Article 4 of the EU AI Act was amended in 2026. Organisations that provide or deploy AI systems still have to act on AI literacy, but the law no longer asks for a "sufficient level", and it does not ask for a certificate. This guide explains what changed and what proportionate measures can look like.
This is not legal advice. Last checked: 12 November 2026.
Article 4 in plain English
If your organisation builds or uses AI systems in its work, it has to take measures that help its people understand AI well enough for their role. The measures should fit what those people already know and how the AI is used, and take into account the people the AI is used on.
This is the first paragraph of the amended article:
Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.
The second paragraph asks the Commission and the Member States to support providers and deployers, in particular SMEs, and the Commission will publish practical examples. The third asks the European AI Board to adopt recommendations that take European competence frameworks into account.
What changed with the Digital Omnibus
The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, and Article 4 has applied since 2 February 2025. In 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, replaced the text of Article 4.
The original wording asked organisations to take measures to ensure, to their best extent, a sufficient level of AI literacy. That standard is gone. The duty is now to take measures, and the Commission's questions and answers state that no specific or "sufficient" level is mandated.
Recital 8 of the Omnibus explains why: strict obligations did not suit every provider and deployer and created a burden, particularly for smaller enterprises. They also name DigComp and the AI Literacy Framework for Primary and Secondary Education as frameworks the Commission and Member States could take into account.
Who it applies to
Article 4 binds organisations in two roles:
- providers, who develop an AI system and place it on the market or put it into service under their own name;
- deployers, who use an AI system under their authority in a professional context. If your staff use AI tools in their work, your organisation is likely to be a deployer.
The duty covers staff and other people who deal with AI systems on the organisation's behalf, such as contractors. It is not a rule about employers or training providers as such: a training provider is covered because it provides or uses AI itself, not because it trains others. Deployers of high-risk AI systems have separate training duties for the people who oversee those systems (Article 26).
What 'measures' can look like
The Commission suggests a minimum approach in four steps:
- Make sure there is a general understanding of AI in the organisation.
- Consider your role: provider, deployer or both.
- Consider the risks of the AI systems you provide or use.
- Build your actions on that analysis, taking into account what staff already know and the context of use.
There is no one-size-fits-all approach, and the Commission warns that relying only on the instructions for use may not be enough. In a small organisation, measures could be a short session for each role, simple written rules on which tools may be used and which data may go into them, practice with realistic tasks, and a note of who took part in what.
For ideas, the AI Office keeps a living repository of more than 40 AI literacy practices from organisations. Copying one does not by itself mean an organisation has met Article 4, but it is a useful starting point.
The AI Pact (European Commission) is another source. It is a Commission initiative that helps organisations prepare for the AI Act. Its network is open to any organisation, and companies of any size that provide or deploy AI can make voluntary pledges. One of the three core pledges is to promote the AI literacy of staff. The pledges are not legally binding, and there is no AI Pact logo or badge.
We apply the same thinking to our own work: read how we use AI ourselves.
No certificate, no fixed level
The Commission is clear: there is no need for a certificate, and there is no obligation to measure what staff know about AI. An internal record of trainings and other initiatives is enough.
So a course that promises an "AI Act certificate" offers something the law does not ask for. EU AI Act training can be a useful measure, but its value lies in what people learn, not in the paper.
National market-surveillance authorities supervise and enforce Article 4 from 2 August 2026, with what the Commission calls a proportionate approach. Small organisations can get help from the European Digital Innovation Hubs and from the AI Skills Academy, which has operated since 1 May 2026.
If you are looking for an AI literacy framework for adults, DigComp 3.0 builds AI into all 21 of its competences. The EU and OECD framework is written for primary and secondary education. The details are in our article on DigComp 3.0 and AI competences.
Dates to know
| Date | What applies |
|---|---|
| 1 August 2024 | The AI Act enters into force. |
| 2 February 2025 | Article 4 (AI literacy) and the prohibitions in Article 5 apply, including the ban on inferring the emotions of people at work or in education, except for medical or safety reasons. |
| 2026 | The Digital Omnibus on AI amends Article 4. |
| 2 August 2026 | Most of the Act applies. National market-surveillance authorities supervise and enforce it, AI literacy included. |
| 2 December 2027 | High-risk rules for the uses listed in Annex III apply. In education and vocational training these include AI used to decide on access or admission, to evaluate learning outcomes or steer learning, to assess the level of education a person needs, or to monitor students during tests. |
Where scenario-based practice fits
Reading about AI is not the same as working with it. A practice scenario lets staff use an AI assistant on a realistic task, notice an answer that sounds right but is wrong, decide what to check, and see what happens next. A short reflection and a second try make the lesson stick.
Such a scenario lines up with DigComp 3.0, which says that AI output can be inaccurate yet plausible and that the person using it is responsible for checking it. Mapping a scenario to statements like this makes a measure easier to describe and to record. See how our work maps to EU competence frameworks.
Keep it proportionate: short scenes per role, the option to replay, and a simple record of who took part.
We design scenario-based learning, serious games and VR and AR simulations, and AI-literacy scenarios like this are something we can design with partners. Read about our approach to AI literacy and applied AI in learning, including what we do not build: AI that grades learners without a person making the decision, and emotion recognition. If you want to discuss a measure for your organisation or your consortium, contact us.
Sources and last check
- AI literacy questions and answers (European Commission), last updated 20 October 2026.
- AI Pact (European Commission), last updated 29 October 2026.
- Regulation (EU) 2026/1744 on EUR-Lex, the Digital Omnibus on AI.
Last checked: 12 November 2026. This article explains the rules in plain language. It is not legal advice: for decisions about your organisation, check the official text or ask a lawyer.
