OneRange

EU AI Act AI Literacy: What Article 4 Now Requires of Employers

· 9 min read · OneRange Research

EU enforcement of the AI Act's AI literacy rule began August 2, 2026, after the Digital Omnibus rewrote it. What Article 4 asks of employers now.

Data card: EU enforcement of the AI Act's AI literacy requirement began August 2, 2026, after the Digital Omnibus rewrote Article 4

For most of 2025, the AI Act's AI literacy rule was easy to ignore. It had applied since February 2, 2025, but nobody was checking. That changed on August 2, 2026, when supervision and enforcement began, and a week earlier the EU rewrote the rule itself.

If your company uses ChatGPT, Copilot, Claude, Gemini, or any AI feature inside your software, and any of that use touches the EU, this applies to you. Here is what changed, what it means in practice, and how to show a regulator you took it seriously.

What Article 4 says, before and after the Digital Omnibus

The original Article 4 told providers and deployers to "take measures to ensure, to their best extent, a sufficient level of AI literacy" of their staff and anyone operating AI on their behalf, taking into account their knowledge, experience, and the context the AI is used in.

The Digital Omnibus, Regulation (EU) 2026/1744, was published in the Official Journal on July 24, 2026 and entered into force on July 27. It replaced that wording. Employers must now "take measures to support the development of AI literacy" of the same people, and the text says outright that this does not require guaranteeing any specific level of AI literacy for any individual.

Original Article 4 (2024)Article 4 after the Digital Omnibus (2026)
Core dutyTake measures to ensure, to their best extent, a sufficient level of AI literacyTake measures to support the development of AI literacy
StandardCloser to an obligation of resultAn obligation of effort; no guaranteed level required
Who it coversStaff and others operating or using AI on the organization's behalfUnchanged
Support from the EUNot specifiedCommission and Member States must support organizations, especially SMEs, and publish practical examples

Read that carefully. The Omnibus did not delete the duty or hand it to governments. It lowered the bar from "make sure they are literate" to "make a genuine effort to build literacy." An effort still has to be visible, and the easiest way to show an effort is a record of it.

The timeline that matters

DateWhat happened
August 1, 2024The AI Act entered into force
February 2, 2025Article 4 (AI literacy) and the prohibited-practices rules began to apply
August 2, 2025Governance and penalty provisions applied; Member States had to name authorities and set national penalty rules
July 27, 2026The Digital Omnibus entered into force, rewriting Article 4 and delaying the high-risk rules
August 2, 2026National market surveillance authorities began supervising and enforcing AI literacy
December 2, 2027New date for most stand-alone high-risk AI obligations
August 2, 2028New date for high-risk AI embedded in regulated products

The delay to the high-risk rules got most of the headlines. The AI literacy duty was not delayed. It is the one obligation that already applies to almost every company using AI at work.

Key dates

DateWhat happenedWhat it means for employers
August 1, 2024AI Act in forceObligations phased from here
February 2, 2025Article 4 AI literacy appliesDuty exists, no enforcement
July 24, 2026Digital Omnibus (Regulation (EU) 2026/1744) published, in force July 27, 2026Wording changes to "support the development of AI literacy"
August 2, 2026National supervision and enforcement beginsRegulators can act

Does it apply to your company?

Article 4 applies to providers (organizations that build AI systems) and deployers (organizations that use them). If your employees use a chatbot or an AI feature at work, your company is a deployer. The rule is not limited to high-risk AI.

The European Commission's AI literacy Q&A says the AI Act applies inside and outside the EU as long as an AI system is placed on the EU market, used in the EU, or its use affects people located in the EU. In practice, a US company should assume the duty covers:

  • Employees based in the EU who use AI tools at work
  • AI-assisted work whose output is used in the EU, such as customer communications, content, or decisions about EU residents
  • Contractors and partners who use AI systems on the company's behalf

Purely internal US use with no EU connection is likely out of scope. If you are unsure where the line falls for you, that is a question for counsel. This article is not legal advice.

Can you be fined?

Not directly at EU level. Article 99 of the AI Act sets fixed fine tiers of up to 35 million euros or 7% of turnover, but Article 4 is not on that list. That does not make it toothless:

  • Member States can set their own penalties and enforcement measures, including warnings and non-monetary measures, and those rules vary by country
  • Law firms including Travers Smith expect a lack of AI literacy to be treated as an aggravating factor when regulators investigate other AI Act breaches
  • A missing training record is a weak position in any dispute about harm caused by an employee's use of AI

It is still unclear whether a gap from before August 2, 2026 can be penalized. The safest assumption is that regulators will look at what you are doing now.

What the Commission says good AI literacy looks like

The Commission's AI literacy Q&A is the most practical guidance available. Its minimum approach asks organizations to consider four things:

  1. A general understanding of AI: what it is, how it works, and where it goes wrong
  2. The organization's role: whether it provides AI systems, deploys them, or both
  3. The risks of the specific AI systems in use
  4. The knowledge gaps of the people using them, including legal and ethical aspects

Three more points from the guidance matter for L&D teams:

  • Training can be role-based and set at different levels for different staff. A marketer drafting copy and an analyst feeding customer data into a model do not need the same course
  • There is no need for a certificate. Organizations can keep an internal record of trainings and other guiding initiatives
  • Relying on instructions for use, or asking staff to read them, might be ineffective

The Commission also keeps a living repository of AI literacy practices from companies. It notes that copying those examples does not automatically mean you comply. The test is whether your approach fits your people and your AI use.

Most companies are not ready

  • 60% — Leaders who cite internal AI skill gaps (DataCamp/YouGov, 2026)
  • <50% — Companies providing basic data or AI literacy training (DataCamp/YouGov, 2026)
  • 36% — Employees who feel adequately trained on AI (BCG AI at Work 2025)

A DataCamp/YouGov survey of 517 US and UK leaders found 60% cite internal AI skill gaps, and fewer than half provide even basic data or AI literacy training. BCG's survey of more than 10,600 workers found only 36% feel adequately trained. For most companies, the honest answer to "what measures have you taken?" is still "we bought licenses."

A five-step AI literacy program you can defend

  1. Map who uses which AI systems. List the tools, the teams using them, and what data goes in. This defines your scope and your risk tiers
  2. Set a baseline. Assess current AI fluency by role before you train, so you know where the gaps are and can show progress later. Our free AI fluency assessment is a starting point
  3. Train by role and risk. Give everyone a shared foundation, then add role-specific training for the tools and decisions each team handles. Cover responsible use, data handling, and checking AI output. Teams using AI agents need more; see how to train employees on AI agents
  4. Keep a record as you go. Log who was trained, when, on what, and how they did. The Commission does not require a certificate, but a record is the clearest evidence of effort
  5. Repeat as your AI use changes. New tools and new use cases mean new training. Treat AI literacy as an ongoing skill, not a one-time module

For the foundation layer, our AI fluency guide explains the core skills in plain language. For the responsible-use layer, the responsible AI training track covers governance, risk, and policy.

AI literacy compliance checklist

  • List every AI tool in use, the teams using it, and what data goes in
  • Sort tools and teams into risk tiers to set your scope
  • Assess current AI fluency by role before any training starts
  • Record baseline results so you can show progress later
  • Give everyone a shared foundation in AI, responsible use, and data handling
  • Add role-specific training for the tools and decisions each team handles
  • Log who was trained, when, on what, and how they did
  • Keep that record internal and current; no certificate is required
  • Review training whenever a new AI tool or use case arrives
  • Schedule refreshers so AI literacy stays an ongoing skill, not a one-time module

How OneRange Vero helps

Vero is interactive AI training. Instead of a video and a quiz, each employee works through a conversation that adapts to their role, their answers, and your company's own policies and material.

  • Role-based by design: assign different courses and assessments to different teams from a catalog of ready-made AI training, or build your own from your AI policy
  • Skill assessments that place each person at Beginner, Intermediate, Advanced, or Expert for each skill, with strengths and areas for improvement
  • Results on every employee's skill profile and in Workforce Results, so you have a running record of who was trained, when, and where they landed

That record will not make you compliant by itself. No product can. It does give you what Article 4 now asks for: evidence of a real, ongoing effort matched to each person's role.

Sources

Tags: AI, AI Fluency, Compliance, Learning & Development

FAQ

Frequently asked questions

Is AI literacy training mandatory under the EU AI Act?

Yes. Article 4 requires every provider and deployer of an AI system to take measures to support the AI literacy of staff who operate or use AI on its behalf. Since the Digital Omnibus took effect on July 27, 2026, employers no longer have to guarantee a specific literacy level, but they do have to make a real, ongoing effort.

Does Article 4 apply to US companies?

It can. The European Commission says the AI Act applies inside and outside the EU when an AI system is used in the EU or its use affects people located in the EU. A US company with staff, offices, or customers in the EU should assume the obligation applies to that use.

Do employees need an AI literacy certificate?

No. The Commission's AI literacy Q&A says there is no need for a certificate and that organizations can keep an internal record of trainings and other guiding initiatives.

Can a company be fined for not training employees on AI?

Article 4 is not listed in the AI Act's fixed EU-level fine tiers. From August 2, 2026, national market surveillance authorities can supervise and enforce it under national rules, and weak AI literacy can count against a company when regulators look at other breaches.

Is one general AI course enough to comply?

Probably not on its own. The Commission's guidance points to training that reflects each person's role, the AI systems they use, and the risks involved. It also warns that simply asking staff to read instructions for use may be ineffective.

Did the Digital Omnibus remove the AI literacy obligation?

No. Regulation (EU) 2026/1744 softened the standard from ensuring a sufficient level of AI literacy to supporting its development, and added a duty for the Commission and Member States to help. The obligation still sits with the employer.

What counts as sufficient AI literacy under Article 4?

There is no fixed level. The Commission's minimum approach covers a general understanding of AI, the organization's role as provider or deployer, the risks of the specific AI systems in use, and the knowledge gaps of the people using them. Training can be role-based, and an internal record replaces any certificate.

Is there a deadline for AI literacy training under the EU AI Act?

The deadline has passed. Article 4 has applied since February 2, 2025, and national market surveillance authorities began supervising and enforcing AI literacy on August 2, 2026. The Digital Omnibus delayed the high-risk rules, but not the AI literacy duty.

Related