AI literacy after the omnibus: what Article 4 now asks of employers

In short: the 2026 omnibus turned Article 4 of the EU AI Act from a duty to ensure a sufficient level of AI literacy into a duty to take measures supporting its development. It is still binding on providers and deployers. A role-based program tied to your own AI policy, refreshed yearly and recorded, is the evidence that you took those measures.^1,2

Article 4 of the EU AI Act has applied since February 2, 2025. In its original form it required providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and others operating AI on their behalf.³ The Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026 and in force since July 27, rewrote it.¹

What changed

The amended article keeps a binding duty on providers and deployers, but it is now a duty to take measures supporting the development of AI literacy among staff and others operating AI on their behalf, rather than one to ensure a sufficient level. It states that providers and deployers are not required to guarantee any particular level of literacy for any individual, and gives the Commission and the Member States a supporting role, with particular attention to small and medium-sized enterprises.¹ This briefing is educational, not legal advice.

What it means for employers

A duty of effort is easier to meet and easier to evidence than a duty of result, but it is still a duty. An organization that has done nothing will struggle to show it took measures. One with a modest, documented program will not.

The Commission’s questions and answers on AI literacy, published in May 2025 under the original text, already pointed in this direction: organizations should record and document the measures they take, and no external certification is required. It also confirmed that the duty reaches beyond employees to others acting on the organization’s behalf, such as contractors, and that supervision and enforcement by national authorities would start from August 2026.²

A literacy program that would satisfy a reasonable reader

• Role-based content. Everyone who uses AI tools learns the basics: what the tools are for, what data may go where, how to check output and how to report a problem. People who build, buy or oversee AI systems learn more, matched to their role.
• Tied to your own policy. The most useful training explains your organization’s AI use policy and data rules with real examples from your work.
• Refreshed. Tools and rules change; a yearly refresh and an update when a major system is introduced is a defensible rhythm.
• Recorded. Who completed what and when. Under a duty of effort, the record is the evidence.

The content does not need to be elaborate. The data-class table from our shadow AI briefing and the checking habits in trust is a management skill cover most of what the first row needs.

Contractors count

The duty covers people operating AI on the organization’s behalf, not only employees.² If agencies, freelancers or outsourced teams use AI tools on your work, the literacy measures should reach them through onboarding or the contract.

For individuals

For people building a career around AI, the change is a reminder that literacy is now an expected part of working with AI in Europe, not an optional extra. The most valuable version of it goes beyond knowing how to prompt: knowing what a tool is reliable for in your field, how to check it, and when not to use it. That is a skill worth being able to describe in an interview, with an example, as our briefing on hiring for AI judgment sets out.

The AIMP program’s twelve modules are one structured way to meet the deeper tiers of the table above, and its first module maps the competencies a literacy program should build. The legal duty became softer this summer. The practical case for literacy did not change at all.