Part of the AI Act and AI agents guide
AI Literacy Under the AI Act: What Article 4 Requires After the 2026 Omnibus
The AI Act's first obligation for ordinary companies is not about high-risk systems. It is AI literacy: if your staff use AI systems, you must take measures to help them do it with understanding. In July 2026 the Digital Omnibus rewrote the duty to make it lighter, but it did not remove it. Here is what it asks for now.
Who it applies to
Article 4 of the AI Act (Regulation (EU) 2024/1689) applies to providers and deployers of AI systems. A deployer is anyone using an AI system under its authority in a professional activity, so a company whose staff use a chatbot, a coding assistant or an AI agent at work is a deployer. The duty has applied since 2 February 2025 (Article 113(a)).
AI literacy means the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to be aware of the opportunities and risks of AI and the harm it can cause (Article 3(56)).
What the Omnibus changed
| Original text (2024) | As replaced by Regulation (EU) 2026/1744 | |
|---|---|---|
| The duty | Take measures to ensure, to their best extent, a sufficient level of AI literacy of staff and others operating or using AI systems on their behalf | Take measures to support the development of AI literacy of the same people |
| Guaranteed outcome | Implied by "sufficient level" | Expressly not required: no specific level of AI literacy of any individual has to be guaranteed |
| Factors | Technical knowledge, experience, education and training, the context of use, and the people the systems are used on | Unchanged |
| Support | None in the article | The Commission and member states support providers and deployers, in particular SMEs; the Commission publishes practical examples; the AI Board adopts recommendations |
The Omnibus entered into force on 27 July 2026. Recital 8 explains the change: stakeholders reported that a stringent obligation to ensure a sufficient level was not suitable for all providers and deployers and created a compliance burden, particularly for smaller enterprises, while AI literacy should remain a strategic priority.
Lighter, not gone: the duty is now about taking reasonable measures, not reaching a guaranteed result. You still need to be able to show what you did.
How it is enforced
Article 4 is not among the obligations listed in Article 99(4), which carry fines of up to €15 million or 3% of turnover. Penalties for other infringements, including Article 4, are left to member states, which must lay down effective, proportionate and dissuasive rules that may include warnings and non-monetary measures and take SMEs' interests into account (Article 99(1)). In practice, the bigger exposure is indirect: a poorly understood AI system leads to the GDPR, consumer or employment problems that authorities and courts do enforce.
For high-risk uses the bar is higher and separately enforced: deployers must assign human oversight to people with the necessary competence, training and authority (Article 26(2)), with fines under Article 99(4)(e). Those obligations apply from 2 December 2027 for Annex III systems; see the AI Act timeline.
A proportionate AI literacy programme
- List who uses which AI systems, in which roles and for what: support agents using a reply assistant, developers using a coding agent, HR using a screening tool. Your register of AI systems is the starting point.
- Set a baseline for everyone who uses AI: what the tools can and cannot do, that outputs can be wrong or invented, what data must not be entered, how to check outputs, and when to involve a human or escalate.
- Add role-specific modules where the context demands it: prompt injection and permissions for people who configure agents, bias and explanation duties for anyone using AI on decisions about people, confidentiality for legal and HR.
- Cover the people affected: Article 4 asks you to consider the persons on whom systems are used. Staff using AI on customers or applicants need to know their rights, such as human review of automated decisions under GDPR Article 22.
- Refresh when you add a tool, change a use, or after an incident, and at least yearly.
- Document it: an AI use policy, the modules, who completed them and when. That record is your evidence.
Where it overlaps with other duties
- GDPR: staff who understand AI limits are your first defence against unlawful processing and data leaks; see AI agents and GDPR.
- NIS2 and DORA: both require security awareness training; AI tools can be added as a module rather than a separate programme. See security awareness training requirements.
- Transparency (Article 50): since 2 August 2026, people interacting with AI systems must be told, unless it is obvious. Staff need to know when that applies.
Policy, register and literacy rules in one pack. The AI Agent Governance Pack includes an agent use policy with AI literacy and transparency rules, a register of AI agents with each one's AI Act role, a DPIA template for agentic processing and an incident playbook.
Sources
- Regulation (EU) 2024/1689 (AI Act), Articles 3(56), 4, 26, 50, 99 and 113, EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Article 1(5), Article 4 and recital 8, EUR-Lex
Related tools
Further reading: EU AI Act Timeline · AI Agents and GDPR
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.