Article 4 of the EU AI Act no longer requires organisations to ensure a sufficient level of AI literacy; it now requires measures to support it, so documents quoting the old wording need revising.
If your AI policy, your training deck or your funder response quotes Article 4 as requiring you to "ensure, to their best extent, a sufficient level of AI literacy", it is quoting a version of the text that no longer stands.
That phrasing has been replaced. The current Article 4(1) requires providers and deployers to take measures to support the development of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf.
Two paragraphs were also added that were not in the adopted text, covering Commission support and Board recommendations.
"Ensure a sufficient level" describes an outcome. It invites a question with a threshold: is our literacy sufficient? Sufficient by whose measure?
"Support the development of" describes an effort. The question becomes: what measures did you take, and were they proportionate?
That is a genuine shift in the character of the obligation, and it is worth understanding precisely, because the two readings fail in opposite directions.
Under the old wording, an organisation that ran no training but whose staff happened to be capable could argue it had met the standard. Under the current wording, that argument gets weaker: you are being asked what you did.
Conversely, an organisation that ran a single generic session for everyone can now point to a measure taken. On the face of the text, that is closer to compliance than it was before.
Here is where I would be careful, and where I think a lot of advice is about to go wrong.
Read narrowly, the amendment looks like a relaxation, and the temptation is to do less. But the obligation was never the reason to build AI literacy, and the regulation is not the party that will actually inspect you.
The people who will ask are a funder writing a due-diligence questionnaire, a board member who read something alarming, and, if it goes badly, an insurer or a lawyer. None of them are reading Article 4. They are asking whether your staff know what they are doing with beneficiary data.
An effort-based legal standard and a demanding evidential expectation are not in tension. They just have different audiences.
Change: any document you hold that quotes the old wording. Policies, training slides, board papers, funder responses. If it says "ensure a sufficient level", it is citing a superseded text, and someone will eventually notice.
Change: how you describe what you are doing. Frame it as measures taken and proportionality reasoning, not as a threshold cleared.
Does not change: the applicability date. Article 4 has applied since 2 February 2025.
Does not change: who is in scope. "Deployer" and "on their behalf" are untouched, and they remain the two words that pull most organisations in.
Does not change: what a proportionate measure looks like. Role-relevant training, documented, with a record of who attended.
First, I have verified the current wording against a consolidated public rendering of the Act and corroborating practitioner analysis. I have not pinned the exact amending instrument and date to my own satisfaction. Before you rely on this in a policy document, check the consolidated text on EUR-Lex and cite that.
Second, this is general information about a regulation, not legal advice about your exposure. Where a legal opinion is needed, get one.
Search your own documents for the phrase "sufficient level of AI literacy". Everything it appears in needs a revision pass. That is a twenty-minute job today and an awkward conversation later.
If this is the question on your desk, a thirty-minute call tells you whether the service fits, or that you do not need us yet.