EU AI Act Article 4 after the Digital Omnibus: what changed
The Digital Omnibus on AI rewrote EU AI Act Article 4 with effect from July 27, 2026 (Regulation (EU) 2026/1744). Providers and deployers no longer have to ensure “a sufficient level” of AI literacy. They must take measures to support the development of AI literacy among their staff and others who use AI on their behalf, and the law requires no specific level of any individual.
A sales rep pastes a customer’s tender into a chatbot late on a Friday. The old Article 4 asked whether her AI literacy was “sufficient”. The new one asks whether you gave her the rules and training to know what stays out.
Status as of October 13, 2026. Not legal advice.
EU AI Act Article 4 before and after the Digital Omnibus
Published in the Official Journal on July 24, 2026, the Omnibus entered into force on July 27, 2026 and replaced Article 4 of the AI Act, Regulation (EU) 2024/1689. The new wording below comes from secondary sources, so check the final text on EUR-Lex (Law & Technology).
| Before (from February 2, 2025) | After (from July 27, 2026) | |
|---|---|---|
| Core duty | “take measures to ensure, to their best extent, a sufficient level of AI literacy” | “take measures to support the development of AI literacy” |
| Required level | A “sufficient level”, never defined in the Act | No specific level of AI literacy is required of any individual |
| Who must act | Providers and deployers of AI systems | Unchanged |
| Who is covered | Staff and other persons operating or using AI systems on the organization’s behalf | Unchanged |
| What to take into account | Technical knowledge, experience, education and training, the context of use and the people affected | The Commission Q&A still asks for measures tailored to these factors |
| Role of public authorities | Not mentioned in Article 4 | The Commission and Member States support providers and deployers, especially SMEs |
| Certificate or exam | Not required | Not required |
In plain terms, the duty moved from reaching an undefined level to making an effort you can show. What have you done to help your people use AI competently, and does it fit how they actually use it?
What stayed the same
- The obligation still exists. “Support” is not optional: an organization with no measures at all is not meeting Article 4.
- It applies to deployers, not just developers. If your staff use ChatGPT, Microsoft Copilot, Gemini, Claude or an AI feature inside your CRM, you are a deployer of those systems.
- It covers people outside your payroll who operate AI systems for you, such as contractors and temporary staff.
- High-risk deployers have extra duties. Under Article 26, deployers of high-risk AI systems must assign human oversight to people with the necessary competence, training and authority. The Omnibus moved the Annex III high-risk dates (recruitment, HR, education, credit) to December 2, 2027, but kept these duties.
What the Commission’s AI literacy Q&A says
The Commission’s AI literacy Q&A, last updated on July 27, 2026, is not legally binding, but it shows how the Commission reads the new Article 4:
- No certificate. In the Q&A’s words, “There is no need for a certificate.” An internal record of trainings or other guidance is enough.
- No obligation to measure. You do not have to test or score employees’ AI knowledge.
- Instructions for use are rarely enough. Relying only on a tool’s instructions might be ineffective; someone using ChatGPT should understand risks such as hallucination.
- “Other persons” is broad. It covers contractors and service providers, and in some cases clients, depending on the risk.
- SMEs get support. The Q&A points to free resources, such as European Digital Innovation Hubs and a living repository of AI literacy practices, though copying an example from it does not by itself make you compliant.
The Q&A asks for a role- and risk-based approach. At a minimum, organizations should:
- build a general understanding of AI in the organization: what AI is, which AI you use, and its opportunities and risks;
- know whether you are a provider or a deployer of each system;
- understand the risks of the systems you provide or use, and how to reduce them;
- tailor measures to staff knowledge, experience and context, including legal and ethical aspects such as the AI Act itself.
For a closer reading, see the Commission’s AI literacy Q&A explained.
Who supervises Article 4, and are there penalties?
National market surveillance authorities supervise Article 4, not the EU AI Office. According to the Commission Q&A, their supervision and enforcement began in August 2026.
Penalties are national too. The Q&A says national authorities could impose penalties and other enforcement measures under national law, following a proportionate approach. So the answer depends on the country:
- Finland has applied the Act on the Supervision of Certain AI Systems (1377/2025) since January 1, 2026. The Finnish Transport and Communications Agency Traficom is the single point of contact. The government bill behind the act (HE 46/2025) states that Article 4 does not as such create sanctionable obligations, and Finnish law sets no penalty for breaching it.
- Sweden has no national implementing law yet. The Swedish Post and Telecom Authority (PTS), the Authority for Privacy Protection (IMY), Finansinspektionen, Läkemedelsverket and Swedac act as competent authorities until December 31, 2026, with PTS as the single point of contact (temporary government assignment Fi2026/01365, June 4, 2026). The assignment names no authority for Article 4; the government inquiry proposes PTS for it, with no sanction for breaching it (SOU 2025:101).
- Elsewhere in the EU, check your national act implementing the AI Act, or ask your single point of contact.
The obligation can also reach companies outside the EU: see Article 4 and UK companies.
Why it matters without a fine
Gaps in AI skills show up as customer data pasted into a consumer AI tool, an AI-drafted reply with invented facts sent to a client, or a deepfake voice call that pushes a payment through. AI literacy reduces exactly these everyday risks.
The gap is real. In a 2025 study of more than 48,000 people in 47 countries, 66% of employees who use AI at work said they had relied on its output without evaluating its accuracy (KPMG and University of Melbourne). In Finland, 63% of employees use or have tried AI at work, yet only 33% have received guidance and 17% training (CGI, December 2025, n = 1,000).
Other AI Act dates to keep in view
For the full timeline, see the Commission’s overview of the AI regulatory framework.
| Date | What applies |
|---|---|
| Feb 2, 2025 | Article 4 (AI literacy) and Article 5 (prohibited practices) |
| Jul 27, 2026 | Regulation 2026/1744 in force: new Article 4 wording |
| Aug 2026 | Article 50 transparency obligations apply from Aug 2; national supervision of Article 4 begins |
| Dec 2, 2026 | Machine-readable marking deadline for AI systems already on the market; new prohibition on AI producing non-consensual intimate imagery and child sexual abuse material |
| Dec 2, 2027 | High-risk systems in Annex III, such as recruitment, HR, education and credit |
| Aug 2, 2028 | High-risk systems in products covered by Annex I |
National authorities publish guidance as obligations start: Traficom, for example, published guidance on the new transparency obligations on August 20, 2026.
The AI literacy obligation in practice: a 5-step plan
The plan follows the Commission’s minimum points and works for a team of 10 or a company of 400.
1. Map where AI is used
List the AI tools in use, who uses them and with which account (business or personal consumer). Include AI features inside software you already pay for, and contractors who work with your data. Note whether you are a provider (you build or brand the system) or a deployer (you use it). Most SMEs are deployers of everything they use.
2. Assess the risk by role
The same tool carries different risks in different jobs. A short table shows where to focus:
| Role | Typical AI use | Main risk | Focus of the measures |
|---|---|---|---|
| Customer service | Drafting replies, chatbot | Wrong answers, customer personal data | Checking answers, data classes, telling customers when they talk to AI |
| Sales | Proposals, prospect research | Invented facts or figures, confidential prices | Verifying sources, what never to paste |
| HR | Job ads, summaries, screening tools | Bias, personal data, high-risk use from December 2027 | No automated screening without approval, a person decides |
| Finance | Analysis, reports, invoice checks | Calculation errors, deepfake payment fraud | Checking numbers, confirming payments through a second channel |
| Field work | Voice notes, translated manuals | Wrong safety or installation instructions | Checking against the official manual |
| Management | Summaries, decision support | Over-trust, trade secrets in prompts | AI prepares, people decide |
3. Set clear rules
Write down the approved tools, what data may go into them and who decides on new uses. The AI policy template for EU SMEs gives you ten copyable sections. If a new tool changes how people work, check first whether you must inform or consult employee representatives (employee consultation rules in the EU).
4. Train everyone, then by role
Give everyone the same foundation: what AI is, how to prompt well, how to check output, what data to keep out, and what the AI Act means for daily work. Then add role-specific examples, and include contractors and temporary staff. In the Aigen Campus course, module 6, Rules and responsibility, covers the AI Act from an employee’s point of view, and every module has examples for 12 job roles.
Tip: You can build your AI policy for free and try module 1 of the course with up to 5 users. Create a free account and see whether the format suits your team.
5. Record what you did and review it
Keep a simple record (see the next section). Review it at least once a year, and sooner when you add a major AI tool or the rules change.
How to document your Article 4 measures
Documentation is not a legal requirement in itself, and you need no certificate. It is simply the easiest way to show a customer, an auditor or an authority what you have done. A useful record answers five questions:
- Who is in scope: employees, contractors and temporary staff who use AI.
- What each person received: training, guidance or a policy, with dates and versions.
- Why it fits: the role and risk reasoning from step 2.
- Acknowledgement: who has read and accepted the AI policy, and which version.
- When you will review it next.
A spreadsheet works for a 15-person company; a larger one benefits from a register that fills itself as people complete training and acknowledge the policy. For a sample register and a checklist, see the AI literacy evidence pack.
One honest note: no course or tool makes you compliant on its own. Training, a reviewed AI policy and a clear record form the core of your measures, but you decide what is enough for your risks.
Frequently asked questions
Does Article 4 still apply after the Digital Omnibus?
Yes. Regulation (EU) 2026/1744 changed the wording, not the existence of the obligation. Providers and deployers must still take measures to support the AI literacy of their staff and others using AI for them.
Do we need an AI literacy certificate for our employees?
No. The Commission’s Q&A says there is no need for a certificate. An internal record of training and guidance is enough, although a verifiable certificate can help when customers ask for evidence.
Is there a fine for not complying with Article 4?
Each Member State decides on penalties. Finland sets no penalty for breaching Article 4, and the Swedish inquiry proposes none. Check the law that implements the AI Act in your country.
Does Article 4 apply if we only use ChatGPT or Copilot?
Yes. Using a general-purpose AI tool at work makes your organization a deployer, and Article 4 applies to deployers. The Commission’s Q&A even names ChatGPT users as people who should understand risks such as hallucination.
Does the AI literacy obligation cover contractors?
Yes, when they operate or use AI systems on your behalf. The Q&A lists contractors and service providers as “other persons”, and in some cases clients.
Get started
Every plan needs clear rules and a shared foundation of skills. The Aigen Campus AI policy builder is free, and the annual license adds the 7-module course for the whole staff and a register that records completions and acknowledgements. Create a free account to build your policy and try module 1.