AI Literacy Under the EU AI Act: What the Law Asks of You Since July 2026

Posts telling businesses to "demonstrate workforce readiness" on AI literacy are doing the rounds again this month. Some of them describe the law as it was written in 2024, not the law as it stands today. Article 4 of the EU AI Act was rewritten in July 2026, and the new wording asks for something different — and more achievable — than many firms have been told.

What changed

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and took effect three days later. It replaced Article 4 in full.

The original text required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff. That phrase is gone. The new Article 4 says providers and deployers "shall take measures to support the development of AI literacy" of their staff and anyone operating AI on their behalf. It then adds a sentence that matters to every small business: the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

The Regulation's own recitals explain why. Stakeholders reported that a stringent duty to ensure a sufficient level "would not be suitable for all types of providers and deployers", and that it created an extra compliance burden, "particularly for smaller enterprises".

What it did not change

The duty did not disappear. It moved from an obligation to achieve a result to an obligation to make an effort — and an effort you cannot show is, in practice, an effort you did not make.

It still applies to every business that uses AI in scope of the Act, whether or not that AI is high-risk. A firm using a general AI assistant for client work is a deployer, and Article 4 reaches it.

And the measures still have to fit. The new text asks you to take into account your people's technical knowledge, experience and training, the context the AI is used in, and the people it is used on. An accountancy practice using AI on client tax data needs different measures from a marketing agency drafting social posts.

What "taking measures" looks like for a small firm

There is no certificate to buy and no test your staff must pass. What an authority or a client will reasonably ask to see is:

A written position. One document stating which AI tools the firm uses, who uses them, and what your people are expected to understand about each.

Measures by role. What general staff need to know is different from what the person configuring a tool needs to know. Write both down.

A record that it happened. Dates, attendees and materials for whatever training or guidance you gave. This is the evidence that turns an intention into a measure.

A review point. Tools change and staff change. Set a date to look again, and a trigger — a new tool, a new use — that brings the review forward.

The Commission and Member States must now publish practical examples of how to meet the obligation, with SMEs named specifically. Until those arrive, the four items above are a proportionate, defensible position.

Why this is good news

The old wording left firms asking an unanswerable question: how literate is sufficiently literate? The new wording replaces it with an answerable one: what have you done, and can you show it? For a small firm that is a matter of a policy, a training record and a review date — not a programme.

Get the policy written

Ops Intel writes AI compliance frameworks for small and medium-sized businesses, and every EU framework includes an AI literacy policy written to the current Article 4. If you would rather check where you stand first, the free AI risk checker at opsintel.io tells you which parts of the Act reach your business.