AI literacy under Article 4 of the AI Act: what still applies after the Digital Omnibus

Article 4 of the EU AI Act is the obligation with the widest reach. It applies to every organization that uses an AI system professionally, even if that system falls into no risk class at all. The duty has existed since 2 February 2025. The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) has softened the text, and since August 2026 national authorities can supervise it. This article describes what the text now says, what the European Commission sees as the minimum, which evidence to keep and how to place the duty in an AI management system under ISO 42001.

What Article 4 requires since the Digital Omnibus

Under the original text, providers and deployers had to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff. That read as an obligation of result, and what counted as sufficient was left open.

The Digital Omnibus has turned it into an obligation of means. Providers and deployers take measures to support the development of AI literacy of their staff and of other persons who work with AI systems on their behalf. In doing so they take into account technical knowledge, experience, education and the context in which the systems are used. The new text states explicitly that no specific level of literacy has to be guaranteed for any individual. A second paragraph gives the Commission and the Member States the task of supporting organizations in this, with particular attention to SMEs. The amended text has applied since 27 July 2026, without a transition period.

What AI literacy means is set out in Article 3(56): the skills, knowledge and understanding that allow you to deploy AI systems in an informed way and to be aware of the opportunities, the risks and the possible harm. That definition has not changed.

In practice less changes than it seems. The duty has not been removed, and an organization that does nothing does not meet the softened text either. What disappears is the expectation that you can demonstrate a level per employee. What remains is that you must be able to show which measures you took and why they fit the people and systems in your organization. What else the Omnibus shifts is covered in the article on the Digital Omnibus and the new deadlines.

Who the duty applies to

Article 4 applies to providers and deployers of all AI systems, regardless of risk class. It is not a high-risk requirement. An organization that uses an AI feature in its office software, has a chatbot on its website or lets staff work with a generative AI tool falls within it. Only use in a personal, non-professional activity falls outside the definition of deployer (Article 3(4)).

The circle of persons is wider than your own employees. According to the questions and answers the Commission published in May 2025, it also includes contractors and service providers who work with AI systems on the organization's behalf. If you let a temporary worker or an external agency work with an AI tool, include them in the approach, for example through contractual arrangements.

You only know which systems are involved once you have an overview. An inventory, including AI features that suppliers have added to existing software without being asked, is therefore the first step. How to set one up is covered in mapping shadow AI for ISO 42001.

Supervision and enforcement

According to the Commission, national market surveillance authorities supervise Article 4 from August 2026. Article 99 of the AI Act sets no specific maximum fine for Article 4, unlike the maximums it sets for prohibited practices and for a range of other obligations. Penalties are up to the Member States. In the Netherlands the AI Act implementation bill (Uitvoeringswet AI-verordening), which designates the authorities, was still a draft out for advice in summer 2026. The Dutch Data Protection Authority (AP) and the Dutch Authority for Digital Infrastructure (RDI) get a coordinating role in it.

We advise against treating Article 4 as a separate fine risk. The duty mainly comes into view when something goes wrong: an incident with an AI system, a complaint or an investigation into another part of the AI Act. The question then is which measures the organization had taken for the people who used the system. An organization that can answer with records is in a stronger position than one that has to reconstruct it afterwards.

What the Commission sees as the minimum

The Commission does not prescribe a programme, but its questions and answers name four points an approach should at least address. A general understanding of AI within the organization. The organization's role, as provider or as deployer. The risk of the AI systems in use. And alignment with the technical knowledge of staff and the context of use.

Two points from the same document are useful in practice. Staff who use generative AI for translations or texts, for example, need to know the specific risks, such as fabricated output (hallucinations). And according to the Commission, merely pointing to a system's instructions for use is usually not enough. A certificate is not required; internal records of training and other measures are sufficient.

An approach per role group

A workable approach divides the organization into role groups and decides per group what is appropriate. For most employees it is about the basics: what the AI systems in their work do, where they make mistakes, which data must not go into them and what the internal AI policy says. Staff who take decisions based on AI output, for example in assessments or selection, need more: how to check an output, when to depart from it and how to record that. Developers and administrators need technical knowledge of data, testing and monitoring. Board members need enough understanding to weigh risks and investments against each other.

For high-risk systems Article 26(2) comes on top: the deployer assigns human oversight to people with the necessary competence, training and authority. That requirement is stricter than Article 4 and applies per person. For high-risk AI under Annex III it takes effect on 2 December 2027 following the Omnibus.

What to record as evidence

Because the duty is one of means, the evidence consists of the measures and the reasoning behind them. In an assessment we expect at least an overview of the AI systems and the role groups that work with them, the measures chosen per role group and why they fit, the AI policy or a usage guideline, records of who completed which training or instruction, and a fixed moment at which the approach is reviewed, for example when a new system is added.

A common pitfall is buying an e-learning course without being able to explain which systems and roles it is meant for. A general course on what AI is covers the Commission's first point. Role, risk and context are then left untouched.

How it fits into ISO 42001

An organization with an AI management system under ISO 42001 already has the building blocks. Clause 7.2 requires you to determine which competences are needed for work that affects the AI systems, to ensure them demonstrably and to evaluate whether actions taken are effective. Clause 7.3 requires everyone working under the organization's control to know the AI policy, their own contribution and what non-compliance means. Control A.4.6 in Annex A asks you to document information on the human resources for AI systems.

The competence matrix, training plan and awareness programme from the AIMS therefore also serve as evidence for Article 4. Two additions are needed. ISO 42001 looks at people working under the organization's control, while Article 4 also names other persons who work with AI on the organization's behalf, so include external people explicitly. And record in the AIMS that the literacy measures also serve to meet Article 4, so an auditor or supervisor sees the link. Both clauses are worked out in competence and awareness in the AIMS. If you want support setting up or testing your AI governance, see our compliance services.