The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) establishes binding obligations on providers and deployers of AI systems. Article 4 imposes a requirement for AI literacy measures. This obligation has applied since 2 February 2025. It was amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744). For providers of high-risk AI systems, literacy and competence expectations are further reinforced by the Quality Management System required under Article 17 and elaborated in EN 18286:2026.
As amended, Article 4(1) of the EU AI Act states:
"Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."
The Act defines "AI literacy" in Article 3(56) as the skills, knowledge and understanding that allow providers, deployers and affected persons to make informed decisions about the deployment of AI systems, and to gain awareness of the opportunities and risks of AI and the possible harm it can cause.
The key legal elements under the amended Article 4 are:
Supervision and enforcement of Article 4 fall to national market surveillance authorities, with formal supervisory powers applying from August 2026. There is no general SME exemption, although measures may be proportionate to organisational size and the nature of the systems used.
Although the Omnibus removed the duty to ensure a fixed "sufficient" level for every individual, the amended text still requires measures that take into account knowledge, experience, education, training, context of use and affected persons. A single generic awareness module for all staff does not satisfy that requirement.
Different roles interact with AI systems in materially different ways:
An AI system used in employment, education or law enforcement carries different risks from an internal administrative tool and therefore demands different literacy and competence measures. Role- and context-specific design remains the practical way to meet the "taking into account" elements of Article 4.
For providers of high-risk AI systems, Article 17 requires a documented Quality Management System. EN 18286:2026 (Artificial intelligence - Quality management system for EU AI Act regulatory purposes), published in July 2026, provides the detailed blueprint for that system.
Clause 7.2 (Competence) requires the provider to:
Clause 7.4 (Awareness) requires that persons doing work under the provider's control are aware of the quality policy, relevant quality objectives, their contribution to the effectiveness of the QMS, and the implications of not conforming with QMS requirements.
These requirements go beyond the softened horizontal Article 4 duty. General AI literacy remains the foundation. Role-specific competence for risk management, data governance, design and development control, testing and validation, human oversight, post-market monitoring and serious-incident handling sits on top of it. Training records, competency determinations and effectiveness evaluations become part of the documented information retained under the QMS and form part of the evidence base for conformity assessment.
Article 4 applies to all providers and deployers of AI systems. EN 18286 competence and awareness requirements apply to providers operating a QMS for high-risk AI systems (and support presumption of conformity with Article 17 once the standard is cited in the Official Journal).
In practice:
Organisations that only implement light, generic Article 4 measures may still fall short of EN 18286 if they place high-risk systems on the market. Conversely, a well-designed competence management process under EN 18286 will typically satisfy the supporting-measures expectation of the amended Article 4 for the roles it covers.
Non-compliance with Article 4 is an infringement of operator obligations under the Act. Competent authorities may issue orders requiring practices to be brought into compliance, restrict or prohibit use or placement on the market of the AI system concerned, or require corrective actions.
For high-risk systems, gaps in competence and awareness under the QMS can also undermine conformity with Article 17 and related obligations (risk management, human oversight, post-market monitoring). Weak literacy and competence evidence can aggravate findings in other areas and increase the likelihood of enforcement action or unsuccessful conformity assessment.
The Omnibus amendment reduced the risk of being held to an undefined individual competency standard under Article 4. It did not remove the duty to take supporting measures, nor did it dilute the competence requirements that sit inside EN 18286:2026 for high-risk providers.
Article 4, as amended, requires providers and deployers to take measures that support the development of AI literacy, taking into account knowledge, experience, education, training, context of use and affected persons. It does not require a guaranteed literacy level for every individual. Role- and context-specific measures remain the practical way to meet that obligation.
For high-risk AI systems, EN 18286:2026 adds concrete competence and awareness requirements inside the Quality Management System. Organisations that treat literacy and competence as managed, role-specific processes - with records, effectiveness evaluation and continual improvement - align with both the amended Article 4 and the standard that underpins Article 17 conformity.
