Art. 4 of the AI Act after the Digital Omnibus: the AI literacy obligation changed in nature - what it means for your company

Since 27 July 2026, Art. 4 of the AI Act reads differently. Regulation (EU) 2026/1744 (the Digital Omnibus on AI) replaced the obligation to “ensure” a sufficient level of AI competence with an obligation to “support the development” of that competence. It sounds like a softening, and it is one, but the obligation has not disappeared. What has changed is what a company will be held accountable for: no longer the level of employees' knowledge, but the measures it has taken.

What exactly did Art. 4 of the AI Act require before the Digital Omnibus?

In its original wording, providers and deployers of AI systems had to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other people who operate AI systems on their behalf. In doing so, they had to take into account those persons' technical knowledge, experience, education and training, and the context the systems were to be used in.

Even then, the reservation “to their best extent” softened the obligation. The reference point, however, remained a target state - a “sufficient level” - and that raised the practical question of who would measure that level, and how.

What did the Digital Omnibus change in the wording of Art. 4?

Regulation (EU) 2026/1744 entered into force on 27 July 2026. Under the new wording of Art. 4, providers and deployers must take measures to support the development of AI literacy. The provision expressly states that this does not require guaranteeing any particular level of competence in any individual.

The amendment also added provisions on support from the Commission and Member States, particularly for SMEs, and on recommendations from the AI Board. The reasoning behind the changes repeats the argument that a one-size-fits-all approach does not suit every company, and that the “sufficient level” requirement was a disproportionate burden for smaller enterprises.

A practical note: the same package pushed back the deadlines for high-risk systems. Art. 4 was not postponed. It has applied since 2 February 2025, and national market surveillance authorities have been able to enforce it since 2 August 2026. I describe the full calendar in the article on the AI Act timeline.

Obligation of result or obligation of means: why hasn't the obligation disappeared?

A Polish lawyer already knows this distinction well from civil law - and it is one that other civil-law systems recognise too. Under an obligation of result, the debtor is answerable for achieving a specified state of affairs. Under an obligation of means (due diligence), the debtor is answerable for whether it acted with due diligence, regardless of the outcome. The old wording of Art. 4 was closer to the first model; the new one fits the second.

There are three practical consequences:

• “Doing nothing because there's no sanction for the result” is no longer enough. What is now assessed are the measures taken. A total absence of measures is a breach outright, not merely a poor outcome.
• The measures must be adequate. A single company-wide webinar, regardless of roles and tools, is hard to defend as due diligence towards a team that processes client data in a language model every day.
• The burden shifts to documentation. Since what counts now are the measures, you need to be able to show them: what, for whom, when, and why to that extent.

Who does Art. 4 apply to - only the IT department, or the board as well?

The provision applies to providers and deployers of AI systems. A deployer is anyone who uses an AI system in a professional activity, so it also includes a company that has “only” bought licences for ChatGPT, Copilot, or a CV-screening tool. The measures must cover the people who operate and use AI systems on the company's behalf. In practice that also means the board, which makes decisions based on AI outputs, and B2B contractors working with company tools.

The scope of the measures should match the role. Preparing a recruiter using a candidate-assessment system is different from preparing a developer integrating a model via an API, and different again from preparing a board member approving a deployment. The tool inventory described in the article on Shadow AI is useful here, because you cannot plan competence for tools the company does not know it is using.

How do you prove that a company has met the obligation under Art. 4?

The European Commission runs an official AI literacy questions and answers page, updated on 27 July 2026 to reflect the new wording of the provision. Four pointers follow from it:

• No certificate is required, and the rules do not mandate compulsory training or a fixed format.
• An internal register of training and other competence-supporting measures is recommended.
• There is no one-size-fits-all solution. The starting point is: a general understanding of AI within the organisation, clarity about the company's role (provider or deployer), a risk assessment of the systems used, and measures tailored to staff knowledge and the context of use.
• The Commission's repository of good practices (over 40 examples) is a source of inspiration, but copying someone else's programme does not automatically create a presumption of compliance with Art. 4.

A well-kept Art. 4 file contains: a list of the AI systems in use with roles assigned, a short analysis of what each role needs, a training schedule and materials, attendance lists, a policy on AI use, and the date of the next review.

What measures count as “supporting the development of competence”?

A one-off training session is a minimum, not a programme. A defensible package for a medium-sized company usually looks like this:

1. Introductory training for all users: how models work, what not to paste into them, how to verify outputs, when to disclose the use of AI.
2. Modules for higher-risk roles: HR, customer service, product teams, developers integrating models.
3. A session for the board: liability, oversight, deployment decisions, obligations under the AI Act and the GDPR.
4. An AI use policy with a list of approved tools and a path for reporting new ones.
5. An annual review, or one triggered by a new tool's deployment.

Are there penalties for skipping AI training?

Many popular write-ups get this wrong, so let's be precise. Art. 99 of the AI Act, which sets the penalty thresholds (up to EUR 35 million or 7% of turnover for prohibited practices, up to EUR 15 million or 3% for the operator obligations it lists), does not list Art. 4 among the provisions carrying those penalties. The Polish Act of 3 July 2026 on Artificial Intelligence Systems (Journal of Laws 2026, item 1003) contains no separate provision on AI competence and no sanction of its own for breaching Art. 4. The Commission for the Development and Security of Artificial Intelligence (KRiBSI) imposes penalties “in the cases, amounts and on the conditions” set out in the AI Act (Art. 104(1) of the Act), and its inspection and sanctioning powers apply from 28 October 2026.

This does not mean Art. 4 can be ignored. The risk comes back by three routes:

• Through other breaches. A deployer of a high-risk system must, among other things, assign human oversight to people with adequate competence. Breaching those obligations already carries a penalty of up to EUR 15 million or 3% of turnover, and the lack of a competence programme will be the first piece of evidence there.
• In disputes over damages. When an employee causes harm using AI, the question of the company's due diligence arises regardless of any administrative penalties.
• In a KRiBSI inspection. KRiBSI conducts inspections and issues decisions on AI Act breaches. Missing Art. 4 documentation is the simplest possible finding of an inspection.

Can AI training be combined with GDPR and other obligations?

Yes, and it's worth doing. The GDPR requires that persons acting under the controller's authority process data only on its instructions (Art. 29 and Art. 32(4)), and a DPO's tasks include awareness-raising and staff training (Art. 39(1)(b)). A module on “what not to paste into AI tools” is at the same time data protection training. One training track serving two purposes with a single register is cheaper and easier to defend than two parallel programmes.

A minimum plan for the next quarter

1. Weeks 1-2: take an inventory of AI tools and assign roles (who uses what, and for what).
2. Weeks 3-4: an AI use policy and introductory training for all users.
3. Month 2: modules for higher-risk roles and a session for the board.
4. Month 3: the Art. 4 register (materials, attendance lists, rationale for scope) and a review date.

This article is for information purposes only and does not constitute legal advice.