AI literacy under the AI Act: what Article 4 requires after the Omnibus

Yes, AI literacy is still a legal obligation under the EU AI Act. As of October 2026, Article 4 requires providers and deployers of AI systems to take measures that support the development of AI literacy among their staff and other people who operate AI on their behalf. Since the AI Omnibus took effect on 27 July 2026, the law no longer asks for a "sufficient level" of literacy and states that no specific level has to be guaranteed. There is no prescribed course, exam or certificate: what matters is that the organisation takes measures suited to its people and to the AI it uses.

The change came with Regulation (EU) 2026/1744, which replaced the duty to ensure a sufficient level of AI literacy with a duty to take measures that support its development. Guidance written in 2025 often still quotes the old wording, which no longer applies.

What Article 4 says now

The amended article, available in consolidated form on the Commission's AI Act Service Desk, has three paragraphs.

• Paragraph 1 (the obligation). Providers and deployers must take measures to support the AI literacy of staff and other persons dealing with the operation and use of AI systems on their behalf. They have to take into account those people's technical knowledge, experience, education and training, the context in which the systems are used, and the people or groups the systems are used on.
• Paragraph 2 (public support). The Commission and the Member States must support and facilitate these efforts, in particular for SMEs. The Commission has to publish practical examples of how to comply on the AI Act's single information platform.
• Paragraph 3 (the AI Board). The European Artificial Intelligence Board is to adopt recommendations, drawing on European competence frameworks, that help the Commission and Member States promote AI literacy, including by setting common objectives.

For compliance teams, the key addition is the new closing sentence of paragraph 1:

"This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." (Article 4(1), as amended)

The definition itself did not change. Article 3(56) still describes AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to be aware of the opportunities, risks and possible harm of AI.

What changed from the 2024 text

The original Article 4 of Regulation (EU) 2024/1689 has applied since 2 February 2025, together with the rest of Chapters I and II (Article 113). It told providers and deployers to take measures to ensure, "to their best extent, a sufficient level of AI literacy" among the same groups of people.

The route to the new wording:

• 19 November 2025: the Commission proposed the Digital Omnibus on AI. On literacy, it would have removed the duty on companies and replaced it with a requirement for the Commission and Member States to promote AI literacy. According to the European Parliament's research service, this was the largest item in the Commission's savings estimate: €222.75 million out of up to €429.5 million a year in administrative costs.
• 7 May 2026: Parliament and Council reached a trilogue agreement, which Parliament approved on 16 June 2026.
• 29 June 2026: the Council adopted the act. It was signed on 8 July, published in the Official Journal on 24 July and entered into force on 27 July 2026.

The co-legislators rejected the full removal. The final text keeps a direct duty on providers and deployers but no longer sets a target level. In practice, the question is whether an organisation took suitable measures, not whether each person reached a set standard. The Commission's announcement says the company requirement was simplified and that the Commission and Member States now take a stronger role.

The Omnibus also inserted a new Article 4a, but it has nothing to do with training: it covers the processing of special categories of personal data for bias detection and correction.

Who must comply

Article 4 covers every provider and deployer of an AI system, whatever the risk category. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer is any person or organisation using an AI system under its authority, except in a personal, non-professional activity. A company whose employees use a chatbot or another AI tool for work is therefore a deployer.

The people to consider are not only employees. The Commission's AI literacy questions and answers describe "other persons" as people broadly under the organisation's remit, giving contractors, service providers and clients as examples.

Is AI literacy training mandatory?

Not in a fixed form. The AI Act does not prescribe a course, an exam, a number of hours or a certificate. The Commission's Q&A, last updated on 27 July 2026 to reflect the Omnibus, says no certificate is needed and that organisations can keep an internal record of trainings and other guidance initiatives.

The Q&A does outline a minimum approach. It suggests that organisations:

1. make sure people have a general understanding of AI and of the AI used in the organisation;
2. consider their own role, as a provider or deployer of AI systems;
3. consider the risks of the AI systems they provide or deploy;
4. build concrete literacy actions on that analysis, adjusted to people's knowledge and the context of use.

For staff using generative AI tools such as chatbots, the Q&A says they should be informed about specific risks, giving hallucination as an example.

High-risk systems: a separate, stricter duty

The softer wording of Article 4 does not reduce the training duties attached to high-risk AI. Under Article 26(2), deployers of high-risk systems must assign human oversight to people who have the necessary competence, training and authority, as well as the necessary support. The Commission's Q&A confirms that this obligation remains in place. After the Omnibus, high-risk obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in products covered by Annex I; our EU AI Act timeline lists the other key dates.

Who enforces Article 4, and is there a fine?

Enforcement is national. The Commission's AI Office does not supervise Article 4. National market surveillance authorities do, and according to the Commission they supervise and enforce the rules from 2 August 2026.

The AI Act does not set a fine amount for Article 4. The fine tiers in Article 99 name specific provisions, such as the prohibited practices in Article 5, provider obligations under Article 16, deployer obligations under Article 26 and the transparency rules in Article 50. Article 4 is not on that list.

Article 99(1) leaves it to Member States to lay down rules on penalties and other enforcement measures for infringements of the regulation, and the Commission's Q&A says national authorities could impose penalties and other measures for breaches of Article 4. The form and size of any sanction therefore depend on national law. The Q&A also notes that the AI Act creates no right to compensation of its own, although people who suffer harm can still bring claims under national law.

A written record is the clearest way to show what was done. Germany's Bundesnetzagentur, for example, recommends that organisations keep a good record of their AI literacy measures.

What organisations can do now

These steps follow the amended text and the Commission's guidance. They are not legal advice; national or sector rules may add requirements.

1. List the AI systems in use, including AI features inside existing software, and note who uses each one.
2. Identify your role for each system. Provider, deployer or both; the measures differ.
3. Group people by exposure. Occasional users of a chatbot need different measures from staff who configure systems, review outputs or make decisions with them.
4. Choose proportionate measures. Short briefings, usage rules, role-specific sessions and internal guidance can all be part of it; no format is required.
5. Include contractors and other persons who operate AI systems on your behalf.
6. Record what was done: date, content, audience and the systems covered.
7. Review when tools change. A new system or a new use case is a reason to update the measures.

Official guidance and resources

• The Commission's AI literacy Q&A, updated on 27 July 2026 for the Omnibus.
• The living repository of AI literacy practices, which collects examples from organisations, starting with AI Pact pledgers. The Commission states that copying these practices does not automatically give a presumption of compliance with Article 4.
• Guidance from national authorities, such as the AI literacy pages of Germany's Bundesnetzagentur.

For wider coverage of the regulation, see our AI Act section and the Policy desk.

Frequently asked questions

Is AI literacy mandatory under the EU AI Act?

Yes. As of October 2026, Article 4 requires every provider and deployer of AI systems to take measures that support the AI literacy of staff and others using AI on their behalf, although no specific level of literacy has to be guaranteed.

Did the AI Omnibus remove the AI literacy requirement?

No. The Commission proposed in November 2025 to shift the duty to the Commission and Member States, but the final Regulation (EU) 2026/1744 kept an obligation on companies in a softer form, which has applied since 27 July 2026.

What is the fine for breaching Article 4 of the AI Act?

The AI Act sets no fine amount for Article 4, because it is not listed in the fine tiers of Article 99. Sanctions depend on national law and are applied by national market surveillance authorities, which supervise the rules from 2 August 2026.

Do employees need an AI literacy certificate?

No. The Commission's guidance says no certificate is needed; organisations can keep an internal record of the trainings and other measures they provide.

When did the AI literacy obligation start?

The original Article 4 has applied since 2 February 2025. The amended version, which asks organisations to support AI literacy rather than ensure a sufficient level, has applied since the Omnibus entered into force on 27 July 2026.