AI system. So is Microsoft Copilot. Google Gemini, Claude, Midjourney, DeepL with AI features, GitHub Copilot. All of them fall under the regulation.

What is not an AI system:

• A traditional spreadsheet program (Excel without AI features)
• A simple if-then rule in your accounting software
• A spam filter that works only with fixed rules
• Your website (as long as it does not use AI-powered chatbots or recommendation systems)

The grey area in between is large. My advice: when in doubt, train. It does not hurt, and you are on the safe side.

Who Do You Need to Train?

Article 4 names two groups: "staff" and "other persons dealing with the operation and use of AI systems on its behalf." That is intentionally broad.

In practice, this means:

• Employees who work directly with AI tools (e.g. marketing team using ChatGPT)
• Managers who decide on the deployment of AI
• Employees who evaluate or further process results from AI systems
• External service providers and freelancers who use AI on your behalf

Who you do not need to train: employees who have absolutely no contact with AI systems. But let us be honest, who does that describe today? Even if someone only uses an email app that offers AI-powered suggestions, that already falls under the regulation.

By the way: this is not about turning everyone into an AI expert. The legislator requires a "sufficient level." What counts as sufficient depends on the role. An office worker who occasionally uses ChatGPT for text suggestions needs a different competence level than the IT director who selects AI systems for the entire organization.

Why Do So Few Companies Know About This?

I have three explanations.

First: the EU AI Act is an enormous piece of legislation. Most coverage focuses on high-risk classification, prohibited practices, and multimillion-euro fines. Article 4, by contrast, is a quiet paragraph. No headline, no scandal, no outrage.

Second: the training obligation came half a year before most other regulations. Many consultants and lawyers communicate the AI Act as "coming in 2025/2026." That one part has been in effect since February 2025 gets lost in the noise.

Third, and this is the real reason: there are no direct fines for violating Article 4 alone. The EU Commission framed it as an "appellative obligation." No fine means, for many companies: not urgent.

That is a mistake in thinking. Because when something goes wrong, when an employee enters confidential customer data into an AI tool and a data breach occurs, the missing training becomes a problem. Courts and regulators will ask: did you fulfill your duty of care? Did you train your employees? Missing AI competence becomes an aggravating factor in other violations.

This is a pattern we also see with the GDPR and the upcoming e-invoicing obligation: the real danger is not the paragraph itself, but the consequential damage from non-compliance.

How to Document the Training

You do not need a certificate. But you do need proof.

My suggestion: document the following points in writing.

1. Who was trained? (Name, role in the company)
2. When did the training take place? (Date, duration)
3. What were the contents? (Topic overview or agenda)
4. Who conducted the training? (Internal or external provider)
5. Which AI systems are in use at the company? (Current inventory)

A simple document is enough. No 50-page training concept. No official stamp. Save the document together with a signed attendance list and you are done.

Important: update the documentation when new AI tools are introduced or new employees start. This is not a one-time thing.

For companies that want to digitize this properly: at Plexito, we build exactly these kinds of processes into the software for our clients. But a spreadsheet works fine as a starting point.

Template: AI Training in 2 Hours

Here is a schedule I recommend for small teams (5 to 20 people). No rocket science. Pragmatic, understandable, documentable.

Block 1: Fundamentals (40 minutes)

• What is AI? Difference between rule-based software and learning systems
• Which AI systems do we use in our company? (Collective inventory)
• Live demo: how ChatGPT/Copilot works under the hood
• What AI does well: creating text, summarizing, translating, analyzing data
• What AI cannot do: guarantee facts, understand context, take responsibility

Block 2: Risks and Rules (30 minutes)

• Hallucinations: why AI says convincingly wrong things
• Data privacy: which data may be entered into AI tools?
• Copyright: who owns the AI-generated text?
• Internal policy: what is allowed in our company and what is not? (Develop together)

Break (10 minutes)

Block 3: Practice (30 minutes)

• Each participant writes a prompt for a task from their daily work
• Group discussion: what works, what does not?
• Tips for better prompts (provide context, assign a role, specify output format)

Block 4: Wrap-Up and Documentation (10 minutes)

• Clarify open questions
• Summary of the internal AI policy
• Fill out attendance list and training record
• Next date: refresher in 6 months

The whole thing fits into one morning. Or two long lunch breaks. The effort is manageable, the benefit is twofold: you fulfill the legal obligation and your employees work better with AI afterwards.

My Personal Take

I worked at DHL, Instacart, Delivery Hero, and New Relic before founding Plexito. At each of these companies, AI competence was a topic. But active training only happened at the big tech firms.

Now, as founder of a software company for the Mittelstand, I see the other side. My clients in the Eifel and Rhineland regions, tradespeople, service providers, small manufacturers, they all use AI. Often without even knowing it. The automatic text recognition in the accounting app? AI. The customer service suggestions in the CRM? AI. The translation feature in the email program? AI.

And that is precisely where the opportunity lies. While everyone stares at the big regulatory topics, high-risk AI, multimillion-euro fines, prohibited practices, you as an SMB can build a real advantage with a simple two-hour training session. Your employees understand AI better. They make fewer mistakes. They use the tools more productively. And you have the documentation in case anyone asks.

That is actually a pretty good deal.

What You Should Do Now

Three steps you can take today:

1. Inventory: Write down which AI systems are in use at your company. Ask your employees. You will be surprised.

2. Block a date: Schedule a two-hour training within the next four weeks. Use the template above as a foundation.

3. Start documentation: Create a simple document for the training record. Name, date, contents, signatures. Done.

If you are unsure whether your AI usage falls under the AI Act, or if you need support with training: get in touch with us. We help SMBs in the region implement these requirements pragmatically. No legal jargon, no panic, with a clear plan.

Because at the end of the day, Article 4 is not a burden. It is a nudge to engage with the topic before it gets expensive.