# AI literacy: what Article 4 of the AI Act requires after the Omnibus > Source: > Published: 2026-11-06 00:00:00+00:00 Of all the obligations in the EU AI Act, Article 4 is the one that affects the most companies and the one that has received the least attention. It does not depend on the risk level: it is enough that someone in the company uses an AI system at work. In 2026 that covers almost everyone, from the person drafting emails with ChatGPT to the one filtering CVs with the ATS. It has applied since February 2025. In July 2026 the Digital Omnibus changed its wording, and you should know exactly how. ## What it said and what it says now The original version required providers and deployers to take measures to *ensure* that their staff had a sufficient level of AI literacy. It was an obligation of result: if an employee did not know enough, the company was in breach. After the Omnibus, it is an obligation of means: you have to take measures to *support* the development of that literacy, and the text makes clear that it does not require ensuring a specific level for each person. The Omnibus recital justifies this by the burden it placed on SMEs. What did not change: - **The obligation still exists.** What changed is how it is measured, not whether you have to comply. - **The scope.** It covers your own staff and other people who use the systems on the company’s behalf: contractors, freelancers, an agency running your campaigns with AI. - **The context.** The measures have to take into account each person’s technical knowledge, their experience and the context in which the system is used. One generic training session for everyone fits poorly with that. In practice, “taking measures” is demonstrated with records. The [Q&A published by the Commission](https://www.hunton.com/privacy-and-cybersecurity-law-blog/european-commission-publishes-q-a-on-ai-literacy) in May 2025 already stated that you do not need to measure each employee’s level and that internal records are enough. ## The risk that training does solve Compliance aside, there is a practical reason to take this seriously, and it lies in what people do with AI tools when nobody has explained anything to them: - **Pasting personal data into a free chatbot.** A customer list to sort, a contract with names and ID numbers to summarize. Depending on the tool and the plan, that data may be used to train models or processed outside the EU, and that is a GDPR problem before it is an AI Act one. - **Trusting a made-up figure or citation.** A report citing a court ruling that does not exist, or a market figure the model pulled out of thin air. - **Accepting what the system suggests without looking.** An ATS that ranks candidates and a person who only interviews the top five. All three shrink with clear rules and half an hour of explanation using examples from each team’s own work. ## A role-based plan for an SME **1. Usage inventory.** Ask each team which AI tools they use, with which account (personal or company) and for what. The list almost always comes out longer than expected, with tools nobody approved. **2. One-page usage rules.** Which tools are approved and on which plan, which data never gets pasted (customers’ personal data, health data, contracts, code with credentials), what has to be checked before publishing or sending something generated with AI, and who to ask when in doubt. **3. Training by role.** Each profile needs to know something different: | Profile | What they use | What they need to know | |---|---|---| | Customer service | Website chatbot, reply assistant | That the chatbot can promise things the company does not offer, how to spot it and when to hand the conversation to a person | | Marketing | Text, image and video generators | Which content has to be labeled as AI-generated, image rights and commercial-use licenses | | Human resources | ATS with ranking or filtering | That it is a high-risk system, that the final decision is theirs and how to review the candidates the system rejects | | Development | Coding assistants, model APIs | Which data goes out to the provider, how to evaluate a model’s outputs and what to log | | Management | All of the above | Which systems exist, what risk level they carry and who is accountable for each one | **4. Records.** A sheet with who received which training and when, the usage rules with their version date, and the changes whenever a new tool is added. It is what you would show if your national AI supervisory authority (in Spain, the AESIA) or a customer asked for it. **5. Refresh when the tools change.** You do not need an annual course. Every time a new tool is approved or an important feature changes, send the affected team a note on what changes. ## How it fits with the rest of the AI Act Literacy is the foundation for the other obligations. The human oversight that high-risk systems will require from December 2027 does not work if the person overseeing does not understand where the system fails. The transparency rules of Article 50, which apply from August 2026, depend on marketing knowing which content has to be labeled. You have the full timeline in the [AI Act guide](https://soamee.com/en/blog/en-eu-ai-act-2026-compliance), and the ethical side, which goes beyond what is mandatory, in [how to turn principles into tests](https://soamee.com/en/blog/en-ai-ethics-business-principles-to-tests). If you want to start with the inventory, it is the first step of our [responsible AI audit](https://soamee.com/en/services/responsible-ai-audit): you get the list of systems, the risk level of each one and what each team that uses them needs to know.