AI training obligation in the workplace: what Article 4 of the AI Act already requires of Luxembourg SMEs
By LetzAgents, sovereign AI team Luxembourg · Published on 4 June 2026 · Updated on 4 June 2026
In brief
- Obligation enforceable since 2 February 2025: Article 4 has required AI literacy for your staff and your AI service providers for 16 months, not starting from August 2026.
- National sanctions activatable on 2 August 2026: switch to sanctionable status in Luxembourg via draft law No. 8476, with CNPD designated as the reference authority.
- 4-week checklist: AI systems register, populations to cover, 3-pillar AI literacy plan, first documented session.
- Up to 70% reimbursement on a project between €3,000 and €25,000 excl. VAT via the SME Package AI (source: guichet.public.lu).
Introduction: your SME has been under Article 4 obligation since 2025
Article 4 of the AI Act (EU Regulation 2024/1689) has been enforceable since 2 February 2025. If your SME uses ChatGPT Enterprise, Microsoft Copilot, Google Gemini, an AI chatbot or a business AI agent, you have been subject to the AI training obligation for 16 months. What changes on 2 August 2026: the entry into force of national sanction regimes. In Luxembourg, the CNPD is designated as reference authority by draft law No. 8476. The obligation does not start on that date, it becomes sanctionable.
Objective: a 4-week checklist, a 3-pillar template, three concrete situations, five mistakes to avoid. For a full overview, see our AI Act 100-day guide and the AI legal glossary.
1. What Article 4 says exactly, and what it does not say
Article 4 requires providers and deployers of AI systems to ensure a sufficient level of AI literacy among their staff and other persons operating these systems on their behalf (source: artificialintelligenceact.eu). The "other persons" scope includes subcontractors, external service providers, temporary workers and, in certain cases, clients (AI Act Service Desk).
What Article 4 does not say: no number of hours, no quantified level, no standardised EU certification scheme. The Commission insists on a "no one-size-fits-all" approach, flexible and proportionate (Commission Digital Strategy).
The real risk before 2 August 2026 is not administrative but civil. Law firms DLA Piper and Mayer Brown remind that classic civil liability applies if a non-AI-literate staff member causes third-party harm.
💡 Good to know: no EU AI literacy certification scheme is standardised to date. Serious providers speak of training attestation, not official certification.
2. Who in your SME is concerned: the precise scope
Four categories (sources: Commission Digital Strategy, AI Act Service Desk):
- (1) All employees who use an AI tool, not just the IT department. A sales rep on an AI-augmented CRM, an accountant on AI reconciliation, an assistant on Copilot all fall within scope.
- (2) Managers and executives who decide on AI uses or validate a tool. Obligation focused on understanding risks and roles, not on technical mastery.
- (3) Subcontractors and external providers who operate an AI system on your behalf: freelancer using ChatGPT for your content, agency running your chatbot, managed services provider administering your private LLM.
- (4) Clients, in certain use cases: front-end chatbot for visitors, AI voice agent; the scope can include the end user (transparency, AI identification).
Concretely, an SME of 30 employees with 3 AI subcontractors may need to document the literacy of around forty people.
3. 4-week checklist for Article 4 compliance
Four weeks, four objectives, four deliverables to archive with your AI Act file.
|
Week |
Objective |
Concrete action |
Documented deliverable |
|---|---|---|---|
|
W1 |
Map AI uses |
Inventory tool, purpose, department, data, hosting, subcontractor. One line per tool. |
Dated AI systems register |
|
W2 |
Identify populations |
Cross-reference AI register, org chart, subcontractor contracts. Distinguish users, managers, providers. |
Populations table with target level |
|
W3 |
Draft the AI literacy plan |
Formalise the 3 Commission pillars (understanding, roles, risks) using the template below. |
2 to 4-page plan, signed by the director |
|
W4 |
Roll out and document |
2 h session for users, 1 h for managers, charter for subcontractors. |
Training evidence (attendance, attestation) |
The process is eligible for the SME Package AI: up to 70% reimbursement on a project between €3,000 and €25,000 excl. VAT (source: guichet.public.lu). Processing via House of Entrepreneurship or eHandwierk. For the overall cost of a private AI, see our private AI cost analysis.
Request a free AI audit if your AI systems register is not yet open.
4. Template: the minimum 3-pillar AI literacy plan
An internal document of 2 to 4 pages structured around the minima set by the European Commission (summary by Travers Smith). These three pillars are what you can present to an auditor or to the CNPD.
|
Pillar |
Expected content |
Duration |
Evidence |
|---|---|---|---|
|
1. General understanding |
AI system, generative vs classical AI, LLM, 4 AI Act risk categories. |
1 to 2 h per person |
Attendance, dated material |
|
2. Roles: provider vs deployer |
Provider or deployer? Who validates an AI tool? Who keeps the register? |
1 h for managers and executives |
AI org chart, charter |
|
3. Risks and mitigations |
Data leakage on public LLMs, hallucinations, bias, vendor lock-in, mitigations. |
1 h per population |
Risk matrix, signed charter |
On pillar 3, a private AI by design simplifies the risk matrix (EU hosting, human in the loop, data not shared). See our use case protect your data with a private AI.
5. Three concrete Luxembourg SME situations
Situation 1: 15-employee fiduciary on Microsoft Copilot
Copilot on accounting workstations, external provider for payroll. Article 4 covers the 15 employees and the provider. Pillar 3: data transfers to a US vendor. See our GDPR, AI Act, Cloud Act comparison and the accounting and fiduciary solutions page.
Situation 2: 25-employee retail SME with AI chatbot
FAQ chatbot on e-commerce site operated by an external web agency. Article 4 covers sales, customer support and the agency (other person). Pillar 3: client data protection and visitor transparency. See our AI chatbot and data in Europe analysis.
Situation 3: 60-employee industrial SME with AI lead qualification agent
AI agent qualifies leads, sovereign European hosting. Article 4 covers sales reps, sales manager (pillar 2: final human decision) and marketing manager (pillar 3: bias). See lead qualification by AI agent.
💡 Good to know: pillar 3 varies from one case to another. Pillars 1 and 2 are easily pooled.
6. Five common mistakes to avoid in your AI literacy plan
- Mistake 1: confusing awareness with AI literacy. An email saying "watch out with ChatGPT" is not a session on the 3 pillars. A shadow IT reminder is a starting point, not an Article 4 deliverable.
- Mistake 2: training only the IT department. Article 4 covers all AI users. A sales rep copy-pasting a contract into ChatGPT is in scope.
- Mistake 3: excluding subcontractors. The "other persons" scope includes freelancers, agencies and managed service providers. Add an AI literacy clause in your service contracts.
- Mistake 4: over-documenting. A 15-employee SME does not need a 500-people mid-cap setup. The approach stays proportionate.
- Mistake 5: believing in an official EU certification. No EU certification scheme is standardised. Be wary of offers promising a non-existent official certification.
7. Where to start this week
Obligation enforceable since 2 February 2025, national sanctions activatable on 2 August 2026: two months separate you from the sanctionable switch. Enough to get compliant if you start now.
Today: open a spreadsheet and start the AI systems register (30 minutes). This week: appoint an internal lead (director, HR, DPO, compliance). Next: articulate AI literacy with a strategic AI framing consistent with your AI Act mapping.
Register started, lead appointed, plan to build? We frame the 3 pillars and articulate your approach with the SME Package AI. See why choose LetzAgents.
FAQ: Your questions on Article 4 of the AI Act
1. Since when has Article 4 of the AI Act been enforceable in Luxembourg?
Since 2 February 2025 (EU Regulation 2024/1689), i.e. 16 months before June 2026. National enforcement of sanctions activates on 2 August 2026: the obligation already exists, it simply becomes sanctionable. The CNPD is designated reference authority by draft law No. 8476.
2. What sanctions apply for AI literacy failure in a Luxembourg SME?
No direct EU administrative sanction at this stage (AI Act Service Desk). National sanctions activate on 2 August 2026 through Luxembourg law. Before that date, the main risk is civil: classic liability if a non-AI-literate staff member causes third-party harm (DLA Piper, Mayer Brown).
3. Who do I need to train on AI in my company?
Four categories: users of AI tools (all roles), managers who decide on uses, subcontractors who operate your AI systems, and in certain cases the end clients (front-end chatbot, voice agent). An SME of 30 employees with 3 subcontractors covers around 40 people.
4. How do I prove my employees are AI-literate?
Three pieces of evidence are enough: an AI literacy plan signed by the director (2 to 4 pages, 3 pillars), attendance sheets per session, an AI usage charter signed by each employee. Archive with the AI systems register. The Commission accepts a flexible approach.
5. What minimum AI training level for an SME in Luxembourg?
No quantified minimum: the Commission insists on "no one-size-fits-all". In practice, 3 to 4 h per user (pillars 1 and 3) plus 1 h for managers (pillar 2) cover a standard SME. The SME Package AI reimburses up to 70% of a project between €3,000 and €25,000 excl. VAT (guichet.public.lu).
About the author
LetzAgents, sovereign AI for SMEs and regulated organisations in Luxembourg. AI Act compliance, private LLM, AI coaching.
Sources: Article 4 of EU Regulation 2024/1689, Commission Digital Strategy, AI Act Service Desk, DLA Piper, Mayer Brown, Travers Smith, CNPD, guichet.public.lu.
Keywords
ai training obligation enterprise luxembourg, ai act article 4 sme luxembourg, ai literacy obligation enterprise luxembourg, artificial intelligence training staff sme, ai act article 4 checklist sme, ai literacy compliance sme luxembourg, article 4 enforceable february 2025, ai act sanctions luxembourg august 2026, 3-pillar ai literacy plan sme, cnpd ai act authority luxembourg, sme package ai literacy training, deployer sme luxembourg
