I have been fielding the same question from legal teams and HR directors for three months now: "Didn't they weaken Article 4? Can we stop worrying about AI training?"
The short answer is no. The longer answer is more interesting -- and more important for anyone making decisions about AI competence programmes right now.
What happened on 19 November 2025
The European Commission published the Digital Omnibus on AI (COM(2025) 836). It is a legislative proposal -- not a law. It proposes amending the EU AI Act in several ways, the most significant being a change to Article 4.
Article 4 today says that providers and deployers of AI systems "shall take measures" to ensure AI literacy of their staff. This has been binding law since 2 February 2025. The word "shall" creates a direct obligation on every company using AI in Europe. Documented. Enforceable. Up to EUR 15 million or 3% of worldwide turnover.
The Omnibus proposes converting this into a softer duty on Member States to "encourage and foster" AI literacy. Companies would no longer face a direct obligation under Article 4 specifically.
Strip away the political packaging and the proposal does one thing: it moves the burden from companies to governments. Instead of "you must train your people," it becomes "your government should encourage you to train your people."
What the analysts say
The legal community has been tracking this carefully. Here is where the major firms stand:
Travers Smith analysed the Commission's May 2025 Q&A on Article 4 and concluded that the bar was already set higher than most companies realised. Their key finding: "merely directing staff to user manuals is generally not considered sufficient." The Commission was tightening interpretation even as it prepared to loosen the obligation.
Ropes & Gray identified five critical takeaways from the same Q&A. The most important for the Omnibus discussion: Article 4 non-compliance is not a standalone fine -- it is an aggravating factor that increases penalties for other AI Act violations. This means even if the direct Article 4 obligation softens, failing to train staff could still escalate fines for other breaches. The aggravating factor mechanism may survive any Omnibus amendment.
Latham & Watkins framed Article 4 as a first-wave obligation alongside the prohibited practices provisions. Their briefing made the case that organisations should not wait for potential amendments -- the compliance timeline is already compressed.
DLA Piper tracked national authority designation timelines and found many Member States were already delayed. If governments are struggling to set up enforcement bodies on schedule, the likelihood of Parliament adopting the Omnibus quickly is low.
CEN/CENELEC, the body responsible for harmonised AI standards, missed its August 2025 deadline entirely. In October 2025, they adopted "exceptional acceleration measures" targeting Q4 2026 for the first harmonised standard (prEN 18286). The Omnibus partly responds to this delay by extending compliance timelines for high-risk systems.
The CIPL (Centre for Information Policy Leadership) published detailed best practices for Article 4 in May 2025, recommending integration with broader strategy, top-down sponsorship, and continuous improvement. hessian.AI published a systematic whitepaper on AI literacy requirements in October 2025 with an integrated competence model. Both documents assume the binding obligation remains.
Where the Omnibus stands today
Here is the legislative reality as of April 2026:
| Stage | Status |
|---|---|
| Commission proposal | Published 19 November 2025 |
| Parliament first reading | Not yet scheduled |
| Council position | Not yet adopted |
| Trilogue negotiations | Not started |
| Expected adoption | Most analysts say not before late 2026 at earliest |
The current binding Article 4 remains fully in force until the Omnibus completes the entire legislative process -- Parliament vote, Council agreement, publication in the Official Journal. This process typically takes 12 to 24 months. It has not started.
Meanwhile, national enforcement powers activate in August 2026. The Omnibus will almost certainly not be adopted before then.
What does NOT change under any scenario
This is the part most people miss.
The Omnibus only proposes softening the general AI literacy obligation in Article 4. It does not touch the specific competence requirements for high-risk AI systems:
- Article 26 (Deployer Obligations) requires human oversight by persons with "necessary competence, training and authority." Unchanged.
- Article 14 (Human Oversight) requires trained, authorised individuals who can effectively intervene. Unchanged.
- Annex III high-risk classification -- employment AI, credit scoring, insurance pricing, clinical decision support, biometrics -- all unchanged.
- Article 27 (Fundamental Rights Impact Assessment) -- unchanged.
Let me be precise about why that matters. If your organisation uses AI in hiring, credit scoring, insurance underwriting, clinical decisions, or any other Annex III category, your training obligation survives the Omnibus entirely. The people overseeing those systems must be demonstrably competent. Documented. Assessed. This is not affected by any proposal on the table.
For banking and finance, DORA adds an independent layer of ICT competence requirements that captures AI systems. For healthcare, the Medical Devices Regulation requires competent use of Software as a Medical Device. For employment, German works council co-determination rights (BetrVG Section 87) create obligations that exist entirely outside the AI Act.
The regulatory stack does not shrink even if one layer softens.
Three scenarios for what happens next
Scenario 1: Omnibus is adopted as proposed. Article 4 becomes a soft duty on Member States. Companies lose the direct general obligation but keep all high-risk requirements. Member States create national AI literacy promotion programmes. This could actually increase demand for structured training as governments look for delivery partners.
Scenario 2: Omnibus is not adopted or stalls in Parliament. Article 4 remains binding. Enforcement begins August 2026. Organisations without documented training programmes are exposed. This is the highest-risk scenario for companies that paused their compliance efforts.
Scenario 3: Parliament compromise. The Parliament has historically been more protective of AI regulation than the Commission. A compromise could preserve the Article 4 obligation but add explicit proportionality qualifiers or SME exemptions. Based on precedent, this is the most likely outcome.
What you should do right now
Do not wait for the Omnibus.
The pattern is unambiguous. I watched organisations delay GDPR compliance waiting for the regulation to be "clarified" or "softened." The regulation was adopted largely intact. The clarification came through enforcement actions, by which point it was too late to build a programme.
Here is the minimum defensible position:
- Know what AI systems you use. An inventory. You cannot train people on systems you have not identified.
- Assess which are high-risk. If any are in Annex III categories, your training obligation is binding today and will not change.
- Document your training. Written policy. Training records. Even a two-hour awareness session is better than nothing -- if it is documented.
- Make it proportionate. A 50-person company needs a different programme than a 5,000-person bank. Document why your approach fits your size and risk.
- Review annually. AI changes fast. A training programme from 2025 will be outdated by 2027.
The question is not whether Article 4 will remain binding in its current form. The question is whether, when an inspector or a client or an insurer asks what you have done, you have an answer.
If your answer is "we were waiting for the Omnibus," that is not an answer. It is an admission.
This analysis reflects the legislative status as of April 2026. The Omnibus is an active legislative proposal and its final form may differ significantly from the Commission's original text. Organisations should monitor developments and adjust their compliance strategies accordingly.
For a structured assessment of your organisation's AI competence obligations, take the Twin Ladder Assessment.