The Competence Obligation Almost Every Company Overlooks

Update from 27 July 2026: this article has been revised to reflect the Digital Omnibus Regulation (EU) 2026/1744, which rewrote Art. 4 as of that date. An earlier version of this article spoke of a strict "ensure" obligation with a competence level to guarantee — that matched the old wording. What's changed and what hasn't is below. We correct ourselves in public; it's exactly what we expect from everyone else.

When people talk about the EU AI Act, most think of high-risk systems, CE marking, and multi-million-euro fines for tech giants. Yet the obligation that actually affects most companies sits right at the front of the law: Article 4 requires companies to take measures to support the development of AI literacy among everyone who operates or uses AI systems on their behalf.

In plain terms: the moment your team uses ChatGPT to draft quotes, Copilot helps with coding, or an AI tool pre-sorts job applications, you are a “deployer” within the meaning of the Regulation — and the competence obligation applies to you. Not from 50 employees onward, not only for high-risk AI. From the very first prompt.

What the new wording changes — and what it doesn't

Until 27 July 2026, Art. 4 required companies to "ensure" that staff had a sufficient level of AI literacy — an obligation of result. The Omnibus Regulation turned this into an obligation to take measures: you no longer have to guarantee a competence level, but you do have to take documented measures suited to the nature of your AI use. Anyone declaring an "all-clear" misses the point: without a documented measure, there is still no chain of evidence to show authorities, customers, or a court.

The level can scale with risk: a marketing team using a text assistant needs a different depth of training than an HR team using an assessment tool. What matters is that you know how AI is used (an AI inventory!), tailor the measures to that use — and can prove both.

Why the evidence matters

Art. 4 carries no fine of its own — but the obligation becomes relevant through market surveillance and in the event of harm: anyone who cannot show that staff were trained for their AI use is in a weak position after a data breach, a wrong decision, or a customer complaint. Documented measures are to Art. 4 what the record of processing activities is to the GDPR: proof that you take it seriously.

In Compliverse, the two therefore belong together: the AI inventory captures which systems are in use, and the built-in training module handles the training itself, complete with quiz and certificate — completing it automatically ticks off the matching measure. That's how you meet Art. 4 in its current form — and get your team to actually use what's already in the tools.