Update, 27 July 2026: Regulation (EU) 2026/1744 was published in the Official Journal of the EU (OJEU) on 24 July 2026 and has been in force since 27 July 2026. This article's references to the Omnibus as a proposal describe the situation as of its publication date. The new wording of Article 4 — an obligation of means: it “does not require providers or deployers to guarantee any specific level of AI literacy of any individual” — is the version in force from that date.
If people in your company use AI systems, this concerns you. Article 4 of the AI Act has, for months, been a common hook for talking to an SME about compliance: "if your team uses AI, you need to be able to show that it knows how to use it." Put that way, it was never accurate, and it is less so now: the Article requires measures to be taken, not a specific level of competence to be demonstrated. But the Digital Omnibus has touched the wording of this article, and the nuance deserves an honest explanation, because it marks the difference between serious governance and a fear-based pitch.
The figure draws Article 4 as an obligation of means, which does not require any specific level of AI literacy of any individual. It is a four-step loop — identify who operates AI and with which systems; train in line with the context of use and each person's profile; document which measures were taken, for whom and when; and review when the systems or the people change — around a central record, the evidence of the AI literacy measures. Article 4 does not require documenting: the record is evidence of the method.
What Article 4 says, and since when
The AI literacy obligation has been in application since 2 February 2025. It isn't a future obligation. In its current wording, it requires providers and deployers to take measures to support the development of AI literacy of their staff — and of other persons dealing with the operation and use of AI systems on their behalf — taking into account their technical knowledge, experience, education and training, the context the AI systems are to be used in, and the persons or groups of persons on whom they are to be used.
In an SME, this translates into something concrete: whoever has to take measures for staff's AI literacy regarding the AI they deploy is not the software manufacturer. It's the organisation itself. A clinic using an AI system to read X-rays, a distributor with an office-productivity copilot on every desktop: in both cases, the AI literacy measures fall on whoever deploys the tool; the Article doesn't require documenting them, but documenting them is what makes them demonstrable.
What changes with the Omnibus
The Digital Omnibus replaces Article 4 in its entirety. Where the original text required measures to ensure, to their best extent, a sufficient level of AI literacy, the new wording requires measures to support the development of AI literacy, and adds that this obligation does not require any specific level of AI literacy of any individual. In parallel, it requires the Commission and the Member States to support and facilitate the efforts of providers and deployers, in particular SMEs, and the Commission to publish practical examples of how to comply with that obligation.
It's a change of intensity, not of direction. The obligation of "result" (ensuring, to their best extent) moves closer to one of "means" (taking measures to support the development of AI literacy). The literal wording was settled with publication in the Official Journal of the EU on 24 July 2026 (Regulation (EU) 2026/1744, in force since the 27th): the Article “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”.
Why this doesn't let you off the hook for anything that matters
This is where I separate the analysis from the noise. The verb shifting from "ensuring" to "supporting the development of" doesn't mean literacy stops mattering. It means three things:
First, the obligation still exists. A mandate to take measures is still a mandate. An organisation that cannot show a single measure — no policy, no training, no record — isn't promoting anything.
Second, the logic of diligence doesn't change. The value of having an AI use policy, a systems inventory, and evidence of training never depended on penalties — the Omnibus itself says that AI literacy "should be a strategic priority, regardless of regulatory obligations and potential sanctions". It was, and still is, being able to show that you acted with sound judgement the day someone — an authority, a client running an audit, an insurer renewing your policy — asks how you govern your AI.
Third, "tailored" isn't "optional". The Article tailors the measures to people's technical knowledge, experience, education and training, to the context the AI systems are to be used in and to the persons or groups of persons on whom they are to be used. An SME that only uses low-exposure AI can meet the obligation with light-touch measures. A clinic processing health data with AI support, or a company starting to use AI in decisions about people, isn't in the same position. The softening of Article 4 benefits those with less risk, not those with more.
What the softening doesn't touch
One fact the softening of Article 4 doesn't touch: Chapter VII, on governance, has applied since 2 August 2025, and the Article 50 transparency obligations have applied since 2 August 2026; they fall mainly on providers and, in the cases covered by paragraphs 3 and 4 and subject to their exceptions — emotion recognition or biometric categorisation systems, deep fakes, and text published to inform the public on matters of public interest — on deployers. The literacy obligation has applied since 2 February 2025, and the fact that the new wording doesn't require a specific level of literacy doesn't make it disappear.
What to document, proportionately
For most SMEs, meeting Article 4 credibly looks like this:
- An AI use policy adapted to the organisation: which systems are authorised, which are prohibited, what to do when a result looks anomalous.
- An inventory of the AI systems actually in use (including AI that arrives through software updates without anyone registering it).
- Evidence of training: who received what, when, on which systems. You don't need a master's degree; what helps is traceability, even though Article 4 doesn't require it.
None of this is a seal or a certification of anything. It's documentation that's reviewed and auditable, ready if an inspection ever arrives. And precisely because the Omnibus lowers the formal bar, it makes more sense than ever to do it properly and without dramatics: an organisation that documents its diligence proportionately is in a solid position, without needing to buy peace of mind.
This article is for informational purposes only and does not constitute legal advice.