Article 4 of the AI Act did not go away. It changed its nature. Since 27 July 2026, a company that uses AI systems must take measures to support its teams’ AI literacy, without having to guarantee a given level for each person. For a Salesforce team the question is no longer “have we reached the right level?” but “which measures did we take, for which roles, and can we show it?”.
What did Article 4 ask until July 2026?
In its 2024 version, in application since 2 February 2025, Article 4 of Regulation (EU) 2024/1689 asked providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy for their staff and for the people using those systems on their behalf. It took into account technical knowledge, experience, training and the context of use.
“A sufficient level” raised a question nobody could settle: sufficient for whom, and measured how? The easy answer was one online module for everyone. Easy to prove, and of little use to the salesperson who sees a generative feature draft an email in Salesforce.
What changed with Regulation 2026/1744?
Regulation (EU) 2026/1744, the AI part of the Digital Omnibus, was published in the Official Journal on 24 July 2026 and has applied since 27 July. It rewrites Article 4 on three points.
- The duty stays with providers and deployers: they take measures to support the development of AI literacy of their staff and of the people acting on their behalf.
- The text states that no level of AI literacy has to be guaranteed for any individual. It is a duty of means, no longer a duty of result.
- The Commission and the Member States support those efforts, SMEs in particular, and the Commission publishes practical examples.
The Commission’s proposal of November 2025 went further and moved the effort onto public authorities. The adopted text keeps a duty on companies. The same regulation moves the Annex III high-risk obligations to 2 December 2027, but it leaves Article 4’s date of application where it was: 2 February 2025.
Does a company that switches on AI in Salesforce fall under it?
In most cases, yes. The regulation calls a deployer the organisation that uses an AI system under its own authority. A company that switches on generative features in its org (a Case summary, a suggested email, a Prompt Builder template, an agent) uses them under its authority, even though Salesforce provides them. The measure covers the people who use them and the people who configure them: users, admins, and the managers who decide what leaves the org.
The real risk sits in the gap between what the org does and what the teams believe it does. A user who takes a generated summary for a checked fact, or an admin who widens the data a template reads without looking at who will see the output: those are the situations the measure has to prevent.
Which measures hold up, and for whom?
A useful measure starts from the features actually switched on in the org and the roles that touch them. A generic module says nothing about what your summary template does, or who can change it.
For users, one hour on their own screens beats a day of theory. They see the feature in their org, on their records, and keep three moves: reread, correct, report. For admins, the measure is the security discipline already taught in ADX201, applied to AI: knowing with which permissions a feature reads its data, and where its output lands. For managers, it is about the decision: who approves that a generated text can go to a customer, and on which signals the feature is extended to another team.
What record should you keep?
A duty of means is shown through records. One page per feature is enough, kept by the admin owner: the feature and its configuration version, the roles that use it, the training each role received and when, and the date of the next review.
The review follows a calendar the org already knows. Salesforce ships three releases a year, and a generative feature can behave differently from one release to the next without anyone touching the configuration. Each release is the moment to check that the training still describes what the org does. The operating model that says who owns each change after go-live is the right place to put that review.
Where to start this quarter?
That is the logic of the two “AI in Salesforce” days I offer on request, one for sales teams and one for admins: they start from the client’s org, not from generic slides. If you are at step one, the list of features switched on is enough for a first conversation.