What AI literacy actually requires

What does the obligation say?

Article 4 is short, and it changed recently. Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced it in full with effect from 27 July 2026. Providers and deployers must take measures that support the development of AI literacy among their staff and other people operating AI systems on their behalf, including contractors.

The wording matters. The original text required you to take measures to ensure, to your best extent, a *sufficient level* of AI literacy. The current text does not: it is a duty of effort, and it does not require you to guarantee that any individual has reached any particular standard. The measures must still reflect those people's technical knowledge, experience, education and training, the context of use, and who the systems are used on.

Most published guidance still quotes the repealed wording. If a supplier is selling you compliance against a "sufficient level" standard, they are working from a version of the article that is no longer in force.

What does it not require?

This is where most of the confusion, and most of the selling, happens.

• No mandated curriculum. The Act does not specify content.
• No guaranteed outcome. Since 27 July 2026 the duty is to support development, not to certify that anyone has reached a standard.
• No examination or certification. There is no exam to pass and no certificate that constitutes compliance.
• No appointed role. Article 4 does not require an AI officer, a training manager, or any named position.
• No single standard for everyone. A uniform course delivered to all staff regardless of role is arguably the wrong shape, not the safe one.

What exactly changed on 27 July 2026?

The practical effect is that a company acting in good faith with a documented, proportionate approach is on considerably firmer ground than the original text suggested, without the underlying obligation disappearing.

Who counts as "operating an AI system on your behalf"?

Wider than most companies initially assume, and the boundary matters for scoping the measures correctly.

• Your own employees, obviously, wherever they touch an AI system as part of their role.
• Contractors and freelancers working inside your systems, even short-term ones.
• Outsourced functions using AI on your data, such as a support desk provider using AI tooling against your customer records.
• Agency or temporary staff, if they operate the systems rather than merely receiving output from them.

What falls outside your scope is a vendor's own staff operating the vendor's system on the vendor's infrastructure. That is the vendor's Article 4 duty as a provider, not yours as a deployer, though it is reasonable to ask a vendor how they meet it.

What does "proportionate" actually mean for a company your size?

The Regulation calibrates on technical knowledge, experience, context of use and who is affected, not on headcount, but headcount still changes what proportionate looks like in practice.

A twenty-person company running one well-understood AI tool needs a short, specific briefing for the handful of people who touch it. A five-hundred-person company running a dozen systems across different functions needs a segmented programme with different content for each group and a way of tracking who has received what. Applying the large-company version to the small company is wasted effort; applying the small-company version to the large one leaves most of the actual exposure uncovered.

How is this different from having an AI policy?

The two get bundled together and they answer different questions. AI literacy under Article 4 is about capability: whether the people operating a system understand what it does, how it fails, and when to escalate. An AI policy is about rules: what staff may and may not do with AI tools.

In practice you need both, and they reinforce each other. Literacy without a policy leaves people knowledgeable but unconstrained. A policy without literacy produces rules nobody understands well enough to apply to a situation the policy did not anticipate. See how to write an AI policy for your company for the policy side of this.

What does compliance look like in practice?

1. Establish who operates AI systems on your behalfStaff and contractors. This list is usually longer than expected once unapproved tools are counted.
2. Segment by what they actually need to understandSomeone acting on an AI output needs to understand its failure modes. Someone building the system needs considerably more.
3. Cover capabilities, limitations and oversightWhat these systems are good at, how they fail, why outputs need checking, and when to escalate.
4. Make it specific to the systems you actually runGeneric AI awareness training is weak evidence. Training on the systems in your own business is strong evidence.
5. Document what you didWhat was delivered, to whom, when, and the reasoning for the segmentation. Documentation is the evidence, not the training itself.

Where should a first programme start, if you have nothing in place yet?

Not with a company-wide course. Start narrower and build outward.

1. The highest-exposure system first. Whichever AI tool touches customer data or customer-facing decisions gets covered before anything internal-only.
2. The people who act on its output, not everyone adjacent to it. A smaller, correctly targeted group beats a large, loosely targeted one.
3. One page of what must never be entered into it, specific to that system, before any broader literacy content.
4. A short session on how that specific system fails, not a general introduction to artificial intelligence.
5. Extend to the next system once the first group is covered, rather than running one enormous rollout across everything at once.

This produces documented, targeted coverage of your actual highest exposure within weeks, which is stronger evidence than a slower, broader rollout that takes months to reach the same system.

Sources, and a necessary caveat

• Regulation (EU) 2024/1689 (the AI Act), Article 4.
• Regulation (EU) 2026/1744, the Digital Omnibus on AI, published 24 July 2026 and in force 27 July 2026, which replaced Article 4 in full.

Why does the documentation matter more than the course?

Article 4 has no prescribed format, which means there is no box to tick that proves compliance. What you are left with is the ability to demonstrate a reasoned, proportionate approach.

In practice the question does not usually arrive from a regulator. It arrives in a procurement questionnaire, an insurer's renewal form, or an enterprise customer's due diligence pack, and it is phrased as "describe your AI literacy measures". A company that can answer with a segmented, documented, systems-specific approach clears that gate. A company holding a generic completion certificate often does not.

Frequently asked questions

Related