Reading time: 11 minutes
EU AI Act Article 4 training requirements: what companies must do after the Digital Omnibus (2026)
Since 27 July 2026, Article 4 of the EU AI Act requires companies to take measures to support their staff's AI literacy - but no longer to guarantee any specific level per person. Here is what the current text requires and how to build a compliant plan.
Article 4 of the EU AI Act, as amended by the Digital Omnibus (Regulation 2026/1744, in force since 27 July 2026), requires companies to take measures to support their staff's AI literacy. The obligation is still mandatory - the verb is "shall take" - but the Regulation no longer requires providers or deployers to guarantee any specific level of AI literacy for any individual. That distinction matters: a company that has taken no training measures at all remains in breach; a company that has taken proportionate measures, even if some employees haven't reached a specific level, complies.
The new paragraph 1 states that providers and deployers "shall take measures to support the development of AI literacy of their staff", taking into account their technical knowledge, experience and the context in which the systems are used. It then adds a sentence that wasn't there before: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."¹
Recital 8 of the Omnibus explains why. Strict obligations to ensure a sufficient level would not be appropriate for every type of provider and deployer, and they created additional compliance burden, especially for small businesses.¹
| Original text (2024) | Current text (since 27/07/2026) | |
|---|---|---|
| Core verb | Ensure a sufficient level | Take measures to support its development |
| Level required per person | Implicit ("sufficient") | None specific, by express wording |
| Proportionality criteria | Knowledge, experience, context of use | The same |
| Role of the Commission and Member States | Not provided | Support companies, especially SMEs, and publish practical examples |
| High-risk obligations (Annex III) | 2 August 2026 | 2 December 2027 |
In practice, Article 4 moves from an obligation of result to an obligation of means. The point is no longer to prove that every employee knows enough. It is to prove that the company did something reasonable and proportionate to help them learn.
The hasty reading of the Omnibus is "we no longer need to train anyone". That reading is wrong for four reasons.
First, the obligation is still there. The verb is "shall take", not "may take". A company that uses AI and has taken no measures at all is still in breach.
Second, there is still no size threshold. It applies equally to an SME using a writing assistant and to a multinational running its own models. What changes is that the text now explicitly asks the Commission and Member States to give smaller companies more help.
Third, the proportionality criteria are unchanged. A generic module that ignores which systems each person uses, and on whom, is hard to defend as a measure adapted to context.
Fourth, and most relevant for HR, postponing high-risk rules doesn't remove them. Article 26 of the Regulation, untouched by the Omnibus, requires deployers of high-risk systems to assign human oversight to people with "the necessary competence, training and authority". Systems used for recruitment, performance evaluation or task allocation are listed in Annex III, and that requirement applies from 2 December 2027.² That kind of training can't be improvised in November 2027.
On penalties: Article 4 never had its own fine under the Regulation's penalty regime. In Spain, the national sanctioning regime depends on the draft Organic Law on the proper use and governance of AI, which the government sent to Parliament in May 2026 and which is still going through it.³
Beyond the law, there's an operational reason. A sales rep pastes a client contract into a public chatbot to get a summary of the terms. An HR specialist accepts, without review, the candidate ranking returned by a screening tool. Neither case depends on whether Article 4 says "ensure" or "support". They are data protection, discrimination and reputational risks that already existed, and training reduces them.
What does change is the tone of the plan. Many companies used to design it to survive an inspection with a deadline looming. Now it can be designed for what it should have been from the start: people using the tools they already have properly, on a reasonable timeline, without the pressure of a date the legislator itself has admitted was hard to meet.
The Regulation doesn't set content, so this list is a reference structure that works well in practice. How deep each block goes depends on how AI is actually used in each role.
| # | Competency | What it means in practice |
|---|---|---|
| 1 | General understanding of AI | What it is, how it works, which systems the company uses, opportunities and risks |
| 2 | Organisational role | Whether the company develops or deploys AI, and what each position implies |
| 3 | Risk assessment | Risks of the systems each person uses: hallucinations, bias, data leaks |
| 4 | Contextual technical training | Adapted to the level, sector and specific tools of the role |
| 5 | Responsible use | Data protection, what not to share with public tools, human oversight |
| 6 | Interpreting outputs | Reviewing AI recommendations and knowing how to verify them |
| 7 | Basic legal framework | AI Act, GDPR as it applies to AI, company obligations |
An operator working with a predictive maintenance system mainly needs blocks 5 and 6. Whoever runs HR or legal also needs 2, 3 and 7. That's why organising the plan by levels makes sense.
Splitting the plan by each role's exposure to AI fits the proportionality criterion, which is exactly the part of Article 4 the Omnibus left intact.
| Level | Audience | Main content | Indicative duration |
|---|---|---|---|
| Basic | All staff who use AI | What AI is, safe use, when not to trust the output, personal data | 2-4 h |
| Intermediate | Heavy users (marketing, HR, customer service, operations) | Role-specific use, spotting bias, critical review of outputs | 6-10 h |
| Advanced | Managers, legal, IT, anyone overseeing high-risk systems | Risk management, the AI Act in depth, governance, documentation | 10-20 h |
The hours are indicative and nobody requires them. Under the current text, what an organisation needs to be able to explain is why it chose that split for its systems and risks, not that it hit a number.
With an obligation of means, documentation changes its job. It no longer proves that each person reached a level. It proves that the company took measures and that they were proportionate. Four pieces cover almost everything.
Which AI-enabled tools are used, in which departments and for what. Include third-party software with built-in AI features. It's the basis for justifying any proportionality decision.
What each profile can use, for which tasks and within what limits, for example which data never goes into public tools. It doesn't need to be long; it needs to exist and be easy for staff to find.
Who received which training, when and with what content. A light assessment is no longer mandatory to prove a level, but it's still the best way to know whether the training worked. Platforms that export in SCORM or xAPI produce this record without manual work, and people management systems such as Sesame HR make it possible to cross-reference it with role changes, which is usually when a new tool shows up.
For anything that might fall under Annex III (recruitment, evaluation, task allocation, access to services), identify who oversees each system and what training they'll need before 2 December 2027. This is the document that gained the most breathing room from the Omnibus, and the easiest one to leave for later.
For companies operating in Spain, digital and AI skills training can be subsidised through FUNDAE. The annual credit depends on the vocational training contributions paid the previous year and on headcount.⁴
| Headcount | Available credit |
|---|---|
| 1-5 people | Guaranteed minimum of 420 euros |
| 6-9 people | 100% of vocational training contributions |
| 10-49 people | 75% |
| 50-249 people | 60% |
| 250 or more | 50% |
For the subsidy to apply, the start of each group must be notified to FUNDAE at least two days before it begins, and the training documentation must be kept. If there's unused credit left this year, the basic level of the plan is a good candidate. Here's how FUNDAE credit works with AI video training.
The challenge is rarely designing the plan. It's producing it and, above all, keeping it current. A company's AI systems change several times a year, and the Regulation itself has changed once since it came into force. A course recorded in 2025 that talks about "ensuring a sufficient level" already contains an error.
That's why it pays to start from internal documentation that already exists (the use policy, tool guides, procedures) and to choose formats that can be edited without re-recording. AI video platforms such as Vidext let you update a module by changing the script instead of rebuilding the piece, which saves weeks in a regulatory area that keeps moving. Here's a step-by-step guide to digitising internal training with AI.
Without 2 August as a deadline, the timeline can be ordered by risk rather than urgency.
October to December 2026. Systems inventory, use policy by role and launch of the basic level. This is what reduces day-to-day risk the most and what any supervisor will ask for first.
First half of 2027. Intermediate level for heavy users, starting with teams that handle customer or employee data.
Second half of 2027, before 2 December. Advanced level for whoever will oversee high-risk systems, with the Annex III map closed and the training recorded.
In large organisations, the bottleneck is rarely producing the content. It's usually agreeing who approves the policy, who signs off the inventory as complete, and who has room in their diary to push it forward. Those steps eat weeks that don't appear on any timeline.
The Digital Omnibus didn't remove AI training from the Regulation; it removed the countdown. What remains is a more reasonable obligation and, for that very reason, one that's harder to tick off with a generic course: showing that the company thought about which systems it uses, who uses them and what each person needs to know. Organisations that use the time until December 2027 to build that plan calmly will reach the high-risk deadline with the work already done.
Yes. The current Article 4 requires measures to support the AI literacy of staff who use these systems. What disappears is the requirement to guarantee a specific level for each person.
The Regulation doesn't assign a specific fine to Article 4. National penalty regimes are set by each Member State; in Spain, the governance law is still going through Parliament. Even so, having taken no measures at all can weigh in the assessment of other breaches of the AI Act or the GDPR.
Yes. A company using Copilot, Gemini or HR software with built-in AI is a deployer under the Regulation, and Article 4 applies.
They can form part of the plan if they're complemented with content on the company's actual systems and risks, and completion is recorded. A generic course without that context fits poorly with the proportionality criteria, which are still in the text.
¹ Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), Article 1, point 5, and Recital 8. OJ L, 24.7.2026 ² Regulation (EU) 2024/1689, Article 26(2) and Annex III, consolidated version after Regulation (EU) 2026/1744 ³ La Moncloa, Council of Ministers briefing, 26 May 2026 ⁴ FUNDAE, frequently asked questions on training credit
Programme to promote permanent employment of qualified young people within the framework of the National Youth Guarantee System. Vidext has received a grant of €25,401 awarded by LABORA (Valencian Employment and Training Service) for the permanent hiring in 2024 of qualified young person(s) registered in the National Youth Guarantee System, an action eligible for co-financing by the European Social Fund Plus (ESF+) 2021-2027 or any other European Union fund. Expediente ECOGJU/2024/550/46. This publication is made in compliance with the transparency obligations established by Spanish Law 19/2013 of 9 December.
