Mandatory AI Act training: what Article 4 requires and who it applies to

The mandatory training required by the AI Act has applied since 2 February 2025, under Article 4 of Regulation (EU) 2024/1689, and it covers every company that uses artificial intelligence systems. Since 2 August 2026 the picture has tightened: the AI Act’s penalty regime is fully operational, national supervisory authorities are active, and the transparency obligations for systems that generate content or interact with people are binding. Many Italian companies still don’t realise the obligation applies to them, or think they can put it off.

In this article we explain what Article 4 requires, who it applies to, how training should be documented and where it makes sense to start. This piece looks at the rules from an Italian perspective. If you’re looking for a ready-made, documented programme for your staff, you’ll find the details on the page for our AI Act training service.

What Article 4 of the AI Act requires

The text is short, but it carries weight. Article 4 states that “providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”.

In practice: if someone in your company uses an artificial intelligence system, whoever is responsible for it must make sure that person knows what they’re doing. It doesn’t matter whether the system is high-risk or not. It doesn’t matter whether the company built the AI in-house or simply uses a third-party tool. The obligation applies at every level of risk, and this is the point that surprises people most when they first hear about it: even a team that uses ChatGPT or Gemini informally to write emails or content falls within the scope of the rule.

Who needs training, and on what

Article 4 makes no distinction between large groups and small businesses. It covers anyone who meets the definition of a provider or a deployer: those who develop an AI system and those who use one in their professional activity. The distinction matters because most Italian SMEs fall into the second category, deployers, and that’s exactly why they tend to underestimate the obligation: they assume it only concerns those who build AI software, not those who simply use it for work. That isn’t the case. Using an AI tool bought from a third party, even a free one, still makes a company a deployer, with all the obligations that follow. The staff involved range from employees who use AI every day to the managers who oversee its use, as well as external contractors who operate AI systems on the company’s behalf.

The training should cover at least the following:

• how the tool being used actually works
• what its limits are (hallucinations, bias, systematic errors)
• what risks it poses for data protection and confidentiality
• what internal rules the company has set for its use
• how to apply critical judgement to the results it produces

It isn’t a theory course on artificial intelligence in general. It’s training tied to the tools people actually use, shaped around the roles of those using them.

Day to day, this translates into very different needs across departments. A customer service agent using a chatbot to answer customers needs to know when to escalate to a human and how to spot an inaccurate answer before it reaches the customer. A marketing team generating content with AI needs to understand the copyright limits on generated text and the risks of publishing unverified claims. An HR manager considering AI to screen candidates is in a higher-risk area, where training must also cover awareness of bias in training data. And board members need an overall view of governance, even if they never use the tools themselves, because they are still responsible for the decisions taken further down the line.

Proportionality and documentation: the two key words

The AI Act doesn’t prescribe a specific course with an official seal of approval. It asks for two more demanding things: that training be proportionate and that it be documented.

Proportionate means calibrated on four factors: the technical knowledge staff already have, their previous experience with similar tools, their level of education, and the context in which the AI system is used. A marketing team that generates content with generative AI every day has different needs from a board that must govern its adoption at a strategic level. In most cases, one course for everyone isn’t enough.

Documented means the company must be able to prove what it has done with concrete evidence, not just state it. In the event of an inspection, you need a paper trail: hours of training delivered, topics covered, recorded attendance, final assessments, named certificates with date and duration. Training done once, with no register and no test, is worth little more than nothing if you’re inspected.

Imagine two companies that ran exactly the same internal course on using AI. The first invited everyone to the meeting room, showed a few slides and kept no written record of who attended. The second recorded attendance with a unique identification system, closed the course with a multiple-choice test and issued a named certificate with date, duration and topics covered. Faced with an inspection, only the second can demonstrate compliance in a few minutes. The first has to reconstruct everything from memory and hope it’s enough.

What non-compliance risks

It’s worth being precise here, because figures for fines are circulating that don’t specifically relate to Article 4. At the moment, Italy’s national legislation implementing the AI Act does not provide for a direct, standalone fine for failing to train staff on its own. That doesn’t mean the risk is zero, though.

If an AI system used in the company causes harm, such as a discriminatory decision in a recruitment or credit process, and the subsequent investigation reveals that the staff involved were not adequately trained, the lack of AI literacy becomes an aggravating factor. It can help trigger the maximum penalties for the substantive breach that caused the harm, rather than for the absence of training itself. In Italy the authorities responsible for supervision, including AgID (the Agency for Digital Italy), the Garante per la protezione dei dati personali (the Italian data protection authority) and the Agenzia per la Cybersicurezza Nazionale (the national cybersecurity agency), are tasked with checking compliance and, where obligations aren’t met, stepping in with corrective measures. With the penalty regime fully operational since 2 August 2026, checks can become systematic, and action following a report is always possible.

What changed on 2 August 2026

2 August 2026 did not introduce the training obligation, which, as we’ve said, has applied since February 2025. It did, however, change the context in which that obligation is enforced. From that date the transparency obligations in Article 50 of the regulation apply, covering systems that interact directly with people (such as chatbots) and those that generate synthetic content, whether text, images or audio. Above all, the penalty regime is fully operational: national supervisory authorities are active across the country and can apply the penalties set out in the regulation.

The Digital Omnibus package pushed back some deadlines, in particular those for the high-risk systems in Annex III (employment, credit, essential public services), postponed to December 2027, and those in Annex I, postponed to August 2028. But the Article 4 literacy obligation is not part of that delay: it remains fully in force, and since August 2026 the authorities have had the operational tools to enforce it more consistently.

The rest of the timeline companies need to keep in mind

Article 4 isn’t an isolated obligation. It’s part of a timeline unfolding over several years that’s worth keeping an eye on, if only to understand where your company stands today. Since 2 February 2025, alongside the literacy obligation, the bans on AI practices deemed unacceptable have also become binding, such as social scoring systems or emotion recognition in the workplace. Since 2 August 2025 specific obligations have applied to providers of general-purpose AI models, known as GPAI, the models that tools such as ChatGPT, Claude or Gemini are built on. Since 2 August 2026, as mentioned, the transparency obligations for systems that interact with people or generate synthetic content apply, and the penalty regime is fully operational. The heaviest obligations, those for the high-risk systems listed in the regulation’s annexes, were moved by the Digital Omnibus to December 2027 and August 2028, depending on the category.

Seen this way, 2 August 2026 was a milestone. Companies that wait for the last possible postponement before getting compliant risk having to chase several obligations at once, instead of tackling them one at a time while there’s still room to manoeuvre.

How long it takes and what it costs to get compliant

It’s the question almost every business owner asks as soon as they realise the obligation applies to them. The honest answer is that it depends on the size of the company and the number of roles involved, but the starting point doesn’t take months of work or a large corporate budget. A basic literacy course for all staff usually takes four to six hours, which can be delivered in a single day or spread across online modules at each person’s own pace. The more specialised programmes, such as operational compliance for managers and HR or governance for those in leadership, take a few more hours, but they remain focused courses, not degree programmes.

The real cost lies not so much in the hours of training as in the time lost chasing compliance after an inspection or an incident, when registers, certificates and traceability are missing. Investing early, in a proportionate way, costs less than catching up later.

Where to start: a four-step approach

Getting compliant doesn’t mean bringing the company to a halt for months. It takes a method.

The first step is to map the artificial intelligence tools actually in use, including those adopted informally by individual departments: who uses what, for what purpose, with which data.

The second is to segment staff by role and level of exposure to AI, because not everyone needs the same type of training.

The third is to choose a training programme that is proportionate to the role and documented from the start, with registers, tests and named certificates. Companies that want to adopt AI solutions in a compliant way almost always start here, even before introducing new tools.

The fourth step, often forgotten, is keeping it up to date: the AI Act is coming into force in stages and the tools change every quarter, so training done once and never revisited quickly loses its value.

The solution we built: Articolo 4

To meet this obligation in a practical way, Digital Runner launched Articolo 4, a project entirely dedicated to artificial intelligence training that complies with the AI Act.

Four specialised courses, from basic literacy for all staff to governance for those in leadership, each built by people who apply AI every day in client projects.

Every course is traceable from the outset: learner identification, electronic attendance registers, final tests drawing on a randomised question bank, and named certificates with date, duration and topics covered. Exactly what you need to respond to an inspection. The content is reviewed every six to twelve months, because a year-old AI course goes out of date much sooner than you’d think. The catalogue serves three different audiences, with courses for individuals, dedicated editions for companies and licensed solutions for training providers who want to offer this training to their own clients.

Don’t wait for an inspection to get started

The Article 4 obligation has been law since February 2025, and since 2 August 2026 the authorities have had the tools to check it at scale. Companies that have already mapped their AI tools and trained their staff in a documented way can face an inspection with confidence. Those that haven’t yet done so would be wise to start now, with a proportionate, well-documented programme.

If you’d like to talk through how to set up a training plan proportionate to your company, or more generally how to integrate AI into your processes correctly, you can book a call with our team.

FAQ

Is AI training mandatory for all companies? Yes, for anyone who meets the definition of a provider or deployer of artificial intelligence systems, regardless of company size or the risk level of the system used. The obligation, set out in Article 4 of Regulation (EU) 2024/1689, has applied since 2 February 2025.

Since when has the AI literacy obligation applied? Since 2 February 2025. 2 August 2026 did not introduce the obligation, but it marked the full entry into force of the AI Act’s penalty regime and of new transparency obligations, under Article 50, for chatbots and AI-generated content.

What happens if a company doesn’t train its staff? At the moment, Italy’s implementing legislation does not provide for a direct, standalone fine for a lack of training alone. However, a lack of AI literacy becomes an aggravating factor if an AI system causes harm, for example a discriminatory decision, and can contribute to the maximum penalties for that breach.

Do you need a specific certified course to be compliant? No. The AI Act doesn’t require a course with an official seal of approval, but it does require training that is proportionate to the role and context of use, and documented with registers, final assessments and named certificates.

Who checks compliance with the obligation in Italy? The competent authorities include AgID, the Garante per la protezione dei dati personali and the Agenzia per la Cybersicurezza Nazionale. Since 2 August 2026 the penalty regime has been fully operational and checks can be systematic, as well as action taken following reports.

Where’s the best place to start getting compliant? By mapping the artificial intelligence tools actually used in the company, including those adopted informally by individual departments, and choosing a training programme segmented by role, documented from the outset and refreshed every six to twelve months.