AI Literacy in 2026: What EU AI Act Article 4 Still Requires of Employers

Article 4 of the EU AI Act still requires providers and deployers to take measures supporting AI literacy among staff and contractors. Since the July 2026 Digital Omnibus, it no longer asks you to guarantee a literacy level. No certificate is required, but a regulator can ask what you did, so keep a dated, role-based record.

An HR leader at a consulting firm faces a specific exposure. Your consultants use AI tools on client work every day, your subcontractors do too, and each of them counts as someone “dealing with the operation and use of AI systems on your behalf”. The July 2026 amendment softened the wording of Article 4. It did not remove the duty, and national authorities have supervised it since August 2026.

What does Article 4 say after the Omnibus?

Article 4 has applied since 2 February 2025, according to the European Commission’s AI literacy FAQ. Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced its wording and entered into force on 27 July 2026 (verify current text on EUR-Lex). The amended Article 4 now reads that providers and deployers “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”, taking into account their technical knowledge, experience, education and training, the context of use, and the people the systems affect.

	Before the Omnibus	After the Omnibus
Verb	“ensure, to their best extent, a sufficient level” of AI literacy	“take measures to support the development” of AI literacy
Type of duty	Result-oriented	Means-oriented
Explicit carve-out	None	The duty “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”
Public support	Not specified	Commission and Member States support providers and deployers, especially SMEs

The change matters less than it looks. You can no longer be faulted for an individual consultant who still misunderstands a model’s limits. You can still be faulted for having no measures at all. The existing Fruggr briefing on the Omnibus covers the wider timeline, including the new dates for high-risk obligations.

Who counts as “staff and other persons” in a consulting firm?

The phrase is wider than your payroll. The Commission FAQ says the duty covers people working on your behalf, such as contractors and service providers, who are “not employees, but persons broadly under the organisational remit”. For a consulting or IT services firm that means four groups:

• Permanent consultants and analysts who use AI assistants, code generators or summarisation tools on client work.
• Freelancers and subcontractors placed on client projects under your delivery process.
• Recruiters and HR staff who use AI for screening, sourcing or interview scheduling.
• Delivery managers who approve AI-generated deliverables before they reach the client.

Talent acquisition deserves its own line. Recruitment AI is a high-risk category under Annex III of the AI Act, and the Omnibus moved the high-risk obligations for Annex III systems to 2 December 2027, according to a secondary summary from ActuIA (verify current text). Recruiters who screen candidates with an AI tool will need documented human-oversight competence by then. Starting their literacy programme now removes a deadline risk later.

What will a regulator expect to see?

The Commission states that “the AI Office does not intend to impose strict requirements or mandatory trainings” and that “there is no need for a certificate”. It also says that handing staff the vendor’s instructions for use is, in many cases, “ineffective and insufficient”. Penalties are set by national authorities under national law, and the FAQ notes that the AI Act itself creates no criminal offences. The FAQ describes supervision as starting in August 2026 and still shows the pre-Omnibus proposal in places, so check it again before you rely on a specific line.

In practice, a defensible file contains four items:

1. An inventory of the AI systems your people use, by team. You cannot tailor training to tools you have not found, which is why shadow AI discovery comes first.
2. A role map that sets the literacy needed for each group, from general awareness to hands-on oversight.
3. Dated records of what each group received: session, e-learning module, guidance note or supervised practice, plus attendance.
4. A review date, so the programme tracks new tools and the Board’s forthcoming recommendations on European competence frameworks.

What does a three-tier programme look like? (illustrative example)

The example below is illustrative, not a benchmark. It sizes a programme for a 400-person consulting firm, using the duty’s own variables: knowledge, context of use and affected people.

Tier	Who	Content	Cadence
1. Everyone	All 400 staff plus active contractors	What generative AI can and cannot do, confidentiality rules for client data, firm AI usage policy	At onboarding, then yearly
2. Heavy users	Consultants and developers using AI daily on client work	Verifying outputs, citing sources, prompt and data hygiene, client disclosure rules	Two hands-on sessions per year
3. Oversight roles	Recruiters using screening tools, engagement leads who sign off AI-assisted deliverables	Bias and error patterns, when to override, escalation path, logging decisions	Before first use, then after each tool change

Each tier should end with a short check of understanding. Article 4 does not require measuring anyone’s knowledge, but the check shows that the content landed and gives you a dated artefact for the file. The Fruggr guide to AI governance training goes deeper on building the programme itself.

US and Canada implications

Article 4 reaches beyond the EU. Under Article 2 of the AI Act, providers and deployers established outside the Union are in scope when the output of their AI systems is used in the Union. A US or Canadian consulting firm that delivers AI-assisted work to a client in France or Germany can therefore be in scope for its own staff, even with no EU office. Confirm scope with counsel.

On the US side, there is no federal AI literacy mandate, but the NIST AI Risk Management Framework covers the same ground. Its GOVERN 2.2 subcategory says that “the organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.” A programme built to satisfy Article 4 can be mapped to GOVERN 2.2 with no extra training, and a firm that already follows NIST AI RMF starts ahead. In Canada, the federal AI bill (AIDA) died with Bill C-27 in January 2025, so no federal statute sets a literacy duty. Provincial rules and client contracts may still impose AI-training terms, so review your master services agreements for them.

What should an HR leader do this week?

1. Ask IT and each practice lead for the AI tools in use, including personal accounts used for client work.
2. Draw the tier map above and name an owner for each tier.
3. Pull any existing AI training records into one dated register, and note the gaps by group.
4. Add AI literacy duties to subcontractor onboarding and to your standard contract schedule.
5. Set a six-month review date and a trigger to review early when a new AI tool enters delivery.

Next step: Start the inventory your literacy plan depends on: see where AI tools are used across your organisation with Fruggr’s Shadow AI detection.

FAQ

This article was drafted with AI assistance and reviewed by our editorial team before publishing.