Digital Omnibus and the EU AI Act AI Literacy Obligation: What Changed

From proposal to adopted regulation

The European Commission proposed the Digital Omnibus on AI on 19 November 2025 as a set of targeted amendments to the AI Act and to the regulation on common rules for civil aviation. Much commentary since then has treated it as pending. That is now out of date. Regulation (EU) 2026/1744 of 8 July 2026 amends Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230, and the AI Act is among the instruments it changes.

The recitals of the adopted act state that Article 4 of the AI Act should be amended. They describe the existing provision as an obligation on all providers and deployers of AI systems to ensure AI literacy of their staff. The stated reasons are that stakeholders reported such stringent obligations would not suit all types of providers and deployers, and that data indicated an additional compliance burden, particularly for smaller enterprises.

The recitals do not treat AI literacy as optional. They say it should be a strategic priority regardless of regulatory obligations and potential sanctions. They also describe literacy as starting from education and training and continuing as lifelong learning, giving providers, deployers and other affected persons the skills to make informed decisions about deploying AI systems.

Article 4 before and under the Digital Omnibus recitals

The table separates what is stated about the original provision from what the Omnibus recitals say about the reason for change. Compliance owners should read the operative wording of the amended Article 4, and its application date, before changing program scope.

• Who is addressed: Original: providers and deployers of AI systems. Omnibus recitals: the duty is described as applying to all providers and deployers, and the amendment responds to the view that it does not suit every type of provider or deployer.
• How the duty is framed: Original: Commission pages describe measures to support the development of AI literacy of staff and of other persons using AI systems on their behalf. Omnibus recitals: the current duty is described as ensuring AI literacy of staff.
• Stated reason for change: Omnibus recitals: stringent obligations create additional burden, particularly for smaller enterprises.
• Policy direction: Omnibus recitals: AI literacy is a strategic priority regardless of obligations and potential sanctions.
• Date of application: Original Article 4: applied from 2 February 2025. Commission guidance pages continue to describe it that way as of November 2026.

Reading the two formulations of the duty

Two descriptions of the original duty are in circulation. Commission pages describe a requirement to take measures to support AI literacy of staff and of other persons dealing with the operation and use of AI systems on their behalf. The recitals of the Omnibus summarise it as an obligation to ensure AI literacy of staff. These are different framings. One emphasises measures taken, the other an outcome.

That difference matters for evidence. A program that can show only that training was delivered supports the first framing weakly and the second hardly at all. A program that can also show who uses which AI systems, what competence was expected for each role, and what use was permitted is defensible under either. The practical conclusion does not depend on how the amended text resolves the wording: competence, not attendance, is the thing to be able to demonstrate.

Supervision and what stays in place

Enforcement of the AI Act is shared between the Commission's AI Office, the European Data Protection Supervisor and national competent authorities designated by the Member States. A regulator or auditor reviewing an AI literacy program is therefore most likely to be a national authority, and organisations should plan for questions about their own program rather than about the Omnibus.

The recitals refer to potential sanctions for AI literacy, but this page does not state penalty amounts or liability rules for Article 4. Those should be confirmed with counsel against the applicable text and national implementing rules.

After Article 4 began to apply, the AI Office launched a repository of AI literacy practices. The AI Act Service Desk describes its aim as encouraging learning and exchange among providers, deployers and the wider public. It is a source of ideas for program design. It should not be presented internally as a compliance standard or as a presumption of conformity.

What to keep and what evidence to retain

The recitals describe relief for smaller enterprises and a continued strategic priority for literacy. They do not describe existing programs as redundant. Pausing a program on the strength of the amendment alone would be premature. Reworking one before the operative wording and application date of the amended Article 4 have been read against your role as provider or deployer carries the same risk.

The following is editorial guidance on defensible evidence, not a list prescribed by the regulation. It applies whichever way the amended wording is read.

• Training content and completion records, with dates and versions, for staff and other persons using AI systems on your behalf
• A role mapping that links each group of users to the AI systems they use and the competence expected of them
• Assessments or other checks showing competence, not only attendance
• Written policy on permitted and prohibited AI use, with approval and revision history
• Records of exceptions, escalations and human approvals for restricted uses
• A change log showing how the program was reviewed after Regulation (EU) 2026/1744

Where runtime policy enforcement fits

Training tells staff what they should and should not do. It does not show what actually happened when they used an AI system. Evidence of permitted use therefore has two parts: a record that people were taught the rules, and a record that the rules were applied during use. The second part complements training records. It does not replace them, and it does not by itself demonstrate competence.

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Individual interactions and tool calls are allowed, redacted, blocked, rate limited or escalated for human approval, and enforcement is applied at runtime, not reviewed after the fact. That enforcement produces audit-ready evidence mapped to the EU AI Act, among other frameworks. This evidence can sit alongside role mapping, policy records and training data in an Article 4 file. It does not mean Trussed satisfies Article 4 on its own, because the obligation concerns people and their competence, which technical controls cannot establish.