Article 4: what the text actually says, and what it means for your organisation.

Article 4 was rewritten on 27 July 2026. The obligation remains, but it no longer targets a level to reach: it targets measures to take.

Regulation (EU) 2026/1744 of 8 July 2026, known as the Digital Omnibus on AI and published in the Official Journal of the European Union on 24 July 2026, replaced Article 4 of Regulation (EU) 2024/1689 in its entirety.

As it now stands, the article provides that providers and deployers of AI systems take measures to support the development of AI literacy among their staff and other persons dealing with the operation and use of those systems on their behalf, taking into account their technical knowledge, experience, education and training, as well as the context in which the systems are to be used.

The previous wording required ensuring, to their best extent, a sufficient level of literacy. That requirement is gone. The European Commission confirms it: AI literacy remains an obligation, but no level, specific or sufficient, is imposed; an organisation does not have to guarantee a level for a given person.

Three elements resist that simplification. The obligation is still assessed against each person's role and the context of use. The Commission and the Member States must publish practical examples of compliance, and the European Artificial Intelligence Board must adopt recommendations setting common objectives. Finally, organisations deploying high-risk systems remain required to train the staff in charge of human oversight.

Only one of these three dates creates immediate exposure.

2 February 2025. Article 4 becomes applicable. It is the first obligation of the regulation to take effect.

2 August 2026. National market surveillance authorities exercise their supervision and sanction powers. Article 4 provides no sanction of its own: consequences fall under the national regimes adopted by the Member States.

27 July 2026. Regulation (EU) 2026/1744 enters into force. It amends Article 4 and postpones the obligations on high-risk systems under Annex III to 2 December 2027, and those under Annex I to 2 August 2028. Article 4 was not postponed.

The Commission recalls that any sanction must remain proportionate and be assessed case by case, according to the nature and gravity of the breach and whether it was intentional or negligent. It specifies that consequences become more likely when an incident stems from a failure in training or supervision. The risk is therefore not an isolated fine for lack of literacy. It is the absence of a file on the day of an inspection or an incident.

Three proofs are expected, and none can be bought off the shelf: knowing which systems are used, having taken measures consistent with roles and contexts of use, and being able to document it. To that end the European Commission publishes a four-step analysis structure.

• establish a general understanding of AI in the organisation: what AI is, how it works, which systems are used here, what opportunities and dangers they present;
• determine the role of the organisation: does it develop AI systems, or use systems developed by others;
• consider the risk of the systems provided or deployed: what must the people using them know, which risks must they be aware of, and do they know the mitigation measures;
• build literacy actions on that analysis, taking into account differences in people's technical knowledge, experience, education and training, the context of use and the persons in respect of whom the systems are used.

Three Commission clarifications are worth knowing. Article 4 imposes no obligation to measure employees' knowledge. No certificate is required: an internal register of training and other initiatives is enough. No particular governance structure is imposed.

This is where generic training reaches its limit. One identical session for everyone demonstrates no consistency with roles or contexts of use. The demonstration requires starting from actual usage, occupation by occupation.