Skip to content
Back to home
Operational compliance checklist

Article 4 EU AI Act — the 12-point checklist

What must be in place by 2 August 2026 in every company that uses AI. Pragmatic, no fear-mongering — and not legal advice.

Where do you stand? Start the AI Check →Jump to the checklist ↓

As of 25 May 2026 · Research sources: BNetzA, Bitkom v2.0, Noerr, CMS, EU AI Office, IAPP, Travers Smith

02/02/2025
Article 4 in force
Duty has applied since early 2025
02/08/2026
Enforcement starts
Market surveillance powers attach
10 weeks
remaining
As of 25/05/2026 until enforcement
BNetzA
Central authority (DE)
KI-MIG · KoKIVO as service desk

What Article 4 actually says — in plain terms

Providers and deployers of AI systems must take measures to ensure a sufficient level of AI literacy among their staff and anyone working with AI on their behalf. The yardstick is use-context, prior knowledge, and the persons affected.

Verbatim text:
“Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf.”
Article 4 EU AI Act (official text)

Who counts as a “deployer”?

Any organisation that uses AI systems under its authority — even if it did not build the model. Practical examples:

  • Microsoft Copilot for M365 (in your tenant)
  • ChatGPT Team / Enterprise or Claude for Work
  • AI features in CRM, HRIS, ticketing, code assistants
  • Generative AI in marketing & recruiting tools

The provider carries the Article 4 duty for its own staff. As a deployer you carry it for your employees and contractors who use the system on your behalf.

The 5 typical gaps — what we find most often

Cross-section from BNetzA, Bitkom v2.0, Noerr, Travers Smith, IAPP, Delbion, Hogan Lovells.

1 · No inventory (Shadow AI)
Only the obvious tools are identified — Copilot, ChatGPT. Embedded AI in CRM/HRIS/ticketing systems, browser extensions and code editors is missed. Delbion: typically 5–12 unlogged tools per company.
2 · Generic training instead of role-specific
“Intro to AI” for everyone. BNetzA explicitly recommends a three-tier model (foundational · advanced · role-specific). Travers Smith: simply reading instructions for use is not enough.
3 · Reasonable practice — but no documentation
IAPP finding: organisations often have sound practices but cannot demonstrate them. Attendee lists are missing, modules are not versioned, responsibilities are scattered across teams.
4 · One-off training treated as “done”
Article 4 implicitly requires an ongoing refresher cycle, because the AI landscape changes quarterly. Minimum standard: annual refresher, semi-annual content review.
5 · Contractors & freelancers forgotten
Article 4 also covers “other persons dealing on your behalf” with AI — recruiting agencies with CV screening, freelance developers with code assistants, marketing agencies using generative AI. Hogan Lovells lists third-party management as a top-three step.

The 12-point checklist — operational, not legal advice

Not an audit standard — a hands-on working list. You can mark the status per item locally (saved only in your browser).

0 of 12 done0%
  • 01 · AI system inventory

    Central register of every AI tool — including embedded AI in SaaS products, browser extensions and code assistants. Refreshed at least quarterly.

  • 02 · Classification per system

    Provider vs. deployer role, risk class per Annex III, use context, data class touched — documented per system.

  • 03 · Role-to-system matrix

    Who uses what, in which decision context, under whose authority? Mapping made explicit — not held in heads.

  • 04 · Learning objectives per role

    Basic users (prompting, risk awareness), power users (validation, hallucinations, prompt injection), oversight roles (Art. 14 / Art. 26(2)), executives (governance, accountability).

  • 05 · Three-tier curriculum (BNetzA model)

    (a) Foundational AI/data concepts and opportunities/risks; (b) advanced legal & technical along your value chain; (c) role-specific training (tech · law · ethics).

  • 06 · Provider documentation reviewed

    Instructions for use, system cards, model cards, DPIA/FRIA inputs from Microsoft, OpenAI, Anthropic & vendors — and staff trained to read them.

  • 07 · AI Acceptable Use Policy

    Written, approved by leadership, communicated. Rules on confidential data, customer data, prohibited use cases (Art. 5), disclosure duties (Art. 50).

  • 08 · Training records

    Name, role, date, modules, hours, assessment — retained as audit evidence. Bitkom certificate or equivalent is fine; certification is not mandatory.

  • 09 · Refresher cadence

    Annual minimum. Ad hoc on major tool rollouts or regulatory updates. Content reviewed every six months.

  • 10 · Contracts with suppliers & contractors

    Clauses requiring an Article-4-equivalent literacy commitment. Evidence requested at onboarding.

  • 11 · Incident & escalation channel

    Staff know how to report AI errors, hallucinations, bias, or prompt-injection attempts. Channel documented, incidents logged.

  • 12 · Works council & works agreement on AI

    Co-determination under §87 BetrVG (DE) for training and performance-related AI tools. “Betriebsvereinbarung KI” as the reference document.

Bonus: The 30-minute walkthrough test

Source aiactblog.nl: Can the responsible manager explain within 30 minutes which systems exist, who uses them, what each role was trained on, what gaps remain, and what management has done about it? If yes — you are enforcement-ready.

Walkthrough test (aiactblog.nl)

Fine reality: Article 4 is NOT in Article 99

An important clarification we often have to repeat: Article 4 is not in the Art. 99 fine catalogue. The risk reaches you through three indirect channels.

Aggravating factor
Article 99 allows authorities to consider “any other aggravating or mitigating factor.” If a high-risk system (Art. 26) fails or a prohibited practice (Art. 5) slips through, missing Article-4 literacy will be cited as systemic compliance failure — fines go up.
Breach of duty of care
Noerr and CMS: failure to take Article-4 measures can be treated by German civil courts as a Sorgfaltspflicht-Verletzung in damages, employment, or shareholder claims following an AI-caused harm. The limitation clock has been running since 02/02/2025.
KI-MIG (Member-State penalties)
Art. 99(1) requires Member States to lay down additional penalties. In Germany the vehicle is the KI-MIG (cabinet 11 Feb 2026, first reading 20 Mar 2026). The final fine scope is not yet final — uncertainty remains.
Non-monetary risks — these bite today
  • RFP / supplier-pool exclusion: public-sector and enterprise buyers ask for Article-4 evidence.
  • D&O insurance: missing programme documentation is increasingly counted as a risk factor.
  • ISO 42001 / SOC 2 / financial-statement audits: AI governance evidence becomes mandatory.
  • Works-council friction: without a works agreement, Copilot rollout can be blocked.

Frequently asked questions

1. Will there be fines specifically under Article 4 from 2 August 2026?
Article 4 is not directly in the Art. 99 fine catalogue. But fines can arise indirectly: as an aggravating factor for other infringements, via the upcoming German KI-MIG, or in civil litigation as a breach of duty of care. Reputational and procurement consequences already bite.
2. We only use Microsoft Copilot — are we a “deployer”?
Yes. Anyone using an AI system productively under their authority is a deployer under Art. 3(4). The provider (Microsoft) carries the Article-4 duty for its own staff — you carry it for your employees and contractors.
3. Is one-off training enough — checked-off and done?
No. BNetzA and Bitkom v2.0 require a refresher cycle because tools and use cases change quarterly. Minimum standard: annual refresher, semi-annual content review.
4. Is there an official certification?
No. There is no mandatory certificate for Article 4. Bitkom certificates, in-house qualifications, or training records are all acceptable — what counts is verifiable documentation: name, role, date, modules, assessment.
5. Must external service providers be included?
Yes. Article 4 covers “other persons dealing with the operation and use of AI systems on your behalf” — contractors, freelancers, and external agencies working with AI on your behalf. Hogan Lovells lists third-party management as a top-three step.
6. What about Switzerland?
Switzerland will not enact an EU-AI-Act equivalent (Federal Council decision 12 Feb 2025). Swiss companies selling AI products into the EU fall under the Act extraterritorially; Swiss-only deployments are not currently covered by Article 4.

Where does your company stand — today?

10 questions, 4 minutes. You receive a traffic-light score and a personalised PDF report with the five biggest gaps in your constellation. Free, no sign-up, GDPR-compliant.

Start the AI Check →Book a consultation

Anonymous until the last question · no AI costs · no hidden sales pitch.

Sources & primary texts

This checklist is not legal advice. It is an operational working document based on publicly available sources (BNetzA, Bitkom, EU AI Office, IAPP, German and international law firms) — as of 25 May 2026. For a legally binding assessment of your specific case, please consult a qualified lawyer.

KI-Check