Under the EU AI Act, providers and deployers must take measures to support the development of AI literacy among staff and other people operating or using AI on their behalf. Those measures must reflect the people’s knowledge and experience, the context of use and the people affected. Article 4 does not require an organization to guarantee a specific literacy level for each individual.
That is the position checked on October 19, 2026, after the July amendment. For a learning or operations lead, the immediate decision is to establish which AI uses and people fall within scope, then choose appropriate support. Buying a certificate does not settle either question.
This article addresses the EU AI Act. Europe includes jurisdictions with different laws, and a company’s particular activities can bring other obligations into play.
Use the amended Article 4
Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced Article 4 with effect from July 27, 2026. The organizational duty remains, with an explicit limit on what it requires of individual outcomes.
| Question | Current position |
|---|---|
What must the organization do? | Take measures to support AI literacy development, suited to the relevant people, systems and context. |
Must every person reach a guaranteed level? | No. The amended text expressly rules out that guarantee. |
Did responsibility move entirely to government? | No. The Commission and Member States must support organizations, particularly smaller businesses, alongside the organizational duty. |
The Commission’s current Article 4 text sets out all three paragraphs, including support from public authorities and recommendations to be adopted by the AI Board. When reading an older course page or policy, check which version it describes. The original provision’s reference to a “sufficient level” is not the current formulation.
Article 4 sits in Chapter I, which began applying on February 2, 2025. Later dates for particular high-risk-system duties do not postpone this literacy obligation.
Identify the AI activity and the people involved
A company need not build its own model to have responsibilities. Article 3 defines a deployer as an organization or person using an AI system under its authority, excluding personal nonprofessional use. A provider develops, or has developed, a system and places it on the market or puts it into service under its own name or trademark.
Start with the actual activity rather than the company’s headquarters alone. Article 2’s territorial rules include:
- Providers bringing AI to the EU market or into service there, whether established inside or outside the EU.
- Deployers established or located in the EU.
- Providers and deployers outside the EU whose AI-system output is used in the EU.
The Act also contains exclusions and specific scope provisions. Have the responsible legal owner apply them to the system and activity. Merely having an EU customer is not a complete assessment of every unrelated AI use in a global company.
Map the people dealing with that use too. Article 4 reaches beyond employees to other people operating or using AI on the organization’s behalf. An outsourced service team should not disappear from the analysis because its members have another employer.
In a September 2026 article, HR leader and executive coach Malvika Jethmalani argued that US organizations can underestimate this exposure and warned against treating literacy as another course to push through a learning-management system. Her account names no company or measured intervention, but raises a useful ownership question: who connects the learning plan to the company’s actual AI activity?
Choose support that fits the work
AI literacy is broader than writing prompts. Article 3’s definition includes informed use and awareness of opportunities, risks and possible harm. A generic demonstration of a chatbot may leave an employee unsure what they may enter, how to check a result or when to stop.
The Commission’s AI literacy Q&A recommends considering the organization’s AI use, its provider or deployer role, system risks and people’s starting knowledge. It allows different learning approaches and does not prescribe one training format. Even ordinary drafting or translation can require guidance about fabricated answers.
Turn that analysis into a specific support decision:
- Name the use and its boundaries. Identify the approved system, task, inputs and actions. Resolve unclear permissions with the employee AI policy owner.
- Identify the relevant users and responsibilities. Include contractors acting on the organization’s behalf, and distinguish producing a draft from checking or authorizing its use.
- Choose the learning and guidance. Use the employee literacy baseline for common decisions, then adapt practice to the system and responsibility.
- Keep the arrangements useful. Give questions an owner and revisit support when the tool, use or affected population changes.
These are practical planning steps, not a statutory syllabus or an automatic compliance test. The role-specific learning-path guide explains how to build the practice without assigning an identical course to every job.
Record the measure without overstating what it proves
The Commission says Article 4 does not require a certificate or a particular AI officer or governance board. Organizations can keep internal records of training and other guidance. It also says Article 4 does not oblige employers to measure employees’ AI knowledge.
That leaves room for useful evidence without inventing a mandatory exam. Record what you provided, for whom, why it matched the use and who will maintain it. If you observe a practice task, keep the finding bounded to what you actually saw.
A May 2026 Reddit discussion captures the tension. One Reddit user reported seeing generic videos played at double speed and completion screenshots treated as compliance. A respondent challenged how much technical understanding was really needed; the author clarified that they meant preparation proportionate to the work. The employers were unnamed, and the discussion predates July’s amendment. It illustrates a disagreement about useful preparation, rather than establishing widespread noncompliance or the current legal standard.
Suppose Claire Bennett leads learning at a packaging supplier. Customer-service employees and an outsourced team use an approved assistant to draft product replies. Claire has a synthetic customer question and a current product sheet that omits the pack quantity.
The coach asks the learner to check whether the draft invents a quantity and identify whom to ask. Claire’s record can distinguish several kinds of evidence:
| Record | What it establishes |
|---|---|
Attendance at an introduction | The person attended that session. |
Task-specific guidance and supported practice | The organization supplied those measures for the identified product-reply use. |
A checked attempt with an omitted pack quantity | How the person handled that particular missing fact, including any help required. |
An unresolved permission or checking question | A gap for the responsible owner to resolve before the affected work proceeds. |
None of these records alone establishes compliance with every applicable requirement. A successful product-reply exercise also does not authorize a new AI use in recruitment, lending or another consequential decision. Keep the scope of the learning separate from permission to deploy.
Keep other obligations and dates separate
The softer individual-outcome wording does not remove other competence requirements. Article 26(2) retains a separate requirement for high-risk-system deployers to assign human oversight to people with appropriate competence, training, authority and support.
Its applicability follows the relevant high-risk rules and transitions. Under the amended Article 113, Chapter III’s main requirements and operator duties have different application dates, subject to the provision’s exceptions:
- Annex III high-risk systems: December 2, 2027.
- Annex I high-risk systems: August 2, 2028.
Have the legal and system owners establish the classification and applicable transition before a launch. A general literacy course cannot substitute for that assessment.
Enforcement also needs the right source. Article 99 requires Member States to establish penalties and enforcement measures. Article 4 is not among the infringements listed in its fixed EU fine tiers. That does not make the literacy duty optional or establish that there can be no national penalty. Check the relevant national rules and authority rather than attaching the Act’s largest headline fine to every training omission.
Before purchasing a program, take one real AI use to the people responsible for law, policy and learning. Agree the applicable obligation, the people it covers and the support it calls for. Then ask a provider how its material serves that need. For the wider arrangement around approved tools, review and ownership, return to the tools and workflows guide.
Questions about EU AI literacy requirements
Did the Digital Omnibus remove the AI literacy duty?
No. Since July 27, 2026, Article 4 requires providers and deployers to take measures supporting AI literacy development, while expressly removing any obligation to guarantee a specific level for an individual. The Commission and Member States have supporting duties too. Check the amended wording when reviewing an older policy or course description.
Does ordinary chatbot use at work count?
It can. Article 4 is not restricted to high-risk systems. A company using an AI assistant under its authority can be a deployer, and the Commission’s guidance includes drafting advertising copy and translation. Establish the Act’s scope for that activity, then provide support suited to the tool, users and risks. The activity and people review is the place to start.
Must employees earn a certificate or pass an annual exam?
Article 4 does not mandate a certificate or an annual exam. The Commission also says employee knowledge measurement is not required by Article 4. A course or assessment may still be useful for a particular responsibility, but its vendor should distinguish that recommendation from a legal requirement. Ask what it teaches for your actual system and what its completion record demonstrates.
Does an EU customer bring all our AI use into scope?
An EU customer alone does not answer that question. Article 2 includes EU-based deployers, providers bringing systems to the EU market or into service there, and third-country providers or deployers whose system output is used in the EU. Map the specific activity and output destination with the legal owner, including relevant exclusions. Avoid both a blanket company-wide conclusion and an assumption that non-EU headquarters settle the matter.
Can we stop literacy work until the high-risk rules apply?
The high-risk timetable does not postpone Article 4. Chapter I began applying in February 2025, and its amended literacy duty is current. Keep suitable literacy measures going while separately checking the classification, application dates and oversight requirements for any high-risk system. The separate-obligations section explains why one training deadline cannot represent the whole Act.
