AI Literacy After the Digital Omnibus: What Art. 4 AI Act Still Requires of Life-Sciences Companies

US life-sciences training rules often combine qualifications, instruction and records. Drug-manufacturing personnel must have education, training or experience enabling their assigned functions; 21 C.F.R. § 211.25(a) also requires operation-specific and continuing training in current good manufacturing practice. The HIPAA Privacy Rule generally requires covered entities to train their workforce on relevant privacy policies and document that training, subject to a narrow exception for certain insured group health plans.121 C.F.R. § 211.25(a) and (b); 45 C.F.R. § 164.530(b)(1), (b)(2)(ii) and (k). Neither is simply a choice between a result and a training program. That distinction matters when comparing them with the EU AI Act: its original literacy provision required measures directed at a sufficient level of understanding, qualified by the words "to their best extent".2Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act) [2024] OJ L 2024/1689, Art. 2(2), (6) and (8), Art. 3(56), original Art. 4, Art. 26(2), Art. 113 and recitals 20 and 91.

On 27 July 2026, the Digital Omnibus on AI replaced that formulation with a duty to support the development of AI literacy and expressly excluded any guarantee of an individual's specific level.3Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) [2026] OJ L 2026/1744, recital 8, Art. 1(5) and Art. 4 of Regulation (EU) 2026/1744; published 24 July 2026, in force 27 July 2026. For a US pharmaceutical or device group whose European staff use drafting, literature-screening or coding assistants, the change affects one legal basis for training. It does not determine whether those tools fall within the Act, how an authority can enforce the duty, or which independent rules govern the same employees. A program developed in 2025 cannot answer those questions merely by retaining its original title.

1. What Did the Digital Omnibus Change in the AI Literacy Duty?

The original Art. 4 AI Act applied from 2 February 2025. It required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and others operating or using AI systems on their behalf. The required measures depended on technical knowledge, experience, education and training, the context of use and the persons affected. Art. 3(56) AI Act connects literacy with informed use, awareness of opportunities and risks, and possible harm.2 The sufficient-level language supplied an express objective, but the qualifications prevent it from being read as an unconditional promise that every employee would attain a fixed standard.

The Commission's proposal of 19 November 2025 would have replaced that operator duty with an obligation on the Commission and Member States to encourage literacy measures. Its explanatory memorandum distinguished this proposed change from the training duties for high-risk systems.4European Commission, Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2024/1689 and (EU) 2018/1139 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), COM(2025) 836 final, 2025/0359(COD) (19 November 2025), explanatory memorandum, recital 5 and Art. 1(4) of COM(2025) 836 final. That formulation was not enacted. Descriptions of the Digital Omnibus as removing the company's literacy duty confuse the proposal with the adopted amendment.

The Parliament adopted its position on 16 June 2026 and the Council approved it on 29 June. Regulation (EU) 2026/1744 was signed on 8 July, published on 24 July and entered into force on 27 July 2026. Art. 1(5) of Regulation (EU) 2026/1744 replaces Art. 4 AI Act with three paragraphs, without a later application date for the change.3 Providers and deployers still "shall take measures", now "to support the development of AI literacy". The amendment retains the persons covered and the contextual factors. It then states that the obligation does not require a guarantee of any individual's specific level of literacy.

Recital 8 of Regulation (EU) 2026/1744 identifies the burden of stringent sufficient-level obligations, particularly for smaller enterprises. The enacted text changes the required objective while retaining factors that constrain the choice of measures: knowledge, context and affected persons still matter. The absence of an individual guarantee does not make the measures immune from assessment, and a course suitable for routine drafting may leave different issues unanswered when the same tool assists a safety function.

The amendment changes the literacy standard without eliminating the duty to take measures. It neither certifies an existing training program nor displaces the rules governing the work performed with AI.

The Commission's literacy questions and answers, carrying a 27 July 2026 update date, state that measuring employees' AI knowledge is not obligatory and that no certificate is required. They also describe keeping internal records of training or other initiatives.5European Commission, AI Office, 'AI Literacy - Questions & Answers' (Shaping Europe's digital future, last update stated as 27 July 2026), answers on measuring knowledge and documentation. The page date does not establish the revision history of individual answers. Those statements are administrative guidance rather than additional statutory requirements. Neither the original nor the amended Art. 4 AI Act expressly imposes the training-record duty found in the HIPAA rule.

Art. 4(2) AI Act requires public support and practical Commission examples; Art. 4(3) AI Act requires Board recommendations. These can inform the interpretation of support measures without rewriting the legislation. Separately, Art. 26(2) AI Act requires the persons assigned human oversight of high-risk systems to have the necessary competence, training and authority, with the necessary support. Recital 91 AI Act associates that competence with an adequate level of AI literacy.2 The general literacy duty and this role-specific oversight standard therefore remain distinct.

2. Was the AI Literacy Duty Ever Backed by a Fine?

The omission of Art. 4 AI Act from the list in Art. 99(4) AI Act does not establish that a literacy infringement can never attract a Union-level fine. The ordinary Art. 99 AI Act scheme and the AI Office's separate jurisdiction must be distinguished. Art. 99(3) AI Act covers prohibited practices; Art. 99(4) AI Act lists specified obligations, including high-risk and transparency duties, but not literacy; Art. 99(5) AI Act concerns incorrect, incomplete or misleading information supplied in reply to a request.6AI Act (n 2), Art. 75(1), Art. 75c(4), Art. 99(1) to (6a) and Art. 113; Regulation (EU) 2026/1744 (n 3), Art. 1(31), (32) and (38). For undertakings, the ordinary ceilings are the higher of EUR 35 million or 7%, EUR 15 million or 3%, and EUR 7.5 million or 1% of worldwide annual turnover in the preceding financial year. The lower-of rules for small and medium-sized enterprises, and for small mid-cap enterprises in the latter two tiers, qualify that comparison.

Art. 99(1) AI Act also requires national rules on penalties and other enforcement measures. Since the amendment, it expressly names administrative fines, warnings and non-monetary measures for any infringement by operators. National law remains central to ordinary enforcement of literacy duties outside the AI Office's jurisdiction. The amendment does not itself show which national measures apply to a particular subsidiary, and the application of Art. 99 AI Act since 2 August 2025 must not be confused with the later commencement of the AI Office provisions.

Art. 75c(4)(a) AI Act allows the AI Office to fine infringements of any applicable provision, including provisions absent from Art. 99(4) AI Act, within the limited jurisdiction of Art. 75(1) AI Act. These provisions of Chapter IX AI Act follow the general application date of 2 August 2026.6 One route concerns systems based on general-purpose AI models where the model and system are developed by the same provider or providers in the same undertaking. It excludes product systems under Annex I AI Act, critical-infrastructure systems under Annex III point 2 AI Act, the specified systems of law-enforcement or border authorities and financial institutions under Art. 74(6) AI Act, and systems concerning the administration of justice under Annex III point 8 AI Act. Another route covers systems constituting or integrated into designated very large online platforms or search engines.

That competence applies to providers of the specified systems. It reaches deployers only if they are also the provider or belong to the same undertaking. An independent pharmaceutical customer does not enter the AI Office's jurisdiction merely by subscribing to a model provider's chatbot. Conversely, an operator satisfying those conditions cannot rely on the absence of Art. 4 AI Act from Art. 99(4) AI Act as a complete answer. Whether a group is an independent customer, a system provider or part of the relevant undertaking can therefore change the enforcement route as well as the applicable duties.

3. When Does Art. 26 AI Act Reach an Office Tool?

Art. 4 AI Act applies within the Act's scope, rather than literally to every system. Art. 2(6) AI Act excludes systems and models specifically developed and put into service solely for scientific research and development. Art. 2(8) AI Act separately excludes pre-market research, testing and development, except testing in real-world conditions.2 A research department's use of a general office assistant is not automatically covered by either exclusion. The system's purpose and stage of use matter, as does whether it meets the Act's definition of an AI system.

Within scope, Art. 26(2) AI Act concerns human oversight of high-risk systems. Art. 6(1) AI Act covers the specified product and safety-component cases under Annex I AI Act requiring third-party conformity assessment; Art. 6(2) AI Act covers uses listed in Annex III AI Act, subject to the conditional derogation in Art. 6(3) AI Act.7AI Act (n 2), Art. 2(2), Art. 3(52), Art. 6(1) to (3), Art. 16, Art. 25(1)(c) and (2), Art. 26(2), Art. 111(2), Art. 113 and Annex III points 4 and 5(d). An ordinary assistant used to draft correspondence is not high-risk merely because its user manufactures regulated devices. The same description cannot settle the classification of software integrated into a medical product or repurposed for employee selection. Even literature screening requires attention to the intended use; the label alone supplies no classification.

The general dates for the high-risk duties are 2 December 2027 for systems under Annex III AI Act and 2 August 2028 for Art. 6(1) AI Act systems. For Art. 26 AI Act, the latter comparison concerns Annex I Section A AI Act: Art. 2(2) AI Act subjects systems under Annex I Section B AI Act to a limited set of provisions rather than the full deployer regime. Art. 111(2) AI Act generally brings pre-existing high-risk systems within the requirements only if they undergo significant design changes after the relevant date; it also sets a 2 August 2030 backstop for systems intended for public authorities.7 A single training deadline detached from those conditions can misstate the position.

Employment uses show why a tool's original purchase description is insufficient. Annex III point 4 AI Act includes analyzing and filtering job applications and monitoring or evaluating workers. Under Art. 25(1)(c) AI Act, a deployer that changes a non-high-risk system's intended purpose so that it becomes high-risk can become its provider, with Art. 16 AI Act obligations. The original provider's cooperation duty under Art. 25(2) AI Act does not apply where it clearly specified that the system was not to be changed into a high-risk one.7 How an internal repurposing meets these conditions is a separate issue from whether staff received general literacy training. The Art. 6(3) AI Act derogation requires more than describing work as preparatory, and does not apply to a system under Annex III AI Act that profiles natural persons.

Other duties can apply without a high-risk classification. Art. 50 AI Act addresses particular interactions and content, with distinct provider and deployer obligations. For deployers, Art. 50(4) AI Act covers deep fakes and AI-generated text published to inform the public on matters of public interest. The text exception requires human review or editorial control together with a person holding editorial responsibility.8AI Act (n 2), Art. 50(1) to (4), Art. 53(1) and (2), Art. 99(4)(g), Art. 111(3) and (4), and Art. 113. The separate analysis of AI labels for pharma chatbots and health content examines those boundaries. The general application date of 2 August 2026 does not eliminate specific transitions, including the limited extension for providers' synthetic-content marking under Art. 111(4) AI Act.

Art. 53 AI Act, by contrast, imposes duties on providers of general-purpose AI models, with its own qualifications and transition for older models. A company merely using a tool built on a model does not become the model provider for that reason. These role distinctions prevent a universal list of "office AI duties": the same group may occupy different roles in different deployments, while its training obligations also depend on the work and information involved.

4. Which Training Duties Never Depended on the AI Act?

Data protection can apply when an assistant receives an adverse-event narrative, a physician's correspondence or employee information. Art. 29 and Art. 32(4) GDPR restrict processing under a controller's or processor's authority to the controller's instructions, unless Union or Member State law requires processing. Art. 35(1) GDPR requires an assessment before processing likely to create a high risk; new technology is relevant, not an automatic trigger. Where a data protection officer is designated, Art. 39(1)(b) GDPR includes monitoring awareness and training among that officer's tasks.9Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1 (GDPR), Art. 4(4), Art. 29, Art. 32(4), Art. 35(1), Art. 39(1)(b) and Art. 83(4)(a). Art. 83(4)(a) GDPR sets a ceiling of EUR 10 million or, for an undertaking, 2% of preceding-year worldwide annual turnover, whichever is higher, for the relevant controller or processor infringements. That ceiling neither makes a fine automatic nor makes the officer personally liable. Whether an AI user was appropriately instructed remains a data-protection issue despite the changed literacy wording.

The NIS2 Directive reaches pharmaceutical manufacturing and medicinal-product research entities through Annex I NIS2. Other device manufacturers generally fall in Annex II NIS2, but manufacturers of devices designated critical during a public-health emergency are in Annex I NIS2. Art. 2(1) NIS2 sets the ordinary size threshold; Art. 2(2) and (3) NIS2 provide specified size-independent routes.10Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) [2022] OJ L333/80, Art. 2(1) to (3), Art. 20(1) and (2), Art. 21(2)(g), Annex I point 5 and Annex II point 5(a). A smaller company is therefore not necessarily excluded. The national law transposing the Directive matters to the entity's position and its management obligations.

Art. 21(2)(g) NIS2 includes cyber hygiene and cybersecurity training among risk-management measures. Under Art. 20(2) NIS2, Member States must require management-body members to follow training, while encouraging entities to offer similar employee training. Art. 20(1) NIS2 addresses management approval, oversight and potential liability for the entity's infringements of Art. 21 NIS2.10 Whether a generative tool handling confidential material falls within the risks these measures must address depends on its use and the applicable national regime. The amended Art. 4 AI Act does not resolve that question or replace these distinct duties.

Pharmacovigilance law expressly combines competence and documentation. Art. 10(1) of Implementing Regulation (EU) No 520/2012 requires sufficient competent, qualified and trained personnel. Art. 10(3) of that Regulation requires initial and continued training appropriate to roles and responsibilities, with plans and records available for audit or inspection. Art. 2 point 5(a) of that Regulation places the training concept in the pharmacovigilance system master file; Art. 2 point 3 of that Regulation addresses computerized safety-information systems and their fitness for purpose.11Commission Implementing Regulation (EU) No 520/2012 of 19 June 2012 on the performance of pharmacovigilance activities provided for in Regulation (EC) No 726/2004 of the European Parliament and of the Council and Directive 2001/83/EC of the European Parliament and of the Council [2012] OJ L159/5, consolidated version of 12 February 2026, Art. 2 point 3, Art. 2 point 5(a), Art. 10(1) and (3). Neither version of Art. 4 AI Act contained that express training-record requirement. For a team using AI to screen literature or triage reports, the extent to which its training addresses missed information and unreliable outputs remains a question under the quality system and sectoral rules.

The Commission's 2025 consultation draft for GMP Annex 22 raises a related issue without establishing an adopted standard. Its scope text would exclude generative AI and large language models from critical GMP applications. For non-critical applications, it calls for adequately qualified and trained personnel to remain responsible for the suitability of their outputs; section 2.1 of the draft GMP Annex 22 addresses personnel qualifications and responsibilities.12European Commission, EudraLex Volume 4, Annex 22: Artificial Intelligence (draft for stakeholders' consultation, 7 July to 7 October 2025), sections 1 and 2.1. This is the position in the cited draft, whose consultation ran from 7 July to 7 October 2025. Its eventual form cannot be inferred from the AI Act amendment. It illustrates why a general literacy course and the qualifications expected for a manufacturing function are different questions.

German works-council rights create another distinction. § 90 Abs. 1 Nr. 3 and Abs. 2 BetrVG require timely information and consultation on planned workflows, expressly including AI. Under § 97 Abs. 2 BetrVG, co-determination over in-house training arises when employer measures change employees' activities so their professional knowledge and skills no longer suffice. § 87 Abs. 1 Nr. 6 BetrVG concerns technical monitoring: the Federal Labor Court treats objective capability to monitor behavior or performance as decisive, without requiring the employer's subjective intention to monitor. Whether a particular tool has that capability depends on its functions and circumstances. § 80 Abs. 3 BetrVG deems expert assistance necessary for the works council's assessment of AI within its tasks, without removing the provision's agreement framework.13Betriebsverfassungsgesetz (BetrVG) in der Fassung der Bekanntmachung vom 25. September 2001 (BGBl. I S. 2518), zuletzt geändert durch das Gesetz vom 19. Juli 2024 (BGBl. 2024 I Nr. 248), § 80 Abs. 3, § 87 Abs. 1 Nr. 6, § 90 Abs. 1 Nr. 3 and Abs. 2, § 97 Abs. 2; Beschluss BAG 1 ABR 16/23 vom 16. Juli 2024, ECLI:DE:BAG:2024:160724.B.1ABR16.23.0, para 25; AI Act (n 2), recital 92. These conditions are not displaced by removing the sufficient-level formulation from Art. 4 AI Act.

Switzerland's legislative path is different. On 12 February 2025, the Federal Council announced that it would pursue ratification of the Council of Europe's AI convention and make necessary legislative changes as sector-specific as possible, with a consultation draft due by the end of 2026.14Schweizerischer Bundesrat, 'KI-Regulierung: Bundesrat will Konvention des Europarats ratifizieren' (Medienmitteilung, 12. Februar 2025); Bundesamt für Kommunikation (BAKOM), 'Künstliche Intelligenz' (10. März 2025). That policy does not establish the absence of training or competence duties in Swiss sectoral law, nor does it import Art. 4 AI Act into domestic law. The comparison of Swiss AI regulation and the EU AI Act considers the wider divergence. A Swiss affiliate's exposure to the EU duty instead depends on the Act's territorial rules and the role it actually performs.

5. Strategic Considerations for US Groups With a 2025 AI Literacy Program

An EU subsidiary running a tool can be a Union-established deployer under Art. 2(1)(b) AI Act. Providers based elsewhere can be reached when placing systems on the Union market or putting them into service there under Art. 2(1)(a) AI Act. Third-country providers and deployers can also fall within Art. 2(1)(c) AI Act where the system's output is used in the Union.15AI Act (n 2), Art. 2(1)(a) to (c), Art. 3(4) and Art. 4(1). A New Jersey regulatory-affairs team preparing an EU submission presents a different territorial question from an entirely domestic US workflow. The name on a group-wide training program does not settle which entity owes the duty.

The persons covered introduce a further uncertainty. Art. 4(1) AI Act reaches staff and other people operating or using systems on the provider's or deployer's behalf. A contract research organization, safety vendor or medical-writing agency may also be a deployer in its own right. Whose measures address which personnel, and whether an employee's personal account is used under the employer's authority within Art. 3(4) AI Act, depend on the actual arrangements. An outsourcing contract or informal account choice cannot by itself answer those statutory questions.

A program designed around the original sufficient-level wording may contain measures useful under the amendment. Its design date proves neither its earlier adequacy nor that it exceeds the amended duty. The remaining contextual factors still matter, and records may be relevant under several independent standards: data-protection instructions, pharmacovigilance training requirements or German co-determination. A narrower literacy formulation does not establish that a particular course, assessment or record has become unnecessary for those other purposes.

Internal changes of use can also turn a literacy question into a provider-responsibility question. An assistant used for recruitment or employee assessment may engage the high-risk provisions, their application and legacy rules, and Art. 25 AI Act. Separately, national penalty rules remain important outside the limited AI Office route. The group's systems, corporate relationships and uses therefore affect both substance and enforcement. For management members of an EU entity within NIS2, national training and liability arrangements add questions that the AI Act amendment did not change.10

The unresolved issue is not whether AI literacy survived the Digital Omnibus: the operator duty remains. It is what that duty requires for a particular use, which other rules govern the same people, and what the group's existing program actually demonstrates. Those questions depend on its systems, functions, contractual relationships and jurisdictional footprint.