AI Literacy Training for GxP Staff: What the EU AI Act Still Requires After the Digital Omnibus

Where Article 4 Stands Today

Before designing any training, it helps to be precise about the law, because a lot of material in circulation is now out of date. Many training offers, slide decks, and even some regulator web pages still quote the original 2024 text of Article 4. That text changed this summer.

The Original Text and the New Text

As adopted in 2024, Article 4 of the AI Act said that providers and deployers of AI systems “shall take measures to ensure, to their best extent, a sufficient level of AI literacy” of their staff and other persons dealing with the operation and use of AI systems on their behalf.² The phrase “sufficient level” raised practical questions: what counts as sufficient, how to measure it, and whether each employee needs to pass a test.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, replaced Article 4 in full. The new paragraph 1 says that providers and deployers “shall take measures to support the development of AI literacy” of their staff and other persons dealing with the operation and use of AI systems on their behalf. It keeps the same factors to take into account: technical knowledge, experience, education and training, the context of use, and the persons or groups on whom the systems are used. It then adds a sentence that did not exist before: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”¹

Paragraphs 2 and 3 are also new. Paragraph 2 requires the Commission and the Member States to support companies, in particular small and medium-sized enterprises, and requires the Commission to publish practical examples of how to comply on the AI Act’s single information platform. Paragraph 3 requires the European Artificial Intelligence Board to adopt recommendations, taking account of European competence frameworks, that set out common objectives.¹

The Dates That Matter

Article 4 is in Chapter I of the AI Act, which has applied since 2 February 2025.² The Commission’s AI Literacy Questions and Answers confirm that the obligation has applied from that date.³ The amending regulation was signed on 8 July 2026, published in the Official Journal on 24 July 2026, and entered into force on the third day after publication, which was 27 July 2026.¹ The Commission’s own pages describe the entry into force as “mid-July 2026,” but the Official Journal record shows the later date.³⁶

Supervision is a separate question from application. The Commission’s Q&A says that Article 4 is supervised and enforced by national market surveillance authorities, not by the EU AI Office, and that those authorities start supervising and enforcing the rules in August 2026. One answer on the page gives 2 August 2026 and another gives 3 August 2026; either way, supervision has now started.³

Why Some Official Pages Still Show the Old Text

If your team checks the AI Act Service Desk, it will find the original “sufficient level” wording on the Article 4 page. The page carries a notice that the provision has been amended by the Digital Omnibus and that the displayed text has not yet been updated.⁴ This matters in practice. Internal policies, supplier training materials, and e-learning modules written in 2025 almost always quote the old text. Before you approve any AI literacy content, check which version it quotes, and update your AI policy so the legal basis is stated correctly.

What the Amendment Changes, and What It Does Not

From a Result to Measures

The original wording could be read as a duty of result: ensure a sufficient level. The new wording is a duty to act: take measures that support development. Recital 8 of the amending regulation explains the reasoning. It says stakeholder experience showed that stringent obligations to ensure a sufficient level of AI literacy would not suit all types of providers and deployers, and that such obligations create a compliance burden, particularly for smaller enterprises.¹

In practical terms, a market surveillance authority looking at your company is now more likely to ask what you did than to test what each person knows. The Commission’s Q&A had already said, before the amendment, that Article 4 does not entail an obligation to measure the AI knowledge of employees. The new text puts that position into the law itself.³

What the Commission First Proposed, and What the Final Law Kept

The Commission published its Digital Omnibus on AI proposal on 19 November 2025.⁵ According to the Commission’s Q&A, the proposal would have shifted the obligation onto the Member States and the Commission to promote AI literacy, “rather than enforcing an unspecific obligation on organisations.”³ Had that version passed, companies would have had no Article 4 duty at all.

That is not what happened. The European Parliament adopted its position on 16 June 2026 and the Council took its decision on 29 June 2026.¹ The final text keeps the duty on providers and deployers, softens its wording, and adds the public support duties on top. Anyone who read the November 2025 headlines and concluded that AI literacy “was dropped” from the AI Act was reading a proposal, not the law.

What Did Not Change at All

Several things are exactly as they were:

• Scope. The duty still applies to every provider and every deployer of an AI system, not only to those with high-risk systems. The Commission’s Q&A gives a plain example: a company whose employees use a general chatbot to write advertising text or translate documents is in scope, and those employees “should be informed about the specific risks, for example hallucination.”³
• The people covered. Staff and other persons dealing with the operation and use of AI systems on the company’s behalf.
• The factors. Knowledge, experience, education, training, context of use, and the people affected.
• Territorial reach. The Commission states that the AI Act applies to actors inside and outside the EU as long as the AI system is placed on the EU market, used in the EU, or its use affects people in the EU, and that this is also valid for Article 4.³ A US-headquartered biotech with an EU affiliate, EU clinical sites, or EU-facing pharmacovigilance work should assume it is in scope.

The Separate Training Duty for High-Risk Deployers

Article 4 is not the only place the AI Act talks about competence. Article 26(2) requires deployers of high-risk AI systems to “assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.”² Article 14(4)(b) requires high-risk systems to be provided in a way that lets those overseers “remain aware of the possible tendency of automatically relying or over-relying on the output produced by a high-risk AI system (automation bias).”² The Omnibus did not soften those provisions, and the Commission’s Q&A stresses that the training obligation for deployers of high-risk systems “remains in place.”³

What the Omnibus did change is the date. Articles 14 and 26 are in Sections 2 and 3 of Chapter III. The amended Article 113 now applies those sections from 2 December 2027 for systems that are high-risk under Annex III, and from 2 August 2028 for systems that are high-risk under Annex I.¹

Is Your GxP AI High-Risk Under the AI Act?

For most pharma and biotech uses, probably not. The AI Act’s high-risk categories come from two lists. Annex III lists areas such as biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and justice. Annex I lists EU product safety laws, including the medical device regulations.² AI used to support batch record review, deviation trending, visual inspection on a fill line, or literature screening for pharmacovigilance does not appear on either list by default.

That has two consequences. First, for most GxP AI, Article 4 is the main AI Act obligation that applies to your staff, which is why it deserves attention even after the amendment. Second, the more demanding oversight and competence expectations for GxP AI come from GMP and GCP rules rather than from the AI Act. We cover those in the section on your GxP training system below. A pharma company can still have high-risk uses elsewhere, for example AI used to filter job applications, which Annex III lists under employment.² Those uses need their own review. For more on the deferred high-risk dates, see our earlier analysis linked at the end of this article.

Penalties and Enforcement

Article 99(4) of the AI Act lists the obligations that carry fixed maximum fines for operators. Article 4 is not on that list, and the Omnibus did not add it.¹² Penalties for an Article 4 breach come from the rules each Member State sets under Article 99(1). The Commission’s Q&A says national authorities could impose penalties and other enforcement measures, that any sanction must be proportionate, and adds: “This might, however, be more likely if there is proof of an incident due to lack of appropriate training and guidance of employees or other persons.”³

For a regulated manufacturer, that last sentence is the one to remember. The realistic risk is not a stand-alone Article 4 audit. It is an AI-related quality event, followed by questions about whether the people involved had been prepared to use the tool well.

Who Counts Inside a GxP Organization

Most Pharma Companies Are Deployers

Under the AI Act, a deployer is a person or body using an AI system under its authority, and a provider is the one who develops an AI system (or has it developed) and places it on the market or puts it into service under its own name.² When a pharma company licenses an enterprise AI assistant, turns on an AI feature in its eQMS or LIMS, or buys a visual inspection system with a machine learning model, it is usually a deployer.

The Commission’s Q&A asks organizations to consider their role as part of designing AI literacy measures: “Is my organisation developing AI systems or just using AI systems developed by another organisation?”³ The answer shapes the content. Deployers need their people to understand the system they use, its limits, and the checks around it. Providers also need their developers to understand data quality, testing, and documentation.

When a Pharma Company Becomes a Provider

Many larger companies now build models in-house: a model that predicts an out-of-trend stability result, a classifier that routes adverse event reports, or a tool that drafts deviation summaries on top of a licensed foundation model. When an in-house system is put into service under the company’s own name, the company can be a provider of that system as well as its deployer.² In that case, data scientists, ML engineers, and the CSV team that validates the system all fall within the Article 4 population, and their content needs to go deeper than a user’s.

Contractors, CMOs, CROs, and Consultants

The Commission’s Q&A explains that “persons dealing with the operation and use of AI systems on behalf of” a provider or deployer are not only employees, but persons broadly under the organization’s remit. It gives examples: “It could be, for example, a contractor, a service provider, a client.”³ On whether service providers should have a contractual obligation to demonstrate AI literacy, the Q&A says it depends on the type of AI system and the risk, and that people working for a service provider or contractor need the appropriate AI skills for the task, the same as employees.³

Pharma and biotech companies outsource a great deal of GxP work. Consider three common arrangements:

• Contractors working inside your systems. A contract QA reviewer using your AI-assisted document review tool is operating your AI system on your behalf. Treat that person like an employee for training purposes.
• A CRO or CMO using its own AI. If the service provider runs its own AI on your work, that provider is the deployer of its system. Its Article 4 duty covers its own staff. Your interest is in knowing, through the quality agreement and supplier oversight, that it has taken such measures.
• Consultants and temporary staff. Short-term workers often receive the lightest onboarding. If they will use AI tools in GxP work, they need the tool-specific module before access is granted, the same as for any other GxP system.

Leaders and Decision Makers

The Article 4 population is not limited to people who type prompts. Heads of quality, qualified persons, site heads, and executives who approve AI use cases, accept residual risk, or sign off on validation need enough understanding to make those decisions well. The AI Act’s definition of AI literacy in Article 3(56) speaks of the skills, knowledge and understanding that allow providers, deployers and affected persons to make an informed deployment of AI systems and to gain awareness of their opportunities, risks, and possible harm.² An informed deployment decision is usually made by a leader, not a user.

Your GxP Training System Already Does Most of the Work

Companies outside regulated industries often have to build a training function from scratch to meet Article 4. Pharma and biotech companies do not. GMP has required qualified, trained personnel for decades, and the draft revisions to EU GMP released for consultation in July 2025 make the link to AI explicit.

EU GMP Chapter 2

Chapter 2 of the EU GMP Guide requires manufacturers to provide training for all personnel whose duties take them into production, storage, or control laboratories, and for other personnel whose activities could affect product quality. It requires training appropriate to assigned duties, continuing training, approved training programs, and training records. It also says that the “practical effectiveness” of continuing training “should be periodically assessed.”⁹

Each of those elements carries over directly to AI. If an analyst uses an AI tool that affects product quality or data integrity, GMP already expects that analyst to be trained on it, to have that training recorded, and to have its effectiveness checked. Article 4 adds a legal duty that reaches beyond GMP roles, but for GMP roles the quality system is already the right home.

Draft Annex 11: Personnel and Training

The draft revision of Annex 11 on computerized systems, released for public consultation in July 2025, adds a section on personnel and training. Section 5.2 says all parties involved with computerized systems used in GMP activities “should have adequate system specific training, and appropriate qualifications and experience, corresponding to their assigned responsibilities, duties and access privileges.”¹⁰ Section 5.1 asks for close cooperation between process owner, system owner, users, subject matter experts, QA, the QP, internal IT, vendors, and service providers.¹⁰

The phrase “system specific” is the useful one here. A general AI awareness course does not meet it. The draft asks for training tied to the actual system and the access the person has. This is a draft, not final text, but it shows the direction inspectors are taking.

Draft Annex 22: Artificial Intelligence

Draft Annex 22, the proposed new GMP annex on AI released for consultation at the same time, goes further.¹¹ Three provisions bear directly on staff competence:

• Section 1 (Scope). The draft says generative AI and large language models should not be used in critical GMP applications. Where they are used in non-critical GMP applications, “personnel with adequate qualification and training should always be responsible for ensuring that the outputs from such models are suitable for the intended use.”
• Section 2.1 (Personnel). The draft calls for close cooperation between process subject matter experts, QA, data scientists, IT, and consultants during algorithm selection, model training, validation, testing, and operation, and says all personnel “should have adequate qualifications, defined responsibilities and appropriate level of access.”
• Section 3.3 (Human-in-the-loop). Where a model gives input to a decision made by a human operator and testing effort for the model has been reduced, the intended use should include the operator’s responsibility, and “the training and consistent performance of the operator should be monitored like any other manual process.”

Section 3.3 is the most demanding line for training teams. It treats the human reviewer as part of the control, and it expects that person’s performance to be monitored over time, not just their course completion. Annex 22 remains a draft. It has no final text and no implementation date, and our earlier articles track its status. But no GMP inspector is likely to accept an AI-supported decision without asking who made it and how that person was prepared.

The Regulators Are Training Their Own Staff

It is worth knowing that the people who inspect and assess your work are going through the same process. The joint HMA and EMA Network Data Steering Group workplan for 2026 to 2028 states that “AI literacy remains a critical priority (and a legal obligation under the AI Act),” and says the EU Network Training Centre will roll out AI literacy initiatives across the European medicines regulatory network, with roll-out planned for the first quarter of 2026.¹² Minutes of the group’s May 2025 meeting record that EMA’s basic AI literacy training for all staff was being split into six pillars, with short micromodules of under five minutes for each.¹³

Two lessons follow. Short, focused modules are an accepted format, even among regulators. And an assessor who has completed AI literacy training is more likely to ask pointed questions about how your reviewers handle AI output.

Designing the Program by System and by Role

The Commission’s Q&A sets out the minimum points an AI literacy program should consider: a general understanding of AI within the organization, the organization’s role as provider or deployer, the risks of the AI systems provided or deployed, and AI literacy actions built on that analysis, taking into account differences in knowledge and experience and the context of use.³ It also says there is “no one size fit all” and that no strict requirements or mandatory trainings are imposed.³

National authorities have filled in the practical steps. The Dutch data protection authority, the Autoriteit Persoonsgegevens, describes a repeating action plan with four steps: identify, set goals, implement, and evaluate.⁸ Germany’s Bundesnetzagentur, in guidance published in June 2025, says the AI Act does not prescribe formal or standardized training measures, that there is no duty to certify training, that measures can be delivered internally or externally, that AI competence should be refreshed regularly as technology develops, and that the measures taken should be documented.⁷ Both documents predate the Omnibus and use the old “sufficient level” language, but their practical steps still fit the amended duty.

For a GxP organization, those steps translate into a sequence that uses processes you already run.

A Role-by-Exposure Matrix

Job titles are a poor guide to AI training needs. Two QA specialists with the same title can have very different exposure: one uses an AI assistant for email, the other approves records that an AI system helped create. It works better to group people by how they interact with AI and how much GxP weight that interaction carries.

A single person can belong to several rows. A senior analyst might be a general user, a human-in-the-loop reviewer on one system, and a content author on another. The matrix helps assign the right set of modules, not a single label.

Four Layers of Content

A layered design suits regulated settings: everyone gets the base, and only the people who need it get the depth. The Commission’s Q&A supports this directly: it says having different levels of training or learning approaches could be appropriate.³

What to Teach: Content That Fits Regulated Work

Generic AI literacy courses are easy to buy and usually miss the points that matter in a GxP setting. The content below is drawn from the risks regulators and researchers have described.

Confident Errors and Why They Are Hard to Catch

Generative AI tools can produce fluent text that contains invented facts, citations, or numbers. The Commission’s Q&A names hallucination as a risk employees should be told about even for simple tasks such as writing advertising text or translating.³ In GxP work the effects are more serious. An AI-drafted investigation summary that states a root cause the evidence does not support, or a batch summary that carries over a wrong lot number, becomes a data integrity problem the moment someone signs it.

Training should show real examples from your own processes, not generic chatbot errors. People learn to catch the error types they have seen.

Automation Bias and Overreliance

The AI Act names automation bias directly in Article 14(4)(b), describing it as the tendency to rely or over-rely on the output of an AI system.² A Microsoft Research literature review of about 60 papers on the subject puts it simply: “Overreliance on AI occurs when users start accepting incorrect AI outputs.” The review notes that policymakers and practitioners are asking for more human oversight, which makes users the last line of defense against AI failures.¹⁵

That describes the GxP human-in-the-loop model exactly. A reviewer who approves 200 correct AI classifications in a row is being trained by the tool to stop checking. Content for Layer 3 should include:

• Why agreement rates drift upward over time, and why that can hide a problem rather than confirm the tool works
• How to review against the source, not against the AI output
• How to record an override and the reason for it
• Planted-error exercises, in which reviewers are given cases with known errors so both they and the organization can see whether checks still catch them

Hidden and Informal AI Use

Some of the greatest AI risk in a regulated company comes from use nobody approved. The 2025 global study by KPMG and the University of Melbourne, which surveyed more than 48,000 people in 47 countries, found that only 47% of employees said they had received AI training and only 40% said their workplace had a policy or guidance on generative AI use. The same study found that 57% of employees said they hide their use of AI and present AI-generated work as their own.¹⁴

These are cross-industry figures, not pharma-specific ones, but they point to a clear training need. Staff should know which tools are approved for which work, why unapproved tools create GxP and confidentiality risk, and how to disclose AI use in a record without fear of blame. A program that only punishes undisclosed use will drive it further out of sight.

What the Rules Say, in Plain Terms

The Commission’s Q&A encourages content on the legal and ethical side, including understanding of the AI Act.³ For GxP staff, keep this practical: what the company’s AI policy allows, which AI uses are classed as GxP, where draft Annex 22 draws its lines on generative AI in critical applications, and who to ask. Most staff do not need AI Act article numbers. They need to know what they are allowed to do on Monday morning.

Data Handling and Confidentiality

Staff need clear rules on what may be entered into which tool: patient data, unpublished clinical results, batch data, supplier information, and trade secrets. These rules come from data protection law and company policy rather than from Article 4, but a literacy program that ignores them will miss the most common everyday risk.

Formats That Work

The Commission’s Q&A says that simply relying on the instructions for use or asking staff to read them “might be ineffective” in many cases.³ For deployers of high-risk systems it is firmer: “Relying on the instructions of use is therefore not sufficient, further measures are necessary.”³ A read-and-sign on an AI procedure is the weakest possible measure.

Formats that tend to work better in GxP settings include:

• Short modules of a few minutes each, like the micromodules EMA planned for its own staff.¹³
• Practice on real cases in a training environment, with known answers.
• Supervised first use, where a new reviewer’s first set of AI-supported decisions is second-checked.
• Team briefings when a model or feature changes, recorded as change-related training.
• Peer examples. The Commission’s living repository of AI literacy practices collects programs from companies and public bodies.⁶ The Commission states that copying these practices does not automatically give a presumption of compliance, but they are a useful source of formats.⁶

Showing What You Did Without Over-Building It

What the Commission Says About Records

The Commission’s Q&A is direct on this. There is no need for a certificate, and organizations can keep an internal record of trainings and other guidance activities. It also says no specific governance structure is mandated to comply with Article 4, and that there is no requirement to appoint an AI officer.³ The Bundesnetzagentur guidance takes the same view on certification and asks that measures be documented.⁷

This is one area where pharma companies are more likely to over-build than under-build. A GxP training record system is already more rigorous than anything Article 4 calls for. The question is not whether to create new evidence, but whether the evidence you already produce covers AI.

What an Authority Could Reasonably Ask For

No market surveillance authority has published an Article 4 inspection checklist that we are aware of. Based on the text of the article and the Commission’s guidance, a company should be able to show, without a scramble:

• A current AI policy that states the correct legal basis
• An AI inventory showing which systems are in use and who uses them
• The reasoning that links systems and roles to training content
• The curricula and modules themselves, with approval and version history
• Completion records for employees and for contractors working in your systems
• How effectiveness is checked and how training is refreshed when systems change
• How supplier AI use is covered through quality agreements and oversight

Our companion article on training records for AI-assisted GxP work goes into the content of individual records in detail. The point here is narrower. For Article 4 purposes, the program-level evidence (inventory, reasoning, curricula, refresh) matters as much as the individual completion record, because the duty is now about the measures you took.

Do Not Overclaim

Some vendors market “AI Act certified” training. The amended Article 4 creates no certification scheme, and the Commission says no certificate is needed.³ Using such language in your own documents can create an expectation that you then have to meet. Describe what you did, factually.

Twelve Questions to Test Your Program

These questions are meant for a quality or compliance leader reviewing the current state. A “no” is not necessarily a breach of Article 4, which is now a duty to take measures rather than to achieve a level. But each “no” shows a gap that an inspector or an incident review could find.

Where to Start If the Answers Are Mostly No

Start with questions 1, 2, and 7. Correcting the policy is quick and removes an easy finding. The inventory is the base for everything else. Known-error practice for human-in-the-loop reviewers addresses the risk most likely to turn into a quality event. The rest can follow through normal training and change control cycles.

What to Watch Next

Three developments will shape how this duty is read over the next year:

• Practical examples on the single information platform. The amended Article 4(2) requires the Commission to publish examples of how to comply.¹ The Commission says it will build them from the living repository.³
• AI Board recommendations. Article 4(3) requires the Board to adopt recommendations with common objectives.¹ These may become the reference point national authorities use.
• National guidance. The Commission notes that further guidance on enforcement might come from national market surveillance authorities.³ Expect guidance written in 2025 to be revised to match the amended text.

Alongside these, the final texts of Annex 11 and Annex 22 will matter more to GxP training than anything in the AI Act. Keep both on the watch list.

Conclusion

The Digital Omnibus did not remove AI literacy from the EU AI Act. It changed the duty from reaching a “sufficient level” to taking measures that support AI literacy, and it made clear that no company must guarantee a level for any individual. That is a fairer and more workable duty, and supervision by national authorities has now begun. For pharma and biotech companies, the more demanding expectations for AI competence come from GMP: Chapter 2’s requirements for duty-based, effective training, and the draft Annex 11 and Annex 22 texts, which call for system-specific training and monitored human reviewers. The practical answer to both is the same. Build AI literacy into the training system you already run, assign it by system and exposure rather than job title, test whether reviewers still catch errors, and keep the program-level evidence current. Recital 8 of the amending regulation says AI literacy should be a strategic priority “regardless of regulatory obligations and potential sanctions.”¹ In GxP work, the reason is simple: a person who does not understand the tool cannot be accountable for the record it helped create.

Sakara Digital works with pharma and biotech organizations that are bringing AI into regulated work and want their people ready for it. If you are sorting out what the amended Article 4 means for your quality system, or how to fit AI literacy into the training you already run, we are happy to have that conversation.

For Further Reading