The literacy duty after the Omnibus
Article 4, applicable since 2 February 2025, originally required providers and deployers to ensure, to their best extent, a sufficient level of AI literacy among their staff and others operating the systems on their behalf.
Regulation (EU) 2026/1744 rewrites it: they must now take measures to support the promotion of that literacy, taking into account knowledge, experience, the context of use and the people affected, and it is made clear that they do not have to guarantee any particular level in any individual. The Commission will publish practical examples and Member States will support SMEs (Article 4(2)).
The duty still exists, though it is more flexible. The sensible way to demonstrate it is a training plan by profile — someone overseeing a high-risk system does not need the same as someone using a writing assistant — with a record of who has completed it.
Minimum internal governance
The Regulation does not require an AI committee, but several obligations presuppose one: knowing which systems exist, who oversees them, what data they receive and who is alerted if they fail. A living inventory, an acceptable use policy and an owner for each system cover most of it.
Governance links up with data protection. The new Article 4a allows special categories of data to be processed exceptionally in order to detect and correct bias, with strict safeguards — pseudonymisation, controlled access, deletion once finished — and with the reason recorded in the record of processing activities.
Where ISO/IEC 42001 fits
ISO/IEC 42001:2023 is an international standard setting requirements for an artificial intelligence management system, with the common structure of management system standards. Certification is voluntary.
It helps organise the inventory, risk assessment, roles, supplier control and continual improvement, and can serve as the backbone of the quality management system Article 17 requires of high-risk providers. But it does not replace the conformity assessment in Article 43: presumption of conformity comes from harmonised standards whose references are published in the Official Journal of the EU (Article 40(1)).
What an auditor usually asks for
- AI training plan by profile, with attendance records
- Acceptable use policy for AI tools approved and communicated
- Owner designated for each system in the inventory
- Data processing to correct bias justified in the record of processing activities
- Decision taken on whether to adopt ISO/IEC 42001 as the management framework
How to tackle it in practice
- 1Define two or three training profiles based on actual AI use and record who completes each one.
- 2Bring the inventory of AI systems into the risk analysis you already maintain for information security or data protection.
- 3If you already have a system certified to ISO/IEC 27001 or ISO 9001, consider extending it with the requirements of ISO/IEC 42001 rather than creating a separate one.
The cybersecurity Article 15 requires of high-risk systems rests on the same controls as ISO/IEC 27001.
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) EUR-Lex · OJ L 2024/1689 · 12 July 2024
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 EUR-Lex · OJ L 2026/1744 · 24 July 2026
- Regulation (EU) 2024/1689, consolidated text EUR-Lex · CELEX 02024R1689-20260727 · Version of 27 July 2026
- ISO/IEC 42001:2023 — Information technology. Artificial intelligence. Management system ISO · 2023 ed.