EU AI Act Article 4 After the Digital Omnibus: AI Literacy and the Shadow AI Problem
Article 4 is easy to miss because it has no product to point to, no chatbot disclosure, no risk assessment form. The 2026 Digital Omnibus softened its wording: it is now a duty to take measures that support AI literacy, not to guarantee a level. It still applies to every AI system you provide or deploy, and the practical work behind it has not changed much.
- Article 4 has applied since 2 February 2025, alongside the Article 5 prohibitions.
- Since 27 July 2026, the Digital Omnibus (Regulation (EU) 2026/1744) wording applies: providers and deployers must take measures to support the development of AI literacy of their staff and others using AI on their behalf.
- The old wording asked them to ensure, to their best extent, a sufficient level of AI literacy. The new text says it does not require guaranteeing any specific level.
- It is now an obligation of effort, not of result, but it is still an obligation, and it applies to ALL AI systems, not only high-risk ones.
- The Commission and the Member States must support providers and deployers in meeting it, in particular SMEs.
- There is no prescribed format: no mandated course length, certificate, or platform.
What Article 4 says now
After the Digital Omnibus, Article 4 of Regulation (EU) 2024/1689 requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. The measures should take into account people’s technical knowledge, experience, education and training, the context the AI systems are used in, and the persons or groups the systems are used on. The text states that this does not require guaranteeing any specific level of AI literacy of any individual.
The Commission and the Member States must support and facilitate these efforts, in particular for SMEs, for example with guidance and practical examples.
What changed, and what did not
Before the Omnibus, Article 4 asked providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy. That read like an obligation of result: a level had to be reached. The new wording is an obligation of effort: you have to take proportionate measures, but no one can hold you to a specific literacy outcome for each employee.
What did not change: Article 4 still applies to every AI system a company provides or deploys, not just high-risk or transparency-tier ones. Using a third-party AI tool still makes you a deployer. And because "we took measures" is a claim, the practical question is still whether you can show what those measures were, for whom, and when.
Why this is the "shadow AI" provision
Article 4’s scope, all staff dealing with AI, not just IT or a designated compliance function, is exactly why it collides with the shadow AI problem: employees adopting AI tools (chatbots, browser extensions, personal ChatGPT accounts for work tasks) without going through any approval process. You cannot take meaningful literacy measures for tools you don’t know exist. That makes an honest, judgment-free inventory of actual AI usage, not just officially sanctioned tools, the practical starting point for Article 4.
This is also why Article 4 and the AI Asset Inventory work described in the risk tier guide are the same underlying task, viewed from two angles: one asks "what AI do we use," the other asks "do the people using it understand it well enough."
Proportionate measures in practice
The Regulation does not prescribe a training format. A defensible, proportionate approach typically covers:
- A basic explanation of what the AI tools your staff actually use do, and don’t do (what they generate, what data they see, their known failure modes).
- Role-specific depth: a marketer using a generative writing tool needs different literacy than an HR team using an AI screening tool, or a developer integrating an AI API.
- Awareness of the company’s AI Act obligations that touch their role: e.g., customer-facing staff need to know about Article 50 chatbot disclosure duties if they manage a chatbot.
- A record of the measures: who, when, on what. Under an obligation of effort, that record is how you show the effort was made.
What this is not
Article 4 is not a data science course, and it is not the same as high-risk system documentation. It is closer to a workplace safety briefing than a technical certification: proportionate, role-specific, and focused on the practical risks and limits of the specific tools people actually touch. A generic "AI 101" video with no connection to your company’s actual tools is a weak measure for anyone whose role involves meaningful AI use.
Questions
Does Article 4 still apply after the Digital Omnibus?
Yes. The Omnibus changed its wording from ensuring a sufficient level of AI literacy to taking measures that support AI literacy, and it states that no specific level has to be guaranteed. The duty to take measures still applies to every provider and deployer of an AI system.
Does Article 4 apply to a company with no in-house AI development?
Yes. Article 4 applies to deployers as well as providers. Using third-party AI tools (a chatbot platform, a generative writing tool, an AI-powered SaaS feature) makes you a deployer, and the duty follows from that, regardless of whether you built any AI yourself.
Is a single company-wide training session enough?
It depends on whether it is proportionate to each role’s actual AI use, which a single generic session often isn’t once different departments use different tools for different purposes. Treat "one video for everyone" as a starting point to build on, and confirm your specific approach with qualified counsel if you need certainty.
Not sure which risk tier your AI system is in?
Take the free 5-question Risk Tier Quiz. No email needed, result in under a minute.
Want this tracked automatically, not read about?
The EU AI Act Governance Cockpit is a Notion + n8n workspace that logs your AI systems, runs this exact risk classification, tracks the required actions, and keeps the evidence. One-time payment from €49.
Related guides
Founder of AI Compliance Lab. Specialist in EU AI Act governance workflows and automation. LinkedIn →