Since 2 February 2025, using AI has carried an AI-literacy duty of its own, separate from the obligations on those who build it. Regulation (EU) 2026/1744 rewrote the article in July 2026: the duty is now to take measures that support literacy, not to ensure a level. Most organisations in scope have not noticed, because the article is short and carries no penalty of its own.
Article 4 of the EU AI Act (Regulation (EU) 2024/1689) requires providers and deployers of AI systems to take measures to support the development of AI literacy among their staff and any other person dealing with the operation and use of AI systems on their behalf. The text now adds that this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”.
Two words carry most of the weight. Deployer means the organisation that uses an AI system in its work, as distinct from the company that built it. If your programme officers use a chatbot to draft donor reports, you are a deployer. On their behalf reaches past your payroll to contractors, consultants and outsourced operators.
The obligation is now effort-based. It does not prescribe a course, a certificate or a number of hours, and it no longer asks you to guarantee an outcome. It asks what measures you took, and whether they were proportionate to the people and the use. Being able to show those measures is the practical test.
Regulation (EU) 2026/1744, the “Digital Omnibus” on AI, was published in the Official Journal on 24 July 2026 and replaced Article 4 in full. The same act moved the high-risk obligations to 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems). Article 4 itself was not delayed.
| Point | Before | Now |
|---|---|---|
| The duty | Take measures to ensure, to their best extent, a sufficient level of AI literacy | Take measures to support the development of AI literacy |
| Guarantee | Not addressed | No duty to guarantee any specific level for any individual |
| Who must act | Providers and deployers | Unchanged, including persons acting on their behalf |
| Public bodies | No role | The Commission and Member States support and facilitate; the AI Board adopts recommendations |
| Applies since | 2 February 2025 | 2 February 2025, unchanged |
What this means in practice. The legal exposure is lower than the earlier wording suggested, and the artefacts below still matter: a funder, a board member or an auditor asks what you did, whatever the text of the Act says. Policies, slides and funder responses that quote the old “sufficient level” wording should be revised. This is a change of emphasis, not a reason to stop. Switzerland is outside the EU, so the Act reaches a Geneva organisation only through its EU-facing activity and contracts.
| Organisation | Why it is in scope | Usual reaction |
|---|---|---|
| An NGO with EU operations or EU funding | Deploys AI systems in the Union, or places their output there | “We don't build AI, so this isn't about us.” The article is about deployers |
| A Geneva-based international body with EU activity | Same, wherever the headquarters sits | Assumes privileges and immunities settle the question. Donor and partner contracts often do not |
| Any organisation using contractors | The duty covers persons operating AI on your behalf | Training covers employees only. Consultants and field partners are missed |
| Organisations whose staff use free AI tools informally | Unsanctioned use is still use, and the organisation still carries it | “We have no AI systems.” Two-thirds of professionals report using AI at work believing it was not permitted |
Five artefacts show the measures taken, and an organisation that holds them is also one where AI is used well.
| Artefact | What it shows | Where it comes from |
|---|---|---|
| An AI use policy | That the organisation has decided what is permitted, by whom, with which data | Written once, approved by the board, reviewed twice a year |
| A tool inventory | Which AI systems are in use, for what purpose, on what data | Falls out of the readiness assessment |
| Role-mapped training | That training was proportionate to role rather than one generic session for everyone | One organisation-wide session plus a lab per department |
| An attendance record | Who received which training, and when | Kept at delivery. Trivial to produce, impossible to reconstruct later |
| A re-assessment | That literacy is maintained as tools and roles change rather than asserted once | Re-score at 90 days, then at six or twelve months |
Ask, without consequences attached, which AI tools people already use and what they put into them. You cannot govern what you have not counted.
Run a readiness assessment across the organisation. It produces the tool inventory, the gap list and the number you will be measured against later.
A prohibition list moves use out of view and leaves the organisation carrying the risk without seeing it. Say what is allowed, with which data, by whom.
One session on the shared rules, then one per department on that department's real tasks. Keep the attendance record.
Repeat the assessment. Keep the policy, the inventory, the records and both scores together. That folder is the record of your measures.
Every one of these five is something you would want anyway. Article 4 adds little work of its own. It removes one argument for postponing work you would want done anyway.
The readiness assessment produces your baseline score, your gap list and the beginning of your tool inventory in about twelve minutes.