Key takeaways
- The AI literacy requirement under Article 4 of the EU AI Act has applied to every dental practice using an AI system under its own responsibility since February 2, 2025.
- Since July 27, 2026, Article 4 only requires measures to promote AI literacy—you are explicitly no longer required to guarantee a specific level of knowledge for individual staff members.
- The regulation does not impose fines solely for a lack of training; however, documented measures remain your most important protection for liability issues and quality management. Using a solution like Nelly for multiple AI applications significantly streamlines the necessary inventory process.
It’s Tuesday afternoon. One of your dental assistants is using ChatGPT to draft a response to a critical Google review. In the treatment room next door, your X-ray software highlights proximal caries, which you then assess yourself. At the front desk, a voice assistant handles appointment requests while you are on your lunch break.
Three AI systems, three different risk levels, one practice. No one on your team has ever classified this as "AI usage"—and that is exactly where the Article 4 obligation begins.
What does Article 4 require of your dental practice?
Article 4 of the EU AI Act requires every dental practice that uses an AI system under its own responsibility to take measures to promote the AI literacy of its staff.
The regulation distinguishes between providers and deployers. Providers are the manufacturers—the company behind your X-ray software, your documentation solution, or your voice assistant. You are the deployer. As soon as you use an AI system in your daily practice, you fall under Article 4. Practice size, legal structure, and specialty do not matter. A solo practice is just as much a deployer as a multi-site dental clinic.
This covers everyone working with these systems on your behalf: dentists, dental assistants, practice managers, billing staff—and even external service providers working for you.
The regulation does not prescribe a fixed curriculum. Instead, it lists the criteria your measures should be based on: the technical background and experience of the individuals, their education and training, and the specific context in which the system is used. Someone who only occasionally generates a text draft needs different knowledge than someone assessing AI-supported diagnostic findings.
What changed on July 27, 2026?
With the Digital Omnibus Regulation (EU) 2026/1744, which came into force on July 27, 2026, Article 4 was downgraded from a mandatory requirement to ensure literacy to a duty to promote it.
The difference is smaller than it sounds and more important than many think:
- Until July 26, 2026: Providers and deployers were required to ensure, to the best of their ability, that their staff possessed a sufficient level of AI literacy.
- From July 27, 2026: Providers and deployers take measures to support the development of AI literacy. The regulation explicitly clarifies that this does not create an obligation to guarantee a specific level of AI literacy for any individual.
This eliminates the risk that concerned many practice owners most: that an authority might retrospectively assess whether an individual employee knew enough. In the future, the assessment will focus on whether you have taken any action at all.
At the same time, the European legislator provided the reasoning: strict obligations create additional burdens, especially for smaller businesses, whereas AI literacy should be a strategic priority regardless of legal requirements and potential sanctions. The Commission and Member States are to actively support providers and deployers in the future, including through practical examples on a central information platform.
For your practice, this means: the hurdle has been lowered, but the reason remains.
What really happens on August 2, 2026?
August 2, 2026, is the general date of application for the EU AI Act – from this day on, national market surveillance authorities will begin their oversight activities.
In Germany, the division of responsibilities was only clarified shortly before this date. The AI Market Surveillance and Innovation Promotion Act (KI-MIG) entered into force on July 29, 2026. It designates the Federal Network Agency as the central market surveillance authority and, at the same time, as the point of contact and complaints office. Anyone wishing to file a complaint about a practice's use of AI now has a clearly defined address for the first time.
You should distinguish between three points:
- Article 4 is not a penalty provision: The regulation's list of sanctions covers the obligations of providers, authorized representatives, importers, distributors, deployers, and notified bodies, as well as transparency obligations – AI literacy under Article 4 is not included. Fines solely for a lack of training are not provided for.
- Transparency obligations apply from August 2, 2026: They were not postponed by the Digital Omnibus and concern, among other things, chatbots, voice assistants, and AI-generated content.
- Obligations for high-risk AI have been postponed: They now apply from December 2, 2027, and August 2, 2028, respectively. Whether a specific system in your practice falls into this category depends on the individual case and should be clarified with the manufacturer.
August 2, 2026, is therefore not a deadline by which training records will suddenly be audited. It is the day the supervisory structure is established.
Which AI is your practice already using?
The first step toward AI literacy is an AI inventory: a simple list of all the systems in your practice that use artificial intelligence.
Most practices underestimate just how much is already in use.
Typically, there are five areas:
- Diagnostics: AI-supported X-ray analysis for early caries detection or for assessing periodontal status.
- Documentation: Systems that record the consultation and create structured documentation that only needs to be approved by the doctor.
- Reception and phone: Voice assistants for scheduling appointments and answering calls outside of office hours.
- Billing: Applications that identify services from the documentation and suggest billing codes.
- Back office and marketing: readily available language models for responding to reviews, newsletters, job advertisements, or employment references.
For each system, note who operates it, what data flows into it, and who approves the result. The inventory doesn't need more than that to start. It serves as both the foundation for your training plan and the first reliable proof that you have engaged with the topic.
The inventory becomes complex primarily when every application comes from a different provider. You need specific information on functionality, data processing, and approval processes for every system—and a separate inquiry for each one. Practices that use multiple AI applications via Nelly, such as AI Documentation and the AI Plan Agent, consolidate these into one solution. Instead of contacting three providers individually, you get the relevant information from a single source. This shortens your list and the path to the information that should be in it.
Learn more about it here: https://www.getnelly.de/produkte/ki-dokumentation
How do you provide risk-based training for your team?
Article 4 does not mandate a specific format – the key is that your measures are tailored to the role and the context in which each individual uses the technology.
Half an afternoon is often enough for many practices if you follow a structured approach:
- Start with an inventory: Go through your list and assign the people who work with each system. This often results in just two or three groups.
- Tier the depth based on risk: Someone who incorporates AI results into a treatment decision needs more training than someone using it to draft text. However, both groups must be instructed: the former on how to identify erroneous system suggestions, and the latter on which patient data is appropriate for an AI system in the first place.
- Cover three content blocks: Basic technical understanding: How is a suggestion generated, and what are the limitations? Legal framework: AI Act, data protection, and professional confidentiality. Application: What exactly can be entered into which system?
- Choose your format: A documented team meeting is just as valid as e-learning or external training. For most practices, internal instruction by a trained staff member is the most practical approach.
- Document briefly and repeat: Date, participants, content, one page. And a fixed annual date, plus whenever a new system is introduced.
The last point is where things usually fall apart in practice. Training from the spring is of little use if a new application is introduced in the autumn for which no one has been trained.
Why does documentation remain important despite the relaxed requirements?
Even without a specific penalty provision, documented AI competence remains relevant – especially for liability issues and your quality management.
The reason is simple: The treatment decision remains yours. AI systems provide analyses and suggestions; they do not assume responsibility. If a system misses a lesion that you should have identified, your duty of care remains unchanged. In the event of a dispute, the question of whether your team knew what the system could do and where its limitations lay is highly relevant – even if it is not mandated by Article 4.
There is also a second, often underestimated point: data protection and professional confidentiality – both of which are particularly important to Nelly and firmly anchored in our product architecture. A team that is not certain which patient data may be entered into which system is the greater risk. It is not the missing training certificate that is the problem, but rather a patient's name appearing in the prompt of an openly accessible language model.
Conversely, where the approval process is properly structured, the documentation is created almost automatically. Nelly's AI documentation, for example, runs in the background, filters out medically relevant information, and creates a draft for your records. It is only approved once you have reviewed it. This confirmation step is active human oversight – and it is logged.
Bottom line: Why you should address AI literacy now
The legal situation shifted in your favor at the end of July 2026. The obligation to ensure a specific level of competence has evolved into an obligation to promote competence – without guarantees for individual staff members and without specific penalty provisions. If you have hesitated until now because the topic seemed unpredictable, you can now check it off with manageable effort.
The real reason for doing it hasn't changed. A team that understands the tools it works with makes fewer mistakes, handles patient data more securely, and actually utilizes the systems you pay for – which is why Nelly provides comprehensive training for the entire team. Start with an inventory. The rest will follow from there.
Get information without obligation
Would you like to know how to use AI in your practice to streamline documentation and patient communication instead of adding to your workload? We offer free, no-obligation consultations for your specific situation – simply book an appointment.
FAQs on the AI literacy obligation
Does Article 4 apply if we only use ChatGPT in the back office?
Yes. Anyone who uses an AI system under their own responsibility is considered an operator under the AI Act – regardless of whether the system was developed specifically for medical practices. This also includes publicly available language models used for responding to reviews or writing job advertisements. However, the requirements for the depth of competence are significantly lower here than for diagnostic systems.
Are there fines for a lack of AI training starting in August 2026?
No. The AI Act’s catalog of sanctions does not mention Article 4; a fine solely for lack of training is not provided for. Market surveillance authorities, such as the Federal Network Agency (Bundesnetzagentur) in Germany, will begin their activities on August 2, 2026. Their jurisdiction covers the regulation as a whole, not specifically AI literacy.
What records should we keep in the practice?
An AI inventory of all systems in use, a brief overview of who works with what, and documentation of the training sessions conducted, including dates, participants, and content. One page per measure is sufficient. It is advisable to store these in your quality management system so that the documents are readily available for audits.
