Free tool
The EU AI Act's AI literacy obligation, as it now reads
Article 4 was rewritten in July 2026. Check whether it applies to you and what it now actually requires, against the amended text rather than the old one.
On 27 July 2026 the Digital Omnibus replaced Article 4 of the AI Act outright, and almost everything written about AI literacy still describes the version it replaced. The duty changed from ensuring a sufficient level of AI literacy to supporting its development, and a sentence was added stating that you need not guarantee any specific level for any individual. That is the difference between a duty of result and a duty of means, and it changes what compliance looks like, what evidence you need, and how much of the training being sold against this obligation you actually require.
Nothing leaves your browser: What you record here is a candid note of where your AI governance is thin, which is precisely the sort of thing that should not be posted to someone else's server. Your answers stay in this browser, the page is served with a Content Security Policy whose connect-src 'none' rule blocks fetch, XHR, WebSocket, EventSource and sendBeacon, and you export the record yourself. A policy inside the page cannot stop you copying the result somewhere else, so what you do with it afterwards is yours to protect. Refreshing the page loses your work.
1. Does it reach you?
Is any AI system in use in your organisation?
Count the AI features already switched on inside software you licence, not only the tools somebody chose deliberately.
Your position
Answer the first three questions and your position appears here, with the reasoning behind it.
Article 4, before and after
Both texts in full, so you can see the change rather than take a summary of it. The second is the law as it stands.
Until 26 July 2026, superseded
Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
From 27 July 2026, current
Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.
An obligation of means, not of result
Before: Take measures to ensure, to your best extent, a sufficient level of AI literacy.
Now: Take measures to support the development of AI literacy, with an express statement that you need not guarantee any specific level for any individual.
So what: You are now judged on what you provided, not on what each person absorbed. A programme that is offered, resourced and kept current is compliant even where an individual has not completed it. Under the old wording that gap was arguable; it is now expressly not a breach.
There was never a testing mandate, and now there is plainly none
Before: Widely read as implying assessment, because 'a sufficient level' invites the question of how you would know.
Now: No level to demonstrate, so no assessment is required to prove one.
So what: Competency testing, pass marks and certificates are a choice you may make for your own assurance. They are not what Article 4 asks for, and any vendor telling you otherwise is selling against a version of the text that no longer exists.
The Commission now has to help
Before: No support duty.
Now: The Commission and Member States must support and facilitate compliance, particularly for SMEs, and the Commission must publish practical examples of how to comply on the single information platform.
So what: If you are a smaller organisation, free official material is coming and is worth waiting for before commissioning anything expensive. The Omnibus also inserts definitions of SME and of 'small mid-cap enterprise' into the Act for the first time.
Recommendations are coming from the AI Board
Before: Nothing specified.
Now: The Board is to adopt recommendations on promoting AI literacy, taking European competence frameworks into account.
So what: A defensible programme should be able to absorb those recommendations later. Build something you can map onto a framework rather than a fixed curriculum you would have to rip out.
Article 4 has no fine attached to it in the Act itself.
Article 99(4) sets out the infringements that attract administrative fines of up to EUR 15 million or 3% of worldwide turnover, and lists the provisions it applies to. Article 4 is not among them. There is no EU-level ceiling written against the AI literacy obligation.
That does not make it unenforceable. Article 99(1) requires Member States to lay down rules on penalties for infringements of the Regulation and to make them effective, proportionate and dissuasive, so the exposure is whatever your Member State legislated, and it varies.
One route does reach further. Where the AI Office supervises an operator directly, the Omnibus provides that infringement of any applicable provision of the Regulation, expressly including those not listed in Article 99(4), may attract fines under that Article. That is a real widening, and it applies to the AI Office's own supervisory perimeter rather than to every deployer.
A common misreading: Marketing that quotes EUR 35 million or 7% against AI literacy is quoting the ceiling for the prohibited practices in Article 5, which is a different obligation entirely. Nothing in the Act attaches that figure, or the EUR 15 million figure, to failing to train your staff.
The dates that matter
Article 4 became applicable
AI literacy has been a live obligation since this date, alongside the prohibitions in Article 5. It did not begin in 2026, and it was never deferred.
The Digital Omnibus entered into forceMost often missed
Regulation (EU) 2026/1744 replaced Article 4 from this date. Any guidance written before it describes a version of the obligation that no longer applies.
General application of the Act's governance and penalty regime
The date from which the broader supervisory and penalty machinery applies. Article 4 itself was already in force; what changes around this point is the apparatus available to supervise it.
New prohibitions apply
The prohibitions inserted by the Omnibus into Article 5 apply from this date, rather than immediately on entry into force.
Annex III high-risk obligations apply
Deferred from 2 August 2026. Chapter III Sections 1 to 3 apply to systems classified high-risk under Article 6(2) and Annex III from this date.
Annex I high-risk obligations apply
Deferred from 2 August 2026. Chapter III Sections 1 to 3 apply to systems classified high-risk under Article 6(1) and Annex I from this date.
Use the data
Both texts of Article 4, the change analysis, the dates, the penalty position and the role groups are published as JSON under CC BY 4.0, currently version 2026-08-04. Article 4 itself is reproduced from the Official Journal, which is freely reusable; everything else is original.
Primary sources: Regulation (EU) 2024/1689 (AI Act); Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Article 4.
What this cannot tell you
Whether your material is any good. A duty of means is satisfied by provision, so this can check that something exists, is aimed at the right populations and is recorded. It cannot see whether the content is accurate, current, or worth anyone’s time, and a programme that ticks every structural box while teaching nothing useful is compliant and pointless at once.
It also cannot tell you your national exposure. The Act is a Regulation, so Article 4 applies directly and identically across the EU, but the penalties for breaching it are set by each Member State under Article 99(1) and differ.
Common questions
›When did the AI literacy obligation start applying?
2 February 2025, alongside the prohibitions in Article 5. It has been live for over a year and was never deferred, which is worth saying because the high-risk obligations were deferred and the two get conflated. What changed in 2026 was the wording of the duty, not the date it began.
›What exactly did the Digital Omnibus change about Article 4?
It replaced the Article. The old text required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy. The new text requires measures to support the development of AI literacy, and adds a sentence that did not exist before: the obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual. It also obliges the Commission and Member States to support compliance, particularly for SMEs, and to publish practical examples.
›Do we have to test staff or issue certificates?
No, and now expressly not. There is no level to reach, so there is nothing to demonstrate. Assessment, pass marks and certificates are a legitimate choice for your own assurance, but they are not what Article 4 asks for. Anyone selling mandatory certification against this obligation is selling against wording that no longer exists.
›What is the fine for failing the AI literacy obligation?
There is no fine attached to Article 4 in the Act itself. Article 99(4) lists the provisions carrying administrative fines of up to EUR 15 million or 3% of turnover, and Article 4 is not among them. Penalties come through your Member State's own rules under Article 99(1), which must be effective, proportionate and dissuasive but vary by state. Separately, where the AI Office supervises an operator directly, the Omnibus allows fines for infringement of any applicable provision including those not listed. Marketing that quotes EUR 35 million or 7% against AI literacy is quoting the ceiling for prohibited practices under Article 5, a different obligation entirely.
›Does this apply to a UK organisation?
Directly, only if you are established in the EU or the output of your AI systems is used there. Otherwise the Act does not reach you as a matter of law. It very often reaches you by contract instead: EU customers carrying their own obligations push equivalent terms down their supply chain, and a great many UK organisations end up meeting Article 4 because an agreement says so rather than because the Regulation does.
›What does good evidence look like under a duty of means?
The measures themselves and the record that they were offered. Dated, versioned material; a record of which populations it went to and when; the acceptable use policy it points at; and for technical and decision-making roles, something showing the material was specific to them. What you no longer need is proof that any individual reached a standard, because the amended text says you are not required to guarantee one.
When you need more than a tool
Cyber Security Training
Practitioner-led training grounded in real delivery: one-to-one CISM and CCISO exam coaching, ISO/IEC 42001 practitioner workshops, and hands-on AI risk training for technical teams.
Plan your programme
