AI Literacy Training Curriculum (Art. 4): 8-Module Course for SMEs
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are a compliance specialist, not a law firm. For legally binding advice, please consult a licensed attorney.
TL;DR
- Art. 4 EU AI Act since 02 February 2025 — AI literacy obligation for providers + deployers
- 5 target groups: management, IT, HR, marketing/sales, all other employees
- 8-module curriculum: ~4-6h training time
- Knowledge quiz + training record mandatory for audits
- Fine risk: EUR 15 million / 3%
1. Art. 4 EU AI Act
"Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf..." — Art. 4 EU AI Act
2. 5 Target Group Personas
| Persona | Training scope | Specifics |
|---|---|---|
| Management | 1-2h | Legal risks, fines, managing director liability, strategic decisions |
| IT/Compliance/DPO | 4-8h | Inventory, risk classification, FRIA, technical documentation |
| HR (recruiting + personnel assessment) | 2-4h | Annex III point 4, Section 22 AGG reversal of burden of proof, bias testing, anonymization |
| Marketing + sales | 2h | AUP, transparency Art. 50, watermarking, deepfakes |
| All other employees | 1h | AUP, prohibitions Art. 5, data protection, output quality control |
3. 8-Module Curriculum
- Module 1: What is AI? (15 min) — Definition Art. 3, machine learning, GPAI
- Module 2: EU AI Act overview (20 min) — Risk-based approach, obligations of providers/deployers
- Module 3: Prohibited practices Art. 5 (15 min) — Social scoring, emotion detection, manipulative AI
- Module 4: AI in everyday work — what am I allowed to do? (30 min) — AUP, data protection, confidentiality, verification
- Module 5: High-risk AI (20 min) — Annex III, FRIA, conformity assessment
- Module 6: Transparency Art. 50 (15 min) — Chatbot disclosures, deepfake labeling, watermarking
- Module 7: GPAI + ChatGPT/Claude/Copilot (20 min) — Acceptable use, data flow, loss of creativity
- Module 8: Knowledge quiz + certificate (30 min) — 25 questions, 70% pass mark, certificate generation
4. Knowledge Quiz Structure
25 questions, at least 70% correct = passed. Example questions:
- "Which of the following is a prohibited practice under Art. 5?" (multiple choice)
- "When do you have to disclose a chatbot?" (single choice)
- "Which data must NOT be entered into ChatGPT?" (multi-select)
Retest on failure + after 12 months.
5. Training Record Obligation
Mandatory content of the record:
- Employee name + position
- Training date
- Module completions with timestamps
- Quiz result
- Certificate ID
- Refresher date
Retention: as long as the employee is with the company + 3 years after leaving.
6. Provider Comparison (DACH 2026)
| Provider | Price/employee | Content | DACH law |
|---|---|---|---|
| Compliance-Kit AI Literacy | EUR 49/employee one-time | 8 modules + 25-question quiz + certificate | DACH-specific ✓ |
| SoSafe AI Literacy | EUR 15-25/employee/year | Short modules + phishing simulation | EU ✓ |
| KnowBe4 AI Module | EUR 20-35/employee/year | Generic, US-focused | partial |
| LinkedIn Learning | EUR 15/employee/month | Generic, broad | no, own research required |
DACH-compliant 8-module AI literacy program + 25-question quiz + certificate generator in the EU AI Act Kit.
Frequently asked questions
Since when does AI literacy apply?
Since 02 February 2025. Mandatory for providers AND deployers of AI systems — almost every organisation.
What must be trained?
Art. 4: 'adequate knowledge' of the AI in use. Content: how the system works, risks, prohibitions, AUP, data protection.
Who must be trained?
All employees who use AI or work with AI output — typically 80–95% of the workforce.
How often?
On onboarding plus an annual refresher are recommended. For substantial changes (e.g. trilogue adoption of the Digital Omnibus proposal of 19 November 2025): additional targeted training.
Is an online course sufficient?
For basics, yes. For high-risk AI, add role-specific training with hands-on exercises.
What is the fine risk?
Art. 99(4)(b): up to EUR 15 million / 3% of global turnover. In practice: fines from EUR 10,000 are expected where a systemic gap is established.
Sources
Tools & self-assessments
EU AI Act Quick Test
Classifies your AI system by risk level (Art. 6, Annex III).
Fining Calculator
Estimate the potential fine exposure for your organisation.
EU AI Act Self-Assessment
Classification plus obligations mapping for all AI systems in the organisation.
AI Inventory Quick Check
Systematic capture of your AI applications in 8 steps.