AI Literacy: Lighter Rule, Higher Stakes

Buried in the Digital Omnibus that Brussels agreed last month is a quiet change to one AI Act duty. It is the duty most organisations have handled worst: AI literacy. The wording is set to ease, from ensuring a sufficient level of literacy to merely supporting its development, once the text is in force. On paper the rule got lighter. In practice the pressure behind it has never been higher. The AI literacy duty has applied since February 2025. The headline high-risk rules everyone watched are the ones that won the reprieve, not this.

That gap is the story. The obligation nobody could see moving is the one that already binds you.

What the Digital Omnibus changed about AI literacy

Article 4 of the AI Act has applied since 2 February 2025. No obligation in the regulation reaches wider. Every provider and deployer falls under it, whatever the risk level of the systems they run. That reach extends to staff and anyone operating AI on the organisation’s behalf.

The Commission’s original Omnibus proposal tried to lift this weight off organisations and hand it to Member States. The final text rejected that. Providers and deployers keep the duty, and the Commission and Member States take on a promotion role on top. What is set to change is the wording. The AI literacy obligation would shift from ensuring a sufficient level to taking measures that support its development, an obligation of effort rather than result. This is agreed but not yet law: until the amendment is published in the Official Journal, the original 2024 wording, ensure a sufficient level, still binds.

Effort, not result

The practical reading is narrow. You take appropriate steps, training and guidance suited to each role. No rule sets a fixed level of AI literacy for you to hit or to measure. That would be a real change in the letter of the rule once it is in force, and it is easy to mistake for a change in the stakes. To anyone skimming the headlines, it sounds like one more piece of relief in a package built around delay.

It is not, for three reasons.

Why the softer AI literacy duty is the more urgent one

• Enforcement arrives on schedule. Supervision of Article 4 passes to national market surveillance authorities from August 2026. That is the same month the wider AI Act machinery stands up, and a missing programme becomes an aggravating factor the moment any other breach is examined.
• Liability is already live. If an untrained employee leaks client data or leans on a biased output, the organisation carries it. The absence of a documented programme makes the defence far harder.
• The real bar is social, not statutory. A supervisor, a client or a board will judge what counts as sufficient. They measure it by what a competent peer would do, not by the softened letter of the rule.

None of those pressures eased when the wording did. If anything the softer text widens a gap. What the law now asks on paper sits well below what everyone around you will expect in the room.

What the skills agenda signals

Look at what Brussels did in the very week it softened the rule. The Cedefop conference on skills, productivity and job quality ran on 29 and 30 June, as the flagship of the European Skills and VET Week. It framed workplace learning as the route to competitiveness, and addressed AI’s effect on jobs head on. This is not a compliance event. It is industrial strategy.

Read the two moves together and the direction is plain. The letter of the AI literacy rule got lighter, and the institutional weight behind skills got heavier. Brussels is not treating literacy as a box to tick. It is treating it as the thing that decides whether European firms stay competitive as AI spreads through their work. That makes AI literacy a competitiveness question, not only a compliance one.

For an organisation, that reframes the whole exercise. AI literacy stops being a way to dodge a fine. It becomes a capability to build, on the same footing as the AI tools themselves.

What defensible AI literacy looks like now

Start with what you actually run. An inventory of where AI sits in the organisation, and who touches it, is the foundation. Most organisations still do not have one. That map is also the fastest way to see where AI literacy is thinnest. Group the workforce by how they use AI, from the board that sets strategy to the teams that run systems each day. Then match the depth of training to the stakes of each role.

Then keep the receipts. The duty is one of effort, so the evidence of effort is what matters. A supervisor or a court will want to see what you assessed, what you provided, and to whom. High-risk deployers carry more. The obligation to train staff for human oversight under Article 26 did not soften in wording, but unlike the literacy duty it is not live yet: its date rides with the high-risk package, 2 August 2026, moving to 2 December 2027 for standalone Annex III systems once the Omnibus is in force.

A softened rule is not a smaller job. It is the same job with less external structure telling you how to do it. That is harder to get right, not easier.

Where this leaves you

The high-risk reprieve bought real time on the most complex tier of the Act. The AI literacy duty did not get that reprieve. The skills agenda around it is accelerating, not winding down. Read the softer wording as a floor, not a ceiling. It is the least you must do, in a year when your regulator, your clients and your board all quietly expect more. Future Prep is tracking the enforcement build-up into August, so the near-term duties stay in view.