EU AI Act Article 4 After the Digital Omnibus: What Employers Must Actually Do
Article 4 of the EU AI Act requires every provider and deployer of an AI system in the EU to take measures supporting AI literacy among staff and anyone operating AI on their behalf. It has applied since 2 February 2025. On 27 July 2026 the Digital Omnibus (Regulation (EU) 2026/1744) replaced the article in full: the duty to "ensure a sufficient level" became a duty to "support the development" of AI literacy, and the law now states explicitly that no specific level must be guaranteed for any individual.
The current legal text
"Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."
— Article 4(1), Regulation (EU) 2024/1689 as replaced by Regulation (EU) 2026/1744, consolidated 27 July 2026
AI literacy itself is defined in Article 3(56): the "skills, knowledge and understanding" that allow providers, deployers and affected persons "to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause."
What changed — and what it means practically
| Before 27 July 2026 | After (current) | |
|---|---|---|
| Duty | Take measures to ensure a sufficient level of AI literacy | Take measures to support the development of AI literacy |
| Nature | Obligation of result (per person, best extent) | Obligation of effort (per organization) |
| Individual guarantee | Implied benchmark ("sufficient") | Explicitly not required |
| Support | — | Commission + Member States must facilitate, especially SMEs; practical examples to be published on the Art. 62 platform |
The substantive bar got lower; the documentary bar got higher. You are no longer answerable for how literate any given employee turns out to be — you are answerable for the measures you took, and effort is only visible if it leaves a trace. A single company-wide course, unchanged for everyone, satisfies none of the four calibration inputs the article names (technical knowledge, experience, education and training, context of use) — by construction.
Who is covered
- Employees who operate or use AI systems in their role — including AI features inside ordinary SaaS (copilots, AI-assisted CRMs, automated document processing). Using a commercial AI tool under your authority makes you a deployer.
- Contractors, agencies, consultants — "other persons dealing with the operation and use of AI systems on your behalf." The Commission's guidance is explicit that this reaches beyond the payroll.
- Not covered: staff who never touch AI systems in their role, and passive recipients of AI-assisted output (assess case by case).
- Scope: every provider and deployer, regardless of size, industry or risk tier — including non-EU companies whose AI outputs are used inside the EU.
What regulators actually accept as evidence
There is no record-keeping obligation written into Article 4 and no mandatory certification — the Commission's guidance says organizations "can" keep an internal record, and that there is no need for a certificate. But enforcement is incident-triggered, and when an incident happens, the measures you can evidence are the difference between a compliance conversation and an Article 99 proceeding (up to €15M or 3% of global turnover where misuse of a high-risk system traces back to ignorance). The practical evidence set:
- Documented role mapping — which roles use which AI systems, and what training maps to each.
- Assigned, not opt-in training — completion records showing the employer assigned it. The Commission is blunt that employees' self-selected LinkedIn Learning or Coursera badges are individual behavior, not organizational compliance.
- The vendor manual is not a measure — Commission guidance: "simply relying on the AI systems' instructions for use or asking the staff to read them might be ineffective and insufficient."
- A baseline — what staff knew before training (assessment records).
- Refresh cadence — the duty is continuous: review when systems change, are upgraded, or new ones are added. Quarterly review + annual update is a defensible rhythm.
The four-module training template (2 hours per staff group)
The regulation prescribes no syllabus. What follows from the article's purpose and Commission guidance is that a person using AI should understand four things — which maps to a four-module session:
| Module | Time | Covers | Grounded in |
|---|---|---|---|
| 1. What we have | 30 min | Which AI systems are used in your organisation, what they do, which risk tier they fall in | Inventory + Art. 6 classification |
| 2. What they can and cannot do | 30 min | Probabilistic generation vs lookup, hallucination, known failure modes, when not to use the system | Annex IV points 3 & 9 |
| 3. Human oversight | 30 min | When a human must review, who the oversight owner is, escalation paths | Art. 14 (design) / Art. 26 (operate) |
| 4. Incidents & confidentiality | 30 min | What counts as an incident, internal reporting, authority notification (15 days), what data must never be entered | Art. 73 + NDA/personal-data rules |
Tailor per role: a finance analyst using AI forecasting and a marketing coordinator using a writing assistant have different burdens — that proportionality is the legal requirement.
Does Article 4 carry a direct fine?
No specific penalty is attached to Article 4 itself, and it is not listed in Article 99 as a standalone violation. But lack of AI literacy provides the causal chain for other penalties: if a staff member misuses a high-risk AI system through ignorance, the organization faces Article 99 exposure — up to €15 million or 3% of global turnover. Claims that "a missed training session costs €35 million" confuse Article 4 with the Article 5 prohibited practices.
Do we have to certify or test every employee?
No. Since the July 2026 amendment the text explicitly does not require guaranteeing any specific level of AI literacy for any individual, and the Commission states there is no mandatory curriculum, no minimum number of hours, and no obligation to measure employees' knowledge. What matters is documented, role-appropriate measures — assigned training, mapping to the systems you actually run, and completion records.
Does the obligation apply if we only use ChatGPT or a copilot?
Yes. If your employees use a general-purpose assistant, an AI copilot, or any AI feature embedded in SaaS under your organization's authority, you are a deployer, and Article 4 applies regardless of company size or the system's risk tier. It has applied since 2 February 2025.
How often should training be refreshed?
The duty is continuous, not one-off. Update training when you adopt a new AI system or a system is upgraded, and review on a regular cadence — quarterly reviews with an annual full update, plus ad-hoc sessions for new systems, is the pattern that maps cleanly to the "measures" standard.
Sources
- Regulation (EU) 2024/1689 Article 4 and Article 3(56), as replaced by Regulation (EU) 2026/1744 Article 1(5), consolidated version of 27 July 2026 (EUR-Lex)
- European Commission AI literacy guidance / Q&A (no mandatory curriculum; internal records optional; vendor manuals insufficient; LinkedIn badges not organizational compliance)
- aiactinsight.eu, complipath.io (20 Aug 2026), kju.ai, dsak.tech, lawandtechnology.eu, open-skills.ai, aisigil.com — cross-checked Article 4 analyses (August–September 2026)
LuminaAct (a MonAItize division) delivers role-based AI literacy training with the assessment baseline, role mapping and completion documentation a market surveillance authority asks for: www.luminaact.eu. Last updated: 22 September 2026.