AI competence under the EU AI Act presents companies with a concrete organizational challenge: Since February 2, 2025, providers and operators of AI systems have been required to implement measures for their staff and other appointed personnel. Since an amendment in July 2026, Article 4 requires companies to support the development of AI competence; however, a specific or "sufficient" level of individual competence does not need to be guaranteed.
For your SME, this doesn't mean a programming course for everyone or a one-off standard training session. You should know which AI systems are used in your company, who is working with them, what risks the respective usage context entails, and what controls are necessary. This leads to appropriate training, clear responsibilities, and verifiable documentation.
AI enhances existing skills. However, AI does not replace responsibility, expert review, or human oversight.
In my work with small and medium-sized enterprises, I often see that AI is already being used long before anyone has consciously decided to do so: for translations, proposal drafts, emails, images, meeting minutes, or research. Therefore, first document the actual use of AI within your company before planning training or establishing rules.
AI competence under the EU AI Act: What Article 4 requires
Article 4 of the EU AI Act addresses providers and operators of AI systems . An operator is generally defined as a natural or legal person, public authority, or other body that uses an AI system within its area of responsibility. Therefore, an SME that uses an AI tool in its daily work can be considered an operator, even if it did not develop the system itself.
According to the current version, providers and operators must take measures to support the development of AI skills among their staff and other individuals involved in the operation or use of AI systems on their behalf. This includes considering technical knowledge, experience, education, training, the context of use, and the individuals or groups for whom the system is used.
The timing is important: Article 4 has been applicable since February 2, 2025. The provision was amended in July 2026. The earlier version required that every effort be made to ensure a sufficient level of AI competence. The new version refers to measures that support the development of AI competence and clarifies that no specific individual level needs to be guaranteed.
The obligation to provide AI literacy thus remains an ongoing organizational task. Employees and other designated personnel should be able to use the systems in place competently and recognize relevant opportunities, risks, and potential damages.
What AI competence and AI literacy actually mean
The definition is found in Article 3, number 56 of the EU AI Act. AI competence encompasses skills, knowledge, and understanding that enable the competent use of AI systems and an awareness of opportunities, risks, and potential harm.
AI literacy is not the same as specialized technical knowledge. A marketing professional doesn't need to be able to develop a language model. However, they should understand that an AI system can generate false statements, process confidential information, fabricate sources, or present a distorted picture of certain groups of people.
Practical AI competence typically includes:
- System understanding: What can the AI system used do, what is it intended for, and what are its limitations?
- User competence: Which inputs lead to usable results and which information must not be entered?
- Examination competence: How are statements, calculations, translations, images, and recommendations professionally checked?
- Risk awareness: What impact can errors have on employees, applicants, clients, or other affected groups?
- Data protection and confidentiality: May personal data, trade secrets, or unpublished documents be processed?
- Responsibility: Who reviews, approves, and documents the deployment? When is a human decision absolutely necessary?
AI competence does not mean mastering as many tools as possible. It means being able to use a specific AI system responsibly in a specific context.
Who needs to be considered within the company
AI system providers
Providers develop or commission the development of an AI system and launch it on the market or put it into operation under their own name or brand. An SME can become a provider if it offers its own AI solution or significantly modifies an existing system and offers it under its own responsibility. The precise legal classification should be examined on a case-by-case basis.
Operators of AI systems
Most SMEs will be affected primarily as operators. This applies, for example, if a company uses generative AI for texts, translations, proposal drafting, or customer communication. AI-supported applicant selection, forecasting, quality control, and process automation are also relevant use cases.
employees
Employees need the skills that match their actual tasks. Someone who uses AI only for internal text drafting needs different knowledge than someone who evaluates AI results on job applicants or publishes automated content without further approval.
Other appointed persons
Article 4 does not only cover permanent employees. External service providers, freelancers, or other persons within the organizational area of responsibility can also be relevant if they are involved in the operation and use of an AI system on behalf of the company.
External support does not automatically relieve you of the task of clearly defining roles, permissible uses, and controls.
Article 4 does not only apply to high-risk AI.
The obligation to demonstrate AI competence under the EU AI Act is not limited to high-risk AI systems. Everyday tools can also fall within its scope. Depending on their specific design, these include, for example, text assistants, translation tools, chatbots, or image-generating systems.
This does not mean that every application requires the same training. While Article 4 does not explicitly mention risk orientation as a separate legal standard, the prescribed factors practically lead to a tiered implementation: prior knowledge, role, context of use, system employed, and potentially affected individuals determine the depth and scope of the measures.
- Lower training requirements: An internal brainstorming session without personal or confidential data, followed by expert review.
- Increased training needs: AI-generated offers, translations, or published customer communications, where errors can have economic or legal consequences.
- High testing requirements: Systems used in personnel decisions, creditworthiness checks, education, health, or security-related processes.
When dealing with personal data, the GDPR also comes into play. Our article on GDPR and AI for SMEs helps you understand data protection and the EU AI Act as separate but interconnected audit levels.
Competence matrix for AI competence in the EU AI Act
Identical training for the entire company is rarely effective. I recommend three role profiles that you can adapt to the size and working methods of your business.
1. User: operate safely and check results
Users work directly with the AI system. This includes, for example, employees who formulate texts, prepare research, create images, check translations, or summarize meeting notes.
- Know the purpose and limitations of the released tool
- Distinguish between permissible and impermissible data
- Identify errors, fabricated information, and unclear sources
- Professionally review results before further use
- Know internal approval and reporting channels
- Observe applicable labelling or information requirements
2. Release Manager: Assess risks, quality and consequences
Release managers review results or approve a use case. They need more than just basic operating knowledge.
- Assess the usage context and potential damage.
- Data protection, confidentiality and copyright must be respected.
- Define quality criteria and testing procedures
- Recognizing distortions and disadvantages
- decide when a result is discarded or passed on for further review
- ensure effective human oversight
In applications with an impact on people, the review process should not be purely technical. Decisions must remain fair, transparent, and consistent with the company's values.
3. Managers: Organizing responsibility, resources, and control
Leaders don't need to operate every tool in detail. However, they do need to create structures that allow for the controlled use of AI.
- Define permissible use cases and responsibilities
- Provide sufficient time and resources for training
- Weigh the risks against the expected operational benefits
- Releases, controls, and update cycles determine
- Integrate incidents and new findings into processes
- decide when professional or legal advice is necessary
A clear framework for collaboration between humans and AI helps to define tasks and decision-making authority in a binding manner.
What evidence is useful for Article 4?
Article 4 does not prescribe a specific certificate or a uniform documentation format. The European Commission states that no specific certificate is required and that internal records of training or other supporting measures can be kept.
A verifiable training record should not only include a signed attendance list. The following are also useful:
- Training concept: Target group, learning objectives, content and relevance to the AI systems used
- Training materials: Presentations, instructions, case studies and checklists
- Proof of participation: Date, duration, format and participants
- Role description: Users, release managers and internal management
- Learning assessment: short knowledge questions, practical tasks or documented instructions
- Release rules: Permitted systems, permissible data, controls and escalation channels
- Update frequency: Reason and date for the next review
An audit trail, as a traceable record of actions, can be particularly helpful for important approvals or changes. For small teams, simple, centrally stored documentation is often sufficient. The crucial point is that you can explain which measures were taken for which roles and systems.
The internal AI policy as a binding framework
An internal AI policy translates general requirements into clear rules for everyday work. It should be concise enough to be used within the company and specific enough to facilitate decision-making.
At a minimum, the following should be regulated:
- which AI systems are permitted, restricted, or prohibited
- for which tasks the systems may be used
- which personal, confidential or protected data may not be entered
- which results require professional or editorial approval
- who is responsible for the respective system and use case
- how to report errors, data protection issues and other incidents
- when training and policy are updated
You can find a detailed structure in our guide to AI policies for SMEs . The policy does not replace training. Both measures complement each other: The policy defines what applies; the training explains why the rules apply and how employees should act.
30-day plan for AI competence according to the EU AI Act
Days 1 to 5: Creating an AI inventory
Document all AI systems used, both officially and unofficially. Don't just ask about purchased software. Also examine AI functions in office programs, translation services, marketing platforms, application tools, CRM systems, and private accounts used for business purposes.
Document for each system:
- Name, provider and responsible internal department
- Purpose and actual use
- users and affected groups
- processed data types
- Further use and publication of the results
- existing controls and approvals
Days 6 to 10: Assess usage and risks
Evaluate each use case based on its potential harm. A draft for internal brainstorming should be treated differently than an AI result that influences an application, a prize, or a safety-related decision.
Consider false statements, discrimination, data breaches, copyright issues, loss of confidential information, and unclear responsibilities.
Days 11 to 15: Define roles and permissions
For each relevant AI system, identify at least one responsible person. Define who is authorized to use the system, who monitors results, and who decides on new use cases.
Human oversight is particularly important: A person must be professionally qualified to question, correct, or reject a result. A purely formal approval without time, knowledge, or scope for decision-making is not effective control.
Days 16 to 20: Adopt internal AI policy
Write the rules clearly and in a way that is relevant to the work environment. Use concrete examples from your company: Is it permissible to upload a quote? Are application documents allowed to be processed? Who checks an Italian translation? Is it permissible to publish an AI-generated image?
Days 21 to 25: Role-based training
School should not discuss the future of AI in abstract terms, but rather focus on the systems and tasks actually used. After the training, employees should know what they are allowed to do, what risks are relevant, and whom to ask if they are unsure.
Days 26 to 30: Submit evidence and plan updates
Store training materials, certificates of attendance, role descriptions, approvals, and policies centrally. Schedule a review when a new system is introduced, functions change significantly, new risks become apparent, or an incident occurs.
If you want to start with a manageable use case, our guide shows how an AI pilot project can be structured in South Tyrol.
Typical errors in implementation
- Only train the IT staff: AI expertise is needed where AI systems are actually used or released.
- Offer training for everyone: Roles, prior knowledge, and risks differ. The content should reflect these differences.
- Only collect participation lists: A name and a date do not indicate what skill was taught.
- Unofficial use overlooked: Employees sometimes use freely available tools before there are company rules.
- Focus on tools, not processes: The risk often arises from the use case and not solely from the product name.
- Human testing only claims: Control only works with expertise, time, and genuine decision-making power.
- Do not update anything after the training: Systems, functions, data flows, and operational applications are changing.
With over 20 years of experience working at the intersection of strategy, web development, and digitalization, I know that small businesses rarely need more complexity. They need clear decisions. Who is allowed to do what, with which data, under what control, and with what goal? Once these questions are answered, the use of AI becomes more manageable, and training needs become more concrete.
Frequently asked questions about AI competence and Article 4
Who is obligated under Article 4 of the EU AI Act?
Article 4 is addressed to providers and operators of AI systems. The measures affect employees and other authorized persons who are involved in the operation or use of the systems within their organizational area of responsibility.
Since when does Article 4 of the AI Act apply?
Article 4 has been applicable since 2 February 2025. In July 2026, the provision was amended: companies must continue to take measures to promote AI skills, but are no longer required to guarantee a specific individual level of competence.
Does Article 4 also apply if employees use ChatGPT?
The operational use of a generative AI system can, in principle, fall under Article 4, even if the application is not classified as high-risk AI. Decisive factors are the specific use, the role of the company, the context of use, and any possible exemptions from the scope of the EU AI Act.
Does my company need a certificate for AI competence?
No, Article 4 does not prescribe a specific certificate. The European Commission cites internal records of training and other support measures as possible documentation.
How often do employees need to be trained?
Article 4 does not specify a fixed training interval. An update is particularly useful when new systems or use cases are introduced, functions or risks change, or an internal audit reveals knowledge gaps.
What should be documented as proof of training?
Document learning objectives, content, AI systems used, date, duration, participants, and roles. For relevant applications, add a brief learning assessment, approval rules, and the planned update date.
Who is internally responsible for implementation?
Article 4 does not prescribe a specific job title. However, management should establish clear responsibilities for AI inventory, risk assessment, internal AI policy, training, approvals, and regular updates.
Is a general online training course sufficient for everyone?
A general introduction can form the basis, but it is not sufficient in every usage context. Employees, approvers, and managers require different knowledge that is appropriate to their tasks and the potential consequences of an error.
Conclusion: AI competence is a process, not a certificate.
AI competence under the EU AI Act can be implemented pragmatically for SMEs: Record the systems used, assess the context of use, define roles, formulate rules, provide training tailored to responsibilities, and document the measures. This avoids creating unnecessary administrative overhead and instead provides a solid foundation for better decisions.
My advice is to start with a clearly defined application. One use case with traceable data, testing, and approval rules is more valuable than several uncontrolled tools. If you want to strategically integrate AI into existing processes, the freelance collective Berger+Team from Bolzano can support you with AI strategy consulting, automation, and practical process integration . You'll speak directly with the experts working on your project.
This article offers practical guidance and does not constitute individual legal advice. For sensitive personal data, applications with significant impacts on people, or potentially high-risk AI systems, a professional and legal review is advisable.
