AI literacy requirements according to Art. 4 AI Act. Legal analysis and practical measures

AI literacy requirements according to Art. 4 AI Act Legal analysis and practical measures II AI literacy requirements according to Art. 4 AI Act – Legal analysis and practical measures Whitepaper October 2025 Authors: Martina Block, LL.M. Coco Marie Görlich Dr. Jonathan Lautenschlager Valentin Mayer Jan Stramm Prof. Dr. Nils Urbach Prof. Dr. Janine Wendt Prof. Dr. Domenik Wendt, LL.M. III Contact: Prof. Dr Nils Urbach Frankfurt University of Applied Sciences House of Science and Transfer (HoST) Hungener Straße 6, 60318 Frankfurt [email protected] Prof. Dr. Janine Wendt Bürgerliches Recht und Unternehmensrecht Technische Universität Darmstadt Hochschulstraße 1, 64289 Darmstadt [email protected] Prof. Dr. Domenik Wendt, LL.M. Bürgerliches Recht, Europäisches Wirtschaftsrecht und Europarecht Frankfurt University of Applied Sciences House of Science and Transfer (HoST) Hungener Straße 6, 60318 Frankfurt [email protected] Image sources: © All images used in the white paper are from the Adobe Stock image archive and are licensed accordingly. I Management Summary With the adoption of Regulation (EU) 2024/1689 (the ‘AI Act’), European legislators have firstly created a binding legal framework for the risk-appropriate use of artificial intelligence (AI). In addition to technical and organizational requirements, Art. 4 of the Regulation contains an explicit obligation to ensure a sufficient level of AI literacy among those involved in the development, operation and use of AI systems. The obligation applies to providers and deployers of such systems and must be fulfilled “to their best extent”. This Whitepaper provides a systematic analysis and practical operationalization of the AI literacy requirements standardized by Article 4 AI Act. The aim is to provide guidance, particularly for small and medium-sized enterprises (SMEs), on the structured implementation of the regulatory requirements. To this end, the legal basis is thoroughly examined and translated into an integrated competence model that distinguishes between individual (micro-) and organizational (macro-) dimensions. The focus is on a two-stage process model for identifying and developing AI literacy: a bottom-up analysis of individual abilities is systematically combined with a top-down comparison of organizational requirements. In addition, a morphological box for classifying AI-relevant role profiles is introduced, which enables a structured assignment competence requirements and measures. This work thus contributes to the normative, methodological and practical foundation of the obligation to ensure competence in the field of AI established by Article 4 AI Act. It is intended as a guide for corporate and public actors who not only want to meet regulatory requirements but also want to translate them into strategically sound competence development. II Table of Contents Management Summary ................................................................................... I 1 Preface .................................................................................................. 2 2 Legal Analysis ......................................................................................... 5 2.1 Overview of the AI Act .................................................................... 5 2.2 Scope of the AI Act ......................................................................... 6 2.2.1 Definition of the ‘AI system’ ............................................................ 6 2.2.2 Territorial scope ............................................................................ 6 2.2.3 Personal scope ............................................................................. 7 2.3 AI literacy under Article 4 AI Act ...................................................... 7 2.3.1 Objective of Article 4 AI Act ............................................................ 7 2.3.2 Addressees ................................................................................... 8 2.3.3 Definition „AI literacy“ ................................................................... 8 2.3.4 General AI literacy ......................................................................... 9 2.3.5 Specific AI literacy ....................................................................... 11 2.3.6 Measures .................................................................................... 11 2.3.7 ‘To their best extent’ .................................................................... 12 2.3.8 Sanctions .................................................................................... 13 3 Implementation prospects from practice................................................ 15 3.1 Definition and dimensions of AI literacy......................................... 15 3.2 Micro dimension: Classification of individual AI literacy ................. 17 3.2.1 Process knowledge ...................................................................... 18 3.2.2 Abilities....................................................................................... 18 3.2.3 Understanding and experience of interaction ................................ 19 III 3.3 Macro dimension: Classification of organizational AI literacy .......... 19 3.3.1 Fundamentals in information systems .......................................... 20 3.3.2 AI technology literacy ................................................................... 22 3.3.3 AI application literacy .................................................................. 23 3.3.4 AI development & operations literacy ............................................ 25 3.3.5 AI management literacy ............................................................... 26 3.3.6 AI reflection literacy ..................................................................... 28 3.4 AI literacy assessment methodology for needs analysis ................. 29 3.4.1 Bottom-up analysis of individual abilities ...................................... 30 3.4.2 Top-down alignment of organizational competencies .................... 31 3.5 Domains for grouping competence measures ............................... 33 4 Guidance for action and outlook ............................................................. 38 4.1 Initial examination methodology ................................................... 38 4.2 Need for differentiation ................................................................ 39 4.3 Operationalization of competency requirements according to roles 40 4.4 Outlook and future prospects ....................................................... 47 5 References ............................................................................................ 49 1 1 Preface 2 1 Preface The relevance of artificial intelligence (AI) for society, the economy and administration has grown significantly in recent years (Mayer et al. 2025). AI is no longer understood exclusively as a technological innovation, but has a profound impact on everyday life, social coexistence and corporate value creation processes. Companies therefore feel an increasing responsibility to use AI systems not only efficiently, but also in a manner that complies with standards, is ethically acceptable, and appropriate for the target audience. With the enactment of the Regulation (EU) 2024/1689 – better known as the ‘AI Act’ – the European Union has firstly created its legal framework for the risk-appropriate use of AI. In addition to technical and organizational requirements, Art. 4 AI Act also includes an explicit obligation to promote so called ‘AI literacy’ among the actors involved. This obligation addresses providers and deployers of AI systems and requires them to take measures to ensure “to their best extent” that all persons involved in the development, deployment, or use of AI have an appropriate level of skills, knowledge, and understanding in dealing with AI. The term AI literacy encompasses not only technical knowledge, but also procedural skills and critical thinking abilities. Companies are therefore required to collect, evaluate and develop both individual and organizational competence profiles in a differentiated manner. SMEs in particular have a great need for practical support in order to meet abstract regulatory requirements with implementable measures. The aim of this Whitepaper is therefore to support companies in the systematic operationalization of the competence requirements set out in Art. 4 AI Act. It provides a legally sound and practice-oriented classification of the provision, translates the regulatory requirements into verifiable competence dimensions (microand macrolevels) and identifies specific options for action in terms of skills development. Particular focus is placed on the two-stage competence model that has been developed and on linking legal requirements with organizational implementation perspectives. The white paper was made possible by hessian.AI. 3 We hope that this work will make a substantial contribution to clarifying the requirements raised by the AI Act. It is intended to accompany companies on their path to responsible, legally compliant and future-oriented use of AI systems – and to help them combine regulatory requirements with organizational capability. 10 – The ability to identify an AI system within the meaning of the AI Act; – Basic knowledge of such AI systems and models; – Basic understanding of the role and significance of data as the foundation of AI systems; – Basis understanding of AI interfaces and user front-ends; – Basic knowledge of the organizational environment in which AI is deployed, in particular its technical and operational integration as well as the regulatory framework applicable to AI systems; – Ability to interact effectively with the deployed AI system (e.g. providing inputs and interpreting outputs); – Ability to use AI as a targeted tool in everyday professional practice. 2. Overview of the position and function of the organization along the AI value chain – Knowledge of the different roles and requirements under the AI Act, in particular: o Role and obligations of providers of (high-risk) AI systems (Art. 3(3), Art. 16 AI Act); o Role and obligations of deployers of (high-risk) AI systems (Art. 3(4), Art. 26 AI Act); – Ability to correctly situate one’s own activities within the context of the various sets of obligations. 3. Understanding the opportunities, risks, and potential harms associated with the use of AI systems – Knowledge of the different risk classes under the AI Act and the related compliance obligations, in particular the distinction between high-risk AI systems and regular AI systems; – Sufficient knowledge of the tasks and activities for which human oversight is required for deployers under Article 14(4) AI Act. 11 2.3.5 Specific AI literacy Beyond general AI literacy, specific AI literacy may be required depending on the type of AI system deployed or provided, as well as its intended purpose. This involves more advanced expertise, enhanced skills, and a deeper understanding of the application and compliance with the requirements of the AI Act (Wendt 2025, para. 26; Wendt and Wendt 2025, § 4, para. 7). Accordingly, the literacy requirements differ significantly depending on the field of application: An AI system used in the legal sector entails different requirements in terms of expertise, risk assessment, and regulatory implementation than an AI system used in the financial sector, such as in banking or insurance. The degree of necessary understanding also largely depends on the complexity of the system and its specific purpose. The more complex and risk-prone a system is, the higher the requirements typically are for the specialized personnel involved – for example, regarding data literacy, model interpretation, or legal evaluation (Wendt 2025, para. 26; Schippel 2025, p. 123). 2.3.6 Measures The flexible system for ensuring AI literacy enshrined in Article 4 AI Act can be implemented in different ways. The AI Act does not prescribe which specific measures are required; instead, this depends on the individual case and should be guided by the actual needs within the company (Bundesnetzagentur 2025, p. 1). When determining appropriate measures for the development of AI literacy, both objective factors – in particular the AI system provided or deployed, its risk class and intended purpose, and the group(s) of persons for whom the AI system is intended – as well as subjective aspects should be considered. According to the wording of Article 4 AI Act, the latter include the technical knowledge, experience, education, and training of the persons involved with the AI systems, which should be identified and documented (Wendt 2025, paras. 30 et seq.). Even though the AI Act does not explicitly state this, the most sensible measure to achieve AI literacy is the implementation of training programs (Wendt 2025, para. 36; Wendt and Wendt 2025, § 4, paras. 9 et seq.; Fleck 2024, p. 102). These can be conducted either internally or externally (Wendt 2025, para. 43; Wendt and Wendt 2025, § 4, para. 11; Fleck 2024, p. 103; Rappenglück and Vonthien 2025, p. 402; Bundesnetzagentur 12 2025, p. 1), and they should also convey sufficient technical knowledge of AI systems (Wendt 2025, p. 103; Wendehorst 2024b, para. 22). In addition to conducting suitable training programs, organizations may also consider introducing the role of an AI officer and/or establishing working groups or task forces, such as an AI Center of Excellence. While the introduction of such a role is not mandatory – unlike other functions such as a data protection officer or an anti-money laundering officer (Bundesnetzagentur 2025, p. 2) – it can, however, be strongly recommended for practical reasons once an organization reaches a certain size (Rappenglück and Vonthien 2025, p. 404). Furthermore, the development of internal policies and work instructions can also contribute to fostering AI literacy (Wendt 2025, para. 48; Wendehorst 2024b, para. 43; Rappenglück and Vonthien 2025, p. 404). 2.3.7 ‘To their best extent’ Providers and deployers of AI systems are obliged to take measures to ensure a sufficient level of AI literacy – and to do so ‘to their best extent’. This wording is rather unusual in EU law and leaves room for interpretation (Wendt und Wendt, § 4 Rn. 5; Rappenglück and Vonthien 2025, p. 400; Möller-Klapperich 2025, p. 195). The AI Act itself does not specify which standard should be applied; however, the Commission’s FAQs indicate that Article 4 AI Act establishes a specific ‘obligation to take measures’ (European Commission 2025a). At the same time, the formulation ‘to their best extent’ introduces a noticeable relativization of the obligation. Providers and deployers of AI systems are therefore not required to take every conceivable step to ensure a sufficient level of AI literacy (MöllerKlapperich 2025, p. 197). Rather, this formulation implies a criterion of reasonableness that considers the individual circumstances. Companies are thus only required to take those steps that are reasonable and feasible considering their size, human and financial resources, type of operation, and specific circumstances (Wendt 2025, para. 49; Fleck 2024, p. 101; Möller-Klapperich 2025, p. 197). Accordingly, a structured needs assessment is first required if providers and deployers are to ensure AI literacy among the actors involved in the most targeted manner possible. This assessment should consider both objective and subjective factors – as set out in Article 4 AI Act. The analysis may be carried out internally within the company or outsourced 13 to qualified third parties (Wendt 2025, para. 50). It should be documented, including its results, and repeated both on a regular basis and on an ad hoc basis where appropriate (Wendt 2025, para. 52; Bundesnetzagentur 2025, p. 4). 2.3.8 Sanctions A violation of the requirements set out in Article 4 AI Act – in particular with regard to insufficient measures to promote AI literacy – may entail legal consequences. Pursuant to Article 99(1), first sentence, AI Act, the EU Member States must adopt provisions for effective, proportionate, and dissuasive sanctions. In addition, non-compliance with Art. 4 AI Act may also be relevant under liability law (Wendt 2025, para. 6; Wendehorst 2024b, para. 6; Rappenglück and Vonthien 2025, p. 401; Möller-Klapperich 2025, p. 195; Bundesnetzagentur 2025, p. 2), for example if damage could have been prevented through adequate training measures. Companies and organizations are therefore well advised to systematically implement and document appropriate training and qualification measures to minimize legal risks and to ensure the responsible use of AI (Bundesnetzagentur 2025, p. 2). 14 3 Implementation prospects from practice 15 3 Implementation prospects from practice 3.1 Definition and dimensions of AI literacy The analysis of Article 4 AI Act makes it clear that EU legislators are not limiting themselves to establishing technical standards and organizational frameworks but are making the acquisition of individual skills a binding legal requirement for all groups of actors involved in the development, deployment and use of AI systems. However, the practical implementation of these normative requirements remains the responsibility of the organizations committed. This requires a methodologically sound translation of regulatory requirements into operable structures, processes and measures that take account of the institutional realities of operational practice. Against this background, this chapter addresses the tension between legal requirements and organizational implementation prospects from the perspective of information systems. As a scientific discipline with a pronounced socio-technical focus, information systems offers a suitable interface for translating regulatory requirements into practice-oriented competence models, differentiated role profiles and structured procedures for needs assessment and skill development. The aim is to specify the content of the mandate contained in Art. 4 of the AI Act to ensure sufficient AI literacy, to operationalize it methodically and to systematically prepare it for business application. Small and medium-sized enterprises in particular are faced with the task of translating the rather abstract requirements into concrete learning objectives, role profiles and testing processes – and doing so under typical constraints of scarce resources and limited expertise. In German-language discourse, the term ‘KI-Kompetenz’ has become established as the translation of the term ‘AI literacy’ used in the AI Act. However, this term often refers primarily to application-related skills in dealing with AI systems, whereas the English term also encompasses critical-reflective and ethical dimensions of dealing with artificial intelligence (Gimpel 2024). Based on the definition of AI literacy enshrined in the AI Act as the interplay of knowledge, ability and understanding (see section 2.3.3), we take up this concept of literacy from an information systems perspective and expand it to include three central design principles. 16 These should take into account the particular complexity and dynamics of organizational practice in dealing with AI systems. The focus is not only on cognitive or technical requirements, but also on practical, normative and organizational dimensions. The following three core ideas illustrate this expanded approach to competence and form the conceptual basis for the following explanations: 1. Socio-technical perspective – technical know-how alone is not enough: human, organizational and regulatory aspects are equally important. 2. Action-oriented approach – competence is demonstrated through practical implementation, not just a certificate. 3. Continuous learning – due to rapid progress, AI literacy is not a static goal, but an ongoing development process. In order to systematize and operationalize the requirements formulated in the ordinance text, some of which are abstract and unspecific, a conceptual frame of reference is used to integrate two dimensions of information systems (Gimpel 2024; Pinski and Benlian 2023). The aim is to enable the practical implementation of the regulatory requirements and to facilitate the structured derivation of concrete action steps in an organizational context. The micro-dimension encompasses the individual perspective according to Pinski and Benlian (2024): 1. Knowledge: Self-perception of the AI process steps (input, processing, output) as well as the specific opportunities and risks in each step. 2. Ability: Self-interpretation of the roles of humans and AI, including responsibility, control mechanisms and decision-making limits. 3. Understanding: Practical comprehension (‘ability’) in dealing with AI tools that generate implicit knowledge. 17 The macro dimension, on the other hand, contains organizational perspectives according to Gimpel (2024): 1. Fundamentals in information systems 2. AI technology literacy 3. AI application literacy 4. AI development & operations literacy 5. AI management literacy 6. AI reflection literacy The micro and macro dimension are considered in an integrated manner and are interlinked: only when employees contribute their knowledge, ability and understanding (micro) to clearly defined roles, governance structures and business processes (macro) does organization-wide AI literacy emerge. Conversely, strategic AI programs remain ineffective without personally anchored competences. A two-stage approach is therefore recommended: 1. Bottom-up analysis of the individual skills of all employees (skills inventory, selfassessments, observation of real work processes) 2. Top-down comparison with the six macro dimensions to identify gaps in strategy, governance or infrastructure (needs assessment, role profiling, assignment of measures) This integrated approach forms the basis for the subsequent chapters of the whitepaper, which provides a uniform vocabulary, facilitates the prioritization of training measures and provides test criteria for the measures required by the AI Act to ensure AI literacy ‘to their best extent’. First, the microand macro-dimensions of AI literacy are classified. 3.2 Micro dimension: Classification of individual AI literacy While the AI Act primarily addresses organizational processes and technical requirements, Art. 4 AI Act explicitly focuses on people as a key success factor. These individual micro-dimensions are also referred to as ‘general AI literacy’ and comprise three closely 18 interlinked sub-skills: knowledge, ability and understanding. Together, these describe how individuals can understand, question and use an AI system responsibly. These three micro-dimensions are explained in more detail below. The combination of these terms gives rise to the ‘holistic empowerment’ that the AI Act requires of stakeholders: a competence profile that combines technical insight, a sense of responsibility and practical experience. By systematically recording and developing these three micro-dimensions, companies lay the foundation for the responsible, efficient and legally compliant use of AI. 3.2.1 Process knowledge Process knowledge refers to an understanding of the key functional steps of an AI system: data input, algorithmic processing and result output. Those with a strong understanding of processes recognize which data sources a model requires, where distortions can arise and how data quality affects the result. Equally important is the know-how of how a model is trained, validated and monitored: Which algorithms are suitable? Which performance metrics are useful, and how are they correctly interpreted? Finally, process knowledge also includes the ability to critically read results – i.e., to correctly classify probabilities, explanations or visualizations and to recognize the limits of their significance. For small and medium-sized enterprises, this knowledge is a prerequisite for fulfilling the documentation and reporting requirements of the AI Act on the one hand, and for identifying malfunctions or compliance risks at an early stage on the other. In short, process knowledge turns employees into informed sparring partners for data scientists and credible intermediaries towards management, customers and supervisory authorities. 3.2.2 Abilities The abilities of actors focus on the interaction and distribution of roles between humans and AI systems. The focus is on key questions regarding the functional division of tasks: Which decisions can be made automatically, and which must remain the responsibility of humans? Actor knowledge also includes an understanding of the control and escala- 19 tion mechanisms required to identify, prevent and appropriately address incorrect decisions. And who ultimately bears responsibility if something does goes wrong? A distinction is made between understanding the technical characteristics of AI and awareness of human roles, rights and obligations (Pinski et al. 2024a). On the technical side, it is important to be able to assess typical weaknesses such as bias, lack of explainability or overfitting. On the human side, the question is whether humans act ‘in’, “on” or ‘out of the loop’; in other words, whether they make decisions themselves or whether this is done independently by AI, and how this choice of role affects liability, governance and ethics. For SMEs, clearly defined stakeholder knowledge is essential because it forms the basis for assigning responsibilities transparently, training employees in a targeted manner and managing expectations towards stakeholders realistically. At the same time, it promotes a culture in which technological opportunities and risks can be discussed openly. 3.2.3 Understanding and experience of interaction Finally, understanding and experience of interaction describes the practical skills tested in dealing with specific AI tools and applications. This refers to skills that are often difficult to teach in seminars and can only be acquired through repeated practice. This includes formulating a prompt for an AI system in such a way that the desired results are achieved or recognizing when a model needs to be retrained. Interaction experience is essentially implicit knowledge: it is acquired ‘on the job’, cannot be fully captured in checklists, and only becomes apparent in practical situations (Pinski et al. 2024a). The more positive, but also critical, use cases employees experience themselves, the more likely they are to develop a reliable sense of a system's strengths and weaknesses. This experience is particularly relevant in SMEs, which rarely have large specialist departments: it shortens training times, reduces operating errors and creates the basis for rapid, evidence-based improvements, for example by learning directly from usage and error logs and adapting processes. 3.3 Macro dimension: Classification of organizational AI literacy From an information systems perspective, AI literacy is not only to be found at the indi- 26 It is crucial to understand that AI systems are not one-off products, but dynamic components that require maintenance in a changing technological and organizational context. Particularly relevant in this context is the ability to create the technical, organizational and regulatory framework conditions for the long-term and compliant operation of AI systems. This includes issues of IT security, data availability and sovereignty, documentation requirements and compliance with relevant norms and standards. Current research considers the ability to develop and operate AI to be a separate area of expertise. Gimpel (2024) describes this as an interface between technology, management and application expertise, combining a deep understanding of AI-specific development logic with practical implementation skills. This makes it important not only for developers, but also for those roles responsible for quality assurance, lifecycle management or regulatory compliance. Last but not least, this competence is relevant from a strategic perspective. Organizations that want to use AI technologies in a sustainable and scalable manner need reliable processes for development, operation and maintenance. Individuals with the appropriate expertise make a key contribution to ensuring technical performance, reducing operational risks and establishing robust innovation processes. In doing so, they create the prerequisites for organizational learning ability and continuous improvement in the use of AI. In summary, it can be said that the competence to develop and operate AI is a practiceoriented, process-oriented and compliance-relevant skill. It enables organizations not only to implement AI systems technically, but also to operate them in a stable, responsible and strategically effective manner over the long term. 3.3.5 AI management literacy Management competence in the context of AI describes the ability to shape the strategic, organizational and economic framework for the introduction, use and further development of AI systems. This competence enables managers, project managers and strategic decision-makers to recognize the potential and risks of AI use, assess them appropriately and translate them into sustainable control structures. As an interface between technology, organization and regulation, this competence is of central importance for the strategic capacity of organizations to act in the digital transformation. 27 A key component of AI management literacy is the ability to strategically evaluate AI initiatives. Managers must be able to identify specific areas of application, weigh the expected benefits against the costs and risks, and select suitable projects. This also includes understanding the prerequisites for successful AI implementations, for example regarding data availability, IT infrastructure, staff qualifications and regulatory framework. This competence encompasses both analytical and creative skills – in other words, the ability to observe technological developments with foresight and actively shape them. In addition, AI management literacy includes the ability to establish suitable organizational structures, responsibilities and processes. This includes, for example, setting up interdisciplinary teams, implementing agile project management, defining governance guidelines for AI systems, and integrating AI-specific risks into operational risk management. In larger organizations in particular, the ability to coordinate different interest groups and mediate between technical expertise and business objectives is of central importance. Another aspect concerns the ability to control regulatory and ethical requirements. Managers must ensure that AI systems not only function technically, but are also used in a legally compliant, non-discriminatory and socially acceptable manner. This includes responsibility for training measures as well as the establishment of processes for ethical review, transparency and traceability of algorithmic decisions. From a research perspective, AI management literacy is identified as a critical success factor for the value-adding and responsible introduction of AI (Pinski and Benlian 2023). Studies show that the ability of top management teams to understand technological developments and classify them strategically is a decisive factor in determining whether AI initiatives will have a long-term impact. It is also emphasized that management competence is not limited to individual leaders but is increasingly team-based and context-dependent (Pinski et al. 2024a; Pinski et al. 2024b). In summary, AI management legacy describes the ability not only to use AI operationally, but also to integrate it strategically and sustainably into value creation and control. It forms the basis for organization-wide design capability in dealing with AI and is therefore indispensable for a sustainable and legally compliant digital transformation. 28 3.3.6 AI reflection literacy Reflective competence in the context of AI describes the ability to recognize and critically analyze the social, legal and ethical implications of using AI systems and to incorporate them into business decisions. This competence forms the normative foundation for the responsible use of AI and is particularly important in areas of application where automated systems play a role in decisions concerning personal data, access opportunities or security-related aspects. As a cross-cutting competence, it complements the technological, application-oriented and management-oriented perspective with a conscious examination of the fundamental values, risks and side effects of algorithmic systems. The central components of AI reflection literacy are, first and foremost, an understanding of the typical risk dimensions associated with AI use. These include issues of discrimination through algorithmic bias, loss of human control, transparency of decision-making processes, and potential incapacitation through automated systems. People with a high level of reflective competence are able to identify and address such risks and initiate appropriate measures to minimize them – for example, through technical design, organizational frameworks or conscious limitation of AI use. Furthermore, this competence includes the ability to distinguish between technological possibilities and social acceptability. Reflective competence means not automatically evaluating everything that is technically feasible as desirable, but rather systematically reflecting on potential conflicts of interest – for example, between efficiency and fairness, automation and autonomy, innovation and sustainability. This requires a willingness to view AI systems not only in functional terms, but also to question them from the perspectives of power relations, social justice and democratic control. In science, reflective competence is increasingly understood as a central element of comprehensive AI literacy. Pinski and Benlian (2023) understand this with the term ‘critical literacy,’ which describes the ability to critically evaluate the effects of AI systems in a social context. It is becoming apparent that this competence not only strengthens individual judgement, but is also a prerequisite for value-driven, participatory AI design in organizations. From an organizational perspective, reflective competence helps to promote a critical 29 and responsible culture of use in dealing with AI. It strengthens the ability to address normative questions in interdisciplinary teams, to develop guidelines for the ethical use of AI, and to communicate with internal and external stakeholders. Finally, it is a central element of trust-building governance structures, for example in the context of ethics boards, compliance processes, or participatory decision-making procedures. In summary, AI reflection literacy is a normative, interdisciplinary and context-related skill. It enables organizations and individuals to combine technological innovation processes with social responsibility, thereby facilitating the use of AI in a way that is not only efficient but also legitimate, fair and sustainable. 3.4 AI literacy assessment methodology for needs analysis The effective implementation of the obligation to ensure sufficient AI literacy, as stipulated in Article 4 of the AI Act, requires a differentiated analysis of existing AI literacies. From a company perspective, a methodologically sound analysis that considers both individual and organizational competence dimensions is recommended for assessing needs. Depending on company size, technological maturity and domain-specific application context, the status quo of existing skills can vary considerably – and with it the specific need for training, development and control measures. Against this background, this subchapter addresses the question of how companies can systematically record the knowledge, understanding and practical skills their employees currently have in dealing with AI systems and to what extent these competencies are appropriate in relation to the technologies used, the respective task profiles and the regulatory requirements. The key questions addressed in the following discussion are therefore: - What individual AI literacies are necessary in the company and to what extent are these already present in the workforce? - How do role profiles differ in terms of their skill requirements and how can these requirements be identified and grouped? - What recommendations for action can SMEs follow to permanently meet the requirements of Art. 4 AI Act? 30 To answer these questions, a combined approach is proposed that combines two perspectives: a bottom-up analysis to identify the individual skills of individual employees and a top-down analysis to derive organizational competence requirements. Both analysis paths are divided into three phases and, when combined, provide the methodological basis for a systematic, evidence-based needs analysis that meets the requirements of Art. 4 AI Act. 3.4.1 Bottom-up analysis of individual abilities The bottom-up analysis and its individual phases, which are shown in Figure 2, aim to systematically record and classify existing individual AI literacy within the company and evaluate them in terms of organization-specific requirements. The focus here is on the perspective of individual employees, whose cognitive, procedural and reflexive skills in dealing with AI systems are understood as the basis for organizational learning and transformation processes. The analysis is carried out in a three-stage process that integrates both subjective self-assessments and objectifiable observations of real work processes. Figure 2: Bottom-up analysis of individual abilities (1) Skills inventory: The first step is to conduct a structured survey of existing skills by a skills inventory. The aim is to gain an overview of the knowledge, abilities and skills already available within the company in relation to AI-related tasks. This inventory can draw on existing competence models and is ideally supported by standardized assessment tools, such as competence matrices or digital skill profiles. The assessment serves to initially locate individual competence levels along the micro-dimensions described in section 3.2. Phase 1: Skill inventory Phase 2: Self-assesment Phase 3: Observation of real work processes 31 (2) Self-assessment: In addition to the inventory, a systematic self-assessment is carried out by the employees. Using digital tools or standardized questionnaires, subjective assessments of knowledge, confidence in action and reflective ability can be queried and evaluated. This form of assessment not only encourages individuals to examine their own competence profile but also provides organization-wide comparable data for interpersonal differentiation. To avoid distortions, it is advisable to combine this with realistic case studies or interactive application scenarios. (3) Observation of real work processes: Finally, supplementary validation is carried out by observing real work processes. The aim is to reveal implicit skills – especially those that cannot be reliably assessed through self-assessment alone – in a specific context of use. This form of assessment requires methodological sensitivity and can be operationalized through shadowing, peer feedback or simulations. The results enable a holistic assessment of practical competence and provide indications of discrepant self-assessment or hidden competence potential. The three-stage bottom-up analysis process thus contributes significantly to individual and collective positioning and forms the empirical basis for targeted development measures. It allows for evidence-based differentiation of training needs, addresses specific learning paths and supports precise positioning in advanced role profiles in line with the top-down analysis of organizational competence structures described below. 3.4.2 Top-down alignment of organizational competencies In addition to the bottom-up perspective of individual skills, a top-down analysis as shown in Figure 3 is necessary to systematically identify and operationalize existing and future requirements for AI literacy at the organizational level. The aim is to examine the strategic, structural and functional framework conditions of an organization and, on this basis, to develop binding competence profiles and derive measures. The top-down analysis is divided into three consecutive phases: needs analysis, creation of role profiles and assignment of measures. 32 Figure 3: Top-down alignment of organizational competencies (1) Needs analysis: The first step is to systematically assess the organization’s specific competence requirements for working with AI systems. This analysis considers, among other things, the type and complexity of the technologies used, the degree of digitalization of business processes and the regulatory requirements of the AI Act. Relevant questions here are: - In which areas are AI systems used? - Which tasks are (partially) automated? - Which control and management skills are required? The needs analysis thus forms the conceptual starting point for determining functional target skills in the respective organizational context. (2) Creation of role profiles: Based on the needs analysis, differentiated role profiles are developed in the second step, which map the relevant fields of activity, decision-making levels and responsibilities in the organization. These role profiles must be structured along the competence dimensions described in section 3.3 and evaluated in terms of their characteristics (low, medium, high). The use of simplified structuring instruments - for example in the form of a structuring grid (morphological box) - enables a systematic combination of functional features and creates the methodological basis for a precise assignment of competence requirements to organizational roles. In this way, not only existing, but also emerging or hybrid role formats can be modeled, for example in interdisciplinary AI teams or governance structures. (3) Assignment of measures: Finally, concrete measures for competence development and their strategic anchoring in existing staff, IT or compliance structures are derived. Phase 1: Needs analysis Phase 2: Creation of role profiles Phase 3: Assignment of measures 33 This includes prioritizing training formats, developing curricular building blocks, integrating them into existing training platforms, and defining eligibility criteria for recruitment and internal career development. In addition, the results can be used to fulfill documentary evidence in the context of AI compliance. The assignment of measures thus closes the loop between strategic needs, operationalized role profiles and a targeted qualification strategy. In combination with the bottom-up analysis, an integrated competence model is created that can be used not only to take stock, but also to control organizational AI literacy development processes. This forms the basis for accessible educational strategies, sustainable personnel development and the implementation of the requirements of Art. 4 AI Act. 3.5 Domains for grouping competence measures To operate the AI literacies presented in section 3 in your own corporate context, a morphological box can be used as a structuring and classification tool. The aim is to differentiate between different role profiles within organizations in terms of their functional characteristics, organizational embedding, and specific AI-related tasks, and to assign specific competence requirements to them. The morphological box systematically combines independent feature dimensions that characterize a role profile in its entirety. This makes it possible to capture and compare the complexity of organizational requirements for AI literacy along structured categories and translate them into compatible development paths. On this basis, training needs, further education measures, or suitability criteria can be derived for each defined role. The individual parameters – such as functional role, decision-making level, or AI usage type – have been deliberately chosen so that they can be varied and combined independently of one another. In combination with the AI literacy dimensions, this allows both typical and new or hybrid role profiles to be generated that consider the different requirements for working with AI systems. The box below uses the role of ‘innovation manager’ in the context of an industrial company as an example to show how the connection between organizational function and AI literacy can be operationalized. This methodological approach is suitable for developing 34 personas in training concepts, for strategic staff planning, and for designing and implementing organization-specific compliance measures to implement Article 4 of the AI Act. Table 1: AI literacy with an example from the innovation department of a private medium-sized company Parameter (feature) Characteristics for the target role (example) Functional role Manager / Project Manager Type of organization Private sector (industrial companies, e.g. mechanical engineering) Domain context R&D / Digitalization / Business Development AI usage type Control and strategic selection of AI systems Participation in decisionmaking Strategic + budget responsibility Fundamentals in information systems High: Understanding of information systems, digital transformation and process integration AI technology literacy Low to medium: Ability to evaluate technological options and limitations AI development and operations literacy Low: Understanding of development processes and technical dependencies (e.g. data pipelines) AI application literacy Medium to high: Ability to integrate AI solutions into innovation projects AI management literacy High: Management of projects, teams and roadmaps, coordination with specialist departments AI reflection literacy High: Assessment of ethical, legal and societal implications of AI innovations For the targeted derivation of training requirements from the developed role profiles, a systematic differentiation of the respective competence requirements is required. The competence dimensions shown in the morphological box can not only be described qualitatively but require a scalable classification in order to design didactically connectable measures. For this purpose, a three-level rating scale is used, which classifies the characteristics of the individual competences with levels low, medium and high, as shown in Table 2. 35 Table 2: Systematic differentiation scale for the respective competence requirements Level of competence Description Didactic objective Low Basic understanding of principles and concepts. Comprehension possible, but not independent application. Awareness raising, clarification of terms, understanding of context Medium Ability to apply knowledge in a reflective manner in typical usage scenarios. Initial operational routines in place. Application skills, case studies, tool usage High Deep understanding, ability to assess, adapt or shape. Responsibility for action given. Analytical, management or organizational skills, decision-making skills This scale is used to qualitatively assess the necessary level of competence for each relevant dimension. It is designed in such a way that it can differentiate between different role profiles and at the same time serve as a basis for curriculum development and competence development measures. Ideally, the classification is based on externally validated competency models or standardized assessments, allowing learning objectives and paths to be tailored to the respective starting point and target position. • The low level indicates a basic understanding at the conceptual level. Individuals in this competence area are able to name and classify key terms and principles, but do not yet can apply them independently. The main objectives of training measures at this competence level are to raise awareness, develop a common understanding of terms, and promote contextual understanding. • The intermediate level represents application-oriented competence in specific professional situations. Individuals with an intermediate level of competence can use AI systems in a reflective manner, explain their basic functioning, and use them independently within clearly defined processes. Training measures at this level focus on practical knowledge transfer, tool competence, and application in exemplary usage scenarios. • Finally, the high level describes an in-depth understanding of the respective competence dimensions. Individuals with this level of competence are not only able 45 Figure 4: Role profiles for addressing Art. 4 of the AI Act 46 Recommended action 3: The implementation of competence requirements must be based on the principle of proportionality and the criteria of reasonability ‘to their best extent’, while always maintaining the mandatory nature of the rule. The practical implementation of training should be based on the principle of proportionality. The decisive factor is not the abstract fulfilment of an ideal state, but the comprehensible assurance of competence development ‘to their best extent’. For SMEs, this means: – There is an indispensable obligation to ensure a basic level of competence. – Any further specialization must be implemented in a reasonable manner, depending on the role, area of application and size of the company. – Documented needs analyses and graduated action plans are considered suitable evidence for supervisory authorities. Recommendation 4: Minimum data protection standards must be systematically considered as a cross-cutting requirement in all role profiles. Ensuring minimum data protection standards must be established as a consistent crosscutting requirement in all role profiles. In addition to the basic principles of data minimization, purpose limitation and transparency obligations, this includes knowledge of the lawful handling of special categories of personal data, compliance with deletion and documentation obligations, and an understanding of the interfaces between the AI Act and the General Data Protection Regulation (GDPR). Employees at all role levels are empowered to identify risks of non-compliance with data protection law and to take appropriate protective measures when introducing and applying AI systems. This applies both to technical experts, who must take data protection-compliant default settings (‘privacy by design’) into account when developing system architectures, and to users who process personal data during their activities. Data protection competence should therefore be understood not as optional additional knowledge, but as a mandatory core requirement for every role in the competency model. 47 Recommended action 5: Ensuring AI literacy should be institutionalized as an ongoing task and continuously developed through regular needs analyses and evaluations. The obligation to ensure AI literacy under Article 4 of the AI Act should be understood as an ongoing and dynamic task that goes beyond one-off training measures. Companies are encouraged to institutionalize competence development within their organizations, for example by establishing permanent governance structures such as competence centers, continuously updated training programs or standardized evaluation procedures. This includes, in particular: (1) regular needs analyses that capture both individual learning progress and organizational requirements, (2) the continuous updating of role profiles considering technical and regulatory developments, and (3) the systematic evaluation of the effectiveness of training measures based on measurable criteria. Such continuity helps to develop AI literacy not only reactively but also proactively and to anchor them sustainably in the organizational structure. This also ensures that compliance with the requirements of Article 4 of the AI Act remains documentable, verifiable and adaptable to new legal or technological conditions in the long term. 4.4 Outlook and future prospects Looking ahead, it can be assumed that securing AI literacy will require even closer cooperation between national, European and international structures in the future. Beyond the purely internal corporate perspective, issues of standardization, certification and transnational comparability of competence levels will come to the fore. Companies will have to adapt to the fact that, in addition to internal certification, external certification processes will increasingly be established to ensure regulatory connectivity and market confidence in equal measures. At the same time, technological dynamics, particularly in the field of generative AI and multi-agent systems, are increasing demands on continuous skills development (Busch et al. 2025; Lämmermann et al. 2025). These technologies not only expand the range of application scenarios, but also create new dependencies on data quality, model transparency and governance mechanisms (Mayer et al. 2024). Organizations are therefore required to develop proactive learning and adaptation processes that go beyond pure training logic and build competence in experimental, interdisciplinary contexts. AI assistants 48 could also be used as learning partners to teach AI skills (Gutheil et al. 2025). The ethical and normative dimension is also becoming increasingly important. With the growing integration of AI into socially sensitive areas, there are rising expectations that companies will not only comply with regulations but also take responsibility for fairness, explainability and social legitimacy. Future competence models will therefore not only reflect technical and regulatory knowledge but will also have to systematically incorporate skills in critical reflection, interdisciplinary cooperation and responsible decisionmaking. SMEs can achieve economies of scale by actively using external support, industry-specific learning platforms and cooperative qualification models. It could prove helpful if the European Commission deliberately refrains from imposing rigid and detailed regulations, but at the same time provides clearer guidance and interpretative notes. For SMEs in particular, it is crucial to know and understand at an early stage what requirements must be met, in what form and with what resources, to create legal certainty and avoid disproportionate burdens. In the long term, AI literacy will thus become an integral part of education and training systems throughout society (Gimpel et al. 2024). The linking of vocational training, university teaching and lifelong learning opens the possibility of understanding the requirements of Article 4 of the AI Act not only as a legal obligation, but also as a starting point for comprehensive digital maturity in Europe. This guide provides companies with an initial methodological proposal on how to systematically address the obligation to ensure sufficient AI literacy as stipulated in Article 4 of the AI Act. It offers guidance on which steps should be prioritized – from the introduction of mandatory basic training to the differentiated design of role profiles and the ongoing institutionalization of competence development. This enables SMEs to meet the legal requirements ‘to their best extent’ in accordance with their resources and in line with the principle of proportionality, while at the same time creating a basis for the long-term development of organizational AI maturity. 49 5 References Bundesnetzagentur (2025): Hinweispapier KI-Kompetenzen nach Artikel 4 KI-Verordnung. Online verfügbar unter https://www.bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/_functions/Hinweispapier.pdf?__blob=publicationFile&v=2. Busch, M., Collarana, D., Decker, S., Eymann, T., Gutheil, N., Keller, R., Kühl, N., LangeBever, C., Mayer, V., Morad, M., Pöllath, L., Röglinger, M., Sharma, R., Urbach, N. (2025) Implementing Generative AI Chatbots – Potentials, Challenges and Guide-lines for the Successful Implementation of Generative AI Chatbots into Tourism, Uni-versity of Bayreuth, March 28, 2025. Cipierre, Paula: Konzepte zur Umsetzung von KI-Kompetenz im Unternehmen zwischen KI-VO und DS-GVO. In: RDV (2024), S. 261. Europäische Kommission (2025a): AI Literacy - Questions & Answers. Europäische Kommission. Online verfügbar unter https://digital-strategy.ec.europa.eu/en/faqs/ailiteracy-questions-answers, zuletzt aktualisiert am 18.08.2025, zuletzt geprüft am 21.08.2025. Europäische Kommission (2025b): Annex to the Communication to the Commission Approval of the content of the draft Communication from the Commission - Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act). C(2025) 924 final. Hg. v. Europäische Kommission. Europäische Kommission. Brüssel. Online verfügbar unter https://ec.europa.eu/newsroom/dae/redirection/document/112455, zuletzt geprüft am 28.07.2025. European Artificial Intelligence Office (2025): Living Repository of AI Literacy Practices - v. 16.04.2025. European Artificial Intelligence Office. Online verfügbar unter https://digital-strategy.ec.europa.eu/en/library/living-repository-foster-learning-and-exchange-ailiteracy. Fernandes, Elora; Holmes, Wayne; Zhgenti, Sopio (2024): Art. 4. In: Ceyhun Necati Pehlivan, Nikolaus Forgó und Peggy Valcke: The EU Artificial Intelligence (AI) Act: A Commentary: Wolters Kluwer Law International. Fleck, Tilmann (2024): AI literacy als Rechtsbegriff - beck-online. In: KIR, 99-103. 50 Gimpel, Henner (2024): KI-Kompetenzen in der Wirtschaftsinformatik: OSF. Online verfügbar unter https://osf.io/wbd84/. Gimpel, H., Gutheil, N., Mayer, V., Bandtel, M., Büttgen, M., Decker, S., Eymann, T., Feulner, S., Kaya, M. F., Kufner, M., Kühl, N., Lämmermann, L., Maedche, A., Ruiner, C., Schoop, M., and Urbach, N. (2024). (Generative) AI Competencies for Future-Proof Graduates: Inspiration for Higher Education Institutions. University of Hohenheim. https://doi.org/10.5281/ZENODO.10680210 Gutheil, Niklas; Mayer, Valentin; Müller, Leopold; Römmelt, Jörg; and Kühl, Niklas, "PromptPilot: Improving Human-AI Collaboration Through LLM-Enhanced Prompt Engineering" (2025). ICIS 2025 Proceedings. 8. https://aisel.aisnet.org/icis2025/hti/hti/8 Hilgendorf, Eric; Härtlein, Johannes (2025): Art. 3. In: Eric Hilgendorf und Johannes Härtlein: KI-VO. Verordnung über künstliche Intelligenz. NomosHANDKOMMENTAR. BadenBaden: Nomos. Kirschke-Biller, Jonathan; Füllsack, Anna-Lena (2025): Art. 3. In: Jens Schefzig und Robert Kilian: BeckOK KI-Recht, Stand: 01.05.2025. 2. Edition: C.H.Beck. Lämmermann, L., Mayer, V., Schweizer, A., & Urbach, N. (2025). AI-Shoring als Zukunftsstrategie: Mit KI-Agenten dem Fachkräftemangel begegnen. Wirtschaftsinformatik & Management, 1-7. Mayer, Valentin; Schüll, Moritz; Aktürk, Onur; and Guggenberger, Tobias, "Designing Human-AI Hybrids: Challenges and Good Practices from a Multiple Case Study" (2024). ICIS 2024 Proceedings. 3. https://aisel.aisnet.org/icis2024/aiinbus/aiinbus/3 Mayer, Valentin; Prediger, Loreen; Urbach, Nils; and Meierhöfer, Simon, "The Evolution of the Organizational Decision-Making Process: A Predictive Analysis of the Impact of Artificial Intelligence" (2025). ICIS 2025 Proceedings. 2. https://aisel.aisnet.org/icis2025/general_topic/general_topic/2 Möller-Klapperich, Julia (2025): KI-Kompetenz. In: NJ 2025. Pinski, Marc; Benlian, Alexander (2023): AI literacy-towards measuring human competency in artificial intelligence. Pinski, Marc; Benlian, Alexander (2024): AI literacy for users – A comprehensive review 51 and future research directions of learning methods, components, and effects. In: Computers in Human Behavior: Artificial Humans 2 (1), S. 100062. DOI: 10.1016/j.chbah.2024.100062. Pinski, Marc; Hofmann, Thomas; Benlian, Alexander (2024a): AI Literacy for the top management: An upper echelons perspective on corporate AI orientation and implementation ability. In: Electron Markets 34 (1). DOI: 10.1007/s12525-024-00707-1. Pinski, Marc; Tarafdar, Monideepa; Benlian, Alexander (2024b): Why Executives Can’t Get Comfortable with AI. In: MIT Sloan Management Review (Online), S. 1–4. Rappenglück, David; Vonthien, Maximilian (2025): Art. 4 KI-VO operativ umsetzen – Ein Drei-Säulen-Ansatz für KI-Kompetenz, KIGovernance und KI-Compliance im Unternehmen. In: RDi 2025, S. 398–405. Schippel, Robert (2025): Trainingsvorgaben: Wie kann man KI-Kompetenz nach Art. 4 KIVO vermitteln? Strategievorschlag zur effektiven Vermittlung von KI-Kompetenz. In: KIR, S. 119–124. Wendehorst, Christiane (2024a): Art. 3. In: Mario Martini: KI-VO: Verordnung über Künstliche Intelligenz. 1. Aufl. München: C.H.Beck. Wendehorst, Christiane (2024b): Art. 4. In: Mario Martini: KI-VO: Verordnung über Künstliche Intelligenz. 1. Aufl. München: C.H.Beck. Wendt, Domenik (2025): Art. 4. In: Janine Wendt und Domenik Wendt: Verordnung über Künstliche Intelligenz – KI-VO. im Erscheinen. Baden-Baden: Nomos. Wendt, Janine; Wendt, Domenik (2025): Das neue Recht der Künstlichen Intelligenz - KIVerordnung, Leitlinien, Delegierte Rechtsakte. 2. Aufl., Baden-Baden: Nomos. 52 Block, M., Görlich, C., Lautenschlager, J., Mayer, V., Stramm, J., Urbach, N., Wendt, J., Wendt, D., (2025). AI literacy requirements according to Art. 4 AI Act. Legal analysis and practical measures. October 21, 2025. https://doi.org/ 10.5281/zenodo.17408352