AI literacy at work: what Article 4 asks after the Digital Omnibus
AI literacy under Article 4 of the EU AI Act now requires a company that uses or supplies AI systems to take measures to support its staff's AI literacy, matched to what each person does with those systems. Since the Digital Omnibus, the law no longer requires anyone to guarantee a specific level of knowledge for any individual.
Updated: 23 October 2026 · Deibson Silva · Forward Deployed AI Engineer and Founder
What does Article 4 of the AI Act say today?
Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, replaced Article 4 of Regulation (EU) 2024/1689. It was published in the Official Journal on 24 July 2026 and entered into force three days later, on 27 July 2026.
The new wording says that providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff and of other persons dealing with the operation and use of AI systems on their behalf.
Those measures must take into account each person's technical knowledge, experience, education and training, the context the systems are used in, and the people they are used on.
It also adds a sentence that was not there before: the obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.
The same Article asks the Commission and the Member States to support companies, in particular SMEs, and asks the Commission to publish practical examples of how to comply on the Act's single information platform.
What did the Digital Omnibus change in Article 4?
The obligation still exists. What changes is what is required and who helps you meet it.
| 2024 wording | Wording from 27 July 2026 | |
|---|---|---|
| What it asks | Measures to ensure, to their best extent, a sufficient level of AI literacy of staff | Measures to support the development of AI literacy of staff |
| Level of knowledge | A "sufficient" level, not defined | None in particular: the law expressly says it does not require one to be guaranteed |
| Who it covers | Staff and other persons operating and using the systems on the company's behalf | The same people |
| What is taken into account | Knowledge, experience, education, training, context of use and the people affected | The same criteria |
| Public support | Not provided for in the Article | The Commission and Member States support companies, especially SMEs, and the Commission publishes practical examples |
What is AI literacy, according to the Act itself?
Article 3(56) defines it as the skills, knowledge and understanding that allow an informed deployment of AI systems and an awareness of their opportunities, their risks and the harm they can cause.
It does not talk about coding. It talks about using AI while knowing what it does, where it gets things wrong, which data must never go into it and who is affected by what it produces.
That is why a reasonable measure is not the same for everyone: someone using an assistant to draft emails needs something different from someone overseeing a system that screens job applications, or from the person who signs off on buying it.
Does Article 4 apply to a UK company?
It can. Under Article 2, the AI Act applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers outside the EU when the output of the system is used in the EU.
So a UK firm whose AI-assisted service or product is used by clients in the EU falls within the Act for that activity, Article 4 included.
Inside the UK, data protection is covered by the UK GDPR, and the ICO's guidance on AI and data protection explains what it expects. The ICO says that guidance is under review after the Data (Use and Access) Act.
How does a company comply with Article 4?
An orderly way to do it, without turning it into paperwork:
- 1Take stock of the AI systems used in the company, including the general-purpose assistants that staff use on their own initiative.
- 2Note who uses each system, for what and on whom: summarising internal documents is not the same as assessing people.
- 3Give everyone who uses AI a short session on what the tool does, its typical mistakes, which data never goes in and when the output must be checked.
- 4Give specific training to whoever oversees high-risk systems: Article 26 requires that oversight to sit with people who have the necessary competence, training and authority.
- 5Write a short, clear acceptable-use policy: permitted tools, forbidden data, compulsory human review and who to tell when something goes wrong.
- 6Keep a record of what you do: who was trained, on what and when. The law does not prescribe a register, but it is how you show that you took measures.
- 7Review the measures whenever the system or its use changes, and check the practical examples the Commission publishes.
Article 4 has applied since 2 February 2025; the new wording since 27 July 2026.
What does each person in the company need to know?
One Article, four different needs:
People who use AI in their work
What the tool does and does not do, how to check what it produces, which client or personal data never goes in, and when to say that a text or an answer comes from an AI.
People who oversee a high-risk system
How the system works, when to step in or stop it and how to document it. Annex III systems, such as those used in hiring, have their obligations from 2 December 2027.
The board and senior leaders
Which cases deserve AI, how each one is measured, who answers for each system and what the law requires, with Articles and dates. They decide, and they answer for it.
People who build the AI
All of the above, plus the craft: measuring with evals, attacking the system before release, documenting its AI Act sheet and leaving it in the company's hands.
Which other rules touch on AI training?
Article 50 has applied since 2 August 2026: people talking to an AI system must be told it is an AI, unless that is obvious. Staff who set up an assistant for clients need to know that rule.
Data protection is unchanged: Article 22 of the GDPR, and of the UK GDPR, protects people from decisions based solely on automated processing, and Article 35 requires an impact assessment when processing with new technologies is likely to result in a high risk.
None of these rules requires a specific qualification. What they ask is that the company knows what it uses, who oversees it and with what judgement.
Where does executive education fit?
Staff AI literacy is usually handled with short training adapted to each tool. What cannot be handled in a few hours is the judgement of the people who decide on AI and answer for it.
That is what the SciTechBiz Institute's advanced executive programmes are for. Applied Intelligence · AI and Cyber Behaviour covers human governance of AI models, behavioural security and institutional policy on responsible use, for CTOs, CIOs and heads of AI.
And for whoever has to build AI inside the company, the Forward Deployed Engineer Certification teaches the craft, with the EU AI Act at every stage.
Training for decision-makers
- Executive AI education for senior leadersWhat to look for before choosing.
- The 7 advanced executive programmesCommon structure, tracks and terms.
- Applied Intelligence · AI and Cyber BehaviourFor technology leaders and heads of AI.
- SciTechBiz Institute certificationsDigital Entrepreneur, Organizational Consultant and FDE.
Honest limits
- This article explains the rule; it is not legal advice on any specific system.
- The EU AI Act changed in 2026: always check dates against the official text in force.
- No SciTechBiz Institute training is a legal requirement under Article 4, and neither is anyone else's: the law asks for measures, not a qualification.
- The SciTechBiz Institute is not a university: its certifications and advanced executive programmes are awarded by the Institute itself and are not recognised by any education authority.
What people ask most
01Is AI literacy still mandatory after the Digital Omnibus?
Yes. Article 4 still requires providers and deployers to take measures to support their staff's AI literacy. What has gone is the requirement to ensure a sufficient level of knowledge for each person.
02Do staff need an AI literacy certificate?
No. Article 4 does not require any certificate or qualification. It asks for measures matched to who uses each system and for what. Keeping a record of training is the practical way to show that measures were taken.
03Who does Article 4 cover?
The company's staff and other persons dealing with the operation and use of its AI systems on its behalf, such as external contractors who run them for the company.
04Does it apply to a UK business?
When the business places AI systems on the EU market, or when the output of its AI system is used in the EU (Article 2). For UK data protection, the UK GDPR and the ICO's guidance on AI apply alongside it.
05Since when does it apply?
Article 4 has applied since 2 February 2025. The wording set by Regulation (EU) 2026/1744 has applied since it entered into force on 27 July 2026.
Sources
- Regulation (EU) 2026/1744, the Digital Omnibus on AI (EUR-Lex): new Article 4, Article 111 and the Article 113 timeline · accessed 23 October 2026
- Regulation (EU) 2024/1689, the AI Act (EUR-Lex): Articles 2, 3, 26 and 50 and Annex III · accessed 23 October 2026
- Regulation (EU) 2016/679, the GDPR (EUR-Lex): Articles 22 and 35 · accessed 23 October 2026
- ICO, Guidance on AI and data protection · accessed 23 October 2026
Founder of Legathum and iPersonality and Forward Deployed AI Engineer. He leads the SciTechBiz Community from Madrid and examines the FDE Certification defence.
See it with your own case
A 15-minute call with Deibson Silva to see the platforms with what you do and answer your questions.
iPersonality Global Institute, S.L. · NIF B27580042 · Madrid · Privacy policy
Prices in euros, exclusive of VAT. In Spain, Spanish VAT is added. In the rest of the EU, VAT is calculated at payment according to your country and VAT number. No Spanish VAT is charged to UK customers.