"AI literacy" is one of the first provisions of the EU AI Act to take effect, together with the prohibitions. Article 4 of the Act asks organizations that develop or use AI systems to take steps to equip their employees in this area. The article was rewritten by the amending regulation that entered into force in summer 2026 (the AI Omnibus).
This article compares the old and new text of Article 4 using primary sources, summarizes the explanations in the European Commission's Q&A document, and outlines how a company can structure its AI literacy work. The overall timeline of the change was covered in the article on the new timeline under the EU AI Act; here we focus on Article 4 alone.
What is AI literacy?
The Act defines the concept in Article 3(56). Under this definition, AI literacy means the skills, knowledge and understanding that allow providers, deployers and persons affected by AI, with due regard to their rights and obligations under the Act, to make an informed deployment of AI systems and to gain awareness of the opportunities, risks and possible harm that AI can cause. The AI Omnibus did not change this definition.
The Act's recitals (recital 20) expand on the scope of the concept a little further: the correct application of technical elements during a system's development phase, the measures to be taken during use, and the correct interpretation of the system's output are all listed as parts of this knowledge.
Two roles stand out in the Act. A provider is a person or organization that develops an AI system, or has one developed, and places it on the market under its own name. A deployer is a person or organization that uses a system under its own authority; personal, non-professional use falls outside this. A company that uses an off-the-shelf AI tool in its business processes is a deployer under this definition.
Article 4: the old and new text
Article 4, one of the Act's general provisions, has applied since 2 February 2025. The Omnibus (Regulation (EU) 2026/1744) changed the content of the text; it did not remove the obligation itself.
| Original text (2024/1689) | Text after 2026/1744 | |
|---|---|---|
| Core of the obligation | Providers and deployers take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff | Providers and deployers take measures to support the development of AI literacy |
| Who is covered? | Staff and other persons who operate or use the systems on the organization's behalf | Same |
| What is it tailored to? | Technical knowledge, experience, education and training; the context in which the system is used; the persons on whom the system is used | Same |
| Level assurance | The wording "sufficient level" is present | No requirement to guarantee a specific level for each person |
| Role of public authorities | Not in the article | The Commission and Member States provide support, particularly to SMEs; the Commission publishes practical examples for compliance |
| AI Board | Not in the article | Adopts recommendations with shared objectives, taking European competence frameworks into account |
In short, the company's obligation to "do something" remains; what has changed is that the bar has been lowered from "ensuring a sufficient level" to "supporting development", and that the supporting duty of public authorities has been written into the text.
The rationale for the change
The recitals of the Omnibus (recital 8) state the reason openly. According to stakeholder experience, a rigid obligation to ensure a sufficient level of literacy is not suitable for every type of provider and deployer; the data also show that this obligation creates an additional compliance burden, particularly for small businesses. The same recital stresses that, independently of legal obligations and penalties, literacy should be a strategic priority.
What does the Commission's Q&A document say?
The Commission's AI literacy Q&A page was updated on 27 July 2026 and gives answers based on the new text. The key points are:
- Minimum framework: The organization is advised to understand AI in general terms, determine its own role (provider or deployer), assess the risk of the systems it uses, and build its training steps around that analysis.
- No testing or certification requirement: The article does not oblige organizations to measure employees' level of knowledge; no certificate is required, and keeping an internal record of training and guidance activities is considered sufficient.
- No one-size-fits-all training: There is no mandatory training format or sector-specific requirement; however, merely having staff read the instructions for use is regarded as ineffective in most cases.
- No separate governance structure required: Article 4 does not require appointing a dedicated AI officer or committee.
- Everyday tools are in scope too: The document states that employees who use generative AI to write ad copy or translate, for example, should be informed about risks such as hallucination.
- Practice examples: According to the document, simply repeating the examples in the repository of AI literacy practices compiled by the Commission does not by itself create a presumption of compliance; the Commission states that it will draw on this repository to publish compliance examples.
On supervision, the document says that enforcement of Article 4 rests not with the Commission's AI Office but with national market surveillance authorities, and that any penalties will be based on the national law of the Member States and must be proportionate.
High-risk systems carry a separate training obligation
The flexibility the Omnibus introduced on literacy does not affect the separate obligation of organizations that use high-risk systems. Under Article 26(2) of the Act, these organizations must assign human oversight to people who have the necessary competence, training and authority. The Omnibus made no change to Article 26; the Commission's Q&A document also separately reminds readers that this obligation continues.
For Turkish companies
Under the Act's scope provision (Article 2), the regulation applies to providers that place systems on the market in the EU regardless of the country where they are established, and to providers and deployers established in a third country if the output produced by the system is used in the EU. Whether a Turkish company that supplies products or services to the EU falls within the scope of Article 4 depends on its role, on what the system is used for, and on where the output is used. This assessment should be made case by case.
How do you set up an AI literacy initiative?
Based on the framework in the sources, the following sequence offers a reasonable starting point:
- Build the inventory. List which AI tools are used in the company, by which teams and for what purpose.
- Flag the role and the risk. For each tool, determine whether the company is a provider or a deployer and whether the tool is used in a high-risk area.
- Separate the target groups. Plan different content for management, everyday users, technical teams and external service providers who use the system on the company's behalf.
- Prepare short, role-specific content. Cover general concepts, the limits of the tools in use, data-sharing rules and how to spot faulty output.
- Keep records and update them. Who took which training, and when; how was the content updated when a new tool went live? This record is the simplest way to demonstrate compliance.
The topic of making employees' uncontrolled use of AI visible was covered separately in the article on employees' AI use and governance.
Conclusion
The AI Omnibus removed the "sufficient level" standard from Article 4 but did not take AI literacy off companies' agendas: the obligation of providers and deployers to take measures continues, and the training requirement for high-risk systems stands as it was.
From Orient Global's perspective, the most effective approach is to treat literacy not as a separate compliance project but as an ordinary step in the process of putting AI tools into service. Short, role-specific, documented training run alongside the tool inventory satisfies the regulatory expectation and delivers the efficiency gains from the tools at the same time.
Why logistics experience matters here. The five steps above are the working habits of a well-run warehouse: a register of equipment (the inventory), a qualification matrix showing who may operate what (roles and target groups), a short briefing before any new system goes live, and training records that stand up to audit. On a warehouse floor nobody operates a forklift without a recorded qualification, and the same logic runs through Article 26(2)'s call for competence, training and authority in those who oversee high-risk systems. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain. At a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end to end, building and leading teams of 100+ people, and he has managed nationwide warehouse and transport operations at leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information purposes only and is not a substitute for legal advice.
#interimmanagement #forwarddeployedengineering