The rules moved in July
What the Digital Omnibus changed in the EU AI Act, what applies now, and where superintelligence fits.
The short version
On 27 July 2026, the EU changed its AI Act. An amending law, the Digital Omnibus on AI (Regulation (EU) 2026/1744), rewrote Article 4 on AI literacy and moved several deadlines.
The AI literacy duty is still there. Its wording changed. Organizations no longer have to aim for a "sufficient level" of AI literacy. They have to "take measures to support the development" of it, and the law now says plainly that no one has to guarantee any individual's level.
Since 2 August 2026, national authorities can enforce the Act, and the transparency rules for chatbots and AI-generated content apply. The strictest rules, for high-risk AI in areas such as hiring and education, now generally start in December 2027.
The Act never uses the word superintelligence. Its closest tool is a set of duties on the makers of the most capable general-purpose models, which the AI Office has been able to enforce since August.
Memo 02 explained Article 4 as it was written in 2024. This memo updates it.
This memo is plain-language explanation. It is not legal advice.
What Article 4 says now
The new text, in force since 27 July 2026:
Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.
The old text required providers and deployers to "take measures to ensure, to their best extent, a sufficient level of AI literacy" of the same people.
Three things to notice.
First, most of it stayed. The duty still covers providers and deployers. It still covers staff and anyone else who uses AI on your behalf. What counts as enough still depends on people's knowledge and experience, on the context, and on the people the AI is used on.
Second, the target moved from a level of literacy to the measures themselves. You must take measures that support people's AI literacy. The new last sentence makes clear that you are not answerable for the level any one person reaches.
Third, the public side now has a job too. The Commission and the member states must support providers and deployers, small and medium-sized enterprises in particular. The Commission must publish practical examples of how to comply, and the European Artificial Intelligence Board will adopt recommendations (Article 4(2) and 4(3)).
What the new wording does not mean
It does not mean you can do nothing. "Take measures" still means measures, and they have to fit your people and the way they use AI.
If you cannot show what you did, you will struggle to show you complied.
It does not soften the rules for high-risk AI. When those rules apply, a deployer must assign human oversight to people with the necessary competence, training and authority, and give them the support they need (Article 26(2)). That is a higher bar than Article 4, and it did not change.
The European Commission's questions and answers on AI literacy still describe what reasonable practice looks like. There is no certificate to obtain. You can keep an internal record of the training and other measures you took. No special governance structure is required. And people who use a general tool such as ChatGPT should be told about its risks, for example that it can produce false information that reads as true. What counts in the end is whether the measures fit the people and the way they use AI, not the paperwork alone.
Who enforces it
Since 2 August 2026, national market surveillance authorities supervise the Act in each member state. Article 99 sets no specific fine for breaching Article 4. Member states set the penalties, and they must be proportionate.
In Denmark, the law that supplements the Act (Law no. 467 of 14 May 2025) makes the Agency for Digital Government (Digitaliseringsstyrelsen) the single point of contact. It divides supervision of specific prohibited practices between the Agency, the Danish Data Protection Agency (Datatilsynet) and the Danish Court Administration (Domstolsstyrelsen), with a separate arrangement for the courts' own use of AI in their judicial work. For other parts of the Act, the Agency explains that the supervising authority depends on the area in which AI is used.
Our reading: a regulator's questions will usually come after something has gone wrong, and they will be simple. What did you do to prepare the people involved? When? A short, dated record answers both.
What applies since 2 August 2026: transparency
Article 50 sets transparency duties. A small organization usually meets them in one of these places.
- A chatbot or voice assistant that talks to the public. People must be told they are dealing with an AI, unless it is obvious. The duty sits with the provider of the system, so check that the tool you use does this, and do not switch it off.
- Text you publish. If you publish AI-generated or AI-manipulated text to inform the public on matters of public interest, you must disclose it. The exception: the text has had real human review or editorial control, not just a spelling and grammar pass, and a person or organization holds editorial responsibility for publishing it.
- Deepfakes. If you publish images, audio or video made or altered with AI that resemble real people, places or events and could pass as real, you must disclose it, at the latest when people first see or hear it. Evidently artistic, satirical or fictional work has lighter rules, and uses authorized by law to detect, prevent or prosecute crime are exempt.
- Emotion recognition and biometric categorization. Where their use is allowed at all, the people exposed must be told, except in certain uses authorized by law for criminal investigations. Emotion recognition at work and in education is banned except for medical or safety reasons.
Providers of tools that generate audio, images, video or text must also mark the output in a machine-readable way, with some exceptions, such as tools that only assist with standard editing. Tools already on the market before 2 August 2026 have until 2 December 2026 to do this.
What moved, and what did not
- Stand-alone high-risk AI. The uses listed in Annex III, such as certain AI used in hiring, education, credit scoring and access to public benefits: the requirements generally apply from 2 December 2027 instead of 2 August 2026. Systems already in use before then are generally covered only if their design changes significantly afterward, with a separate deadline for systems used by public authorities.
- High-risk AI built into regulated products, such as machinery, toys and medical devices (Annex I): from 2 August 2028.
- New prohibitions. From 2 December 2026, Article 5 also bans supplying AI systems made to generate non-consensual intimate material or child sexual abuse material, or that can readily do so without adequate safeguards, and using an AI system for that purpose, within the conditions and exceptions the Article sets out.
- Unchanged. The original prohibited practices in Article 5 have applied since 2 February 2025. The duties of providers of general-purpose AI models have applied since 2 August 2025. Models already on the market before that date have until 2 August 2027.
Superintelligence and the law
Several of the companies that build AI say their goal is superintelligence: AI that far outperforms the best humans at nearly all cognitive work. No such system exists today. The word appears in their mission statements, their division names and their public letters.
The AI Act does not use it. The Act does not regulate future systems by name. It regulates capability, through a category called general-purpose AI models with systemic risk. A model is presumed to belong to it when the total computation used to train it exceeds 1025 floating-point operations (Article 51). Its maker must:
- evaluate the model, including adversarial testing;
- assess and reduce systemic risks at EU level;
- track and document serious incidents, and report them without undue delay to the EU AI Office and, where appropriate, to national authorities;
- protect the model and its infrastructure against cyberattack.
These duties in Article 55 are the Act's closest tools for systems that approach superintelligence. Since 2 August 2026, the Commission, acting through the AI Office, can fine providers that break them, up to 3% of worldwide annual turnover or 15 million euros, whichever is higher (Article 101). On 29 August 2026, the European Commissioner responsible announced formal requests for information to providers on model security, external evaluation and monitoring after release. On 1 September, the Commission said requests had gone to more than 30 AI companies.
Outside the law, the debate is louder. In October 2025, a public statement organized by the Future of Life Institute called for a ban on developing superintelligence until scientists broadly agree it will be done safely and controllably, and the public strongly supports it.
For a small organization, the practical point is simpler. You will not build a superintelligence. You will use tools made by companies that say they are trying. The law puts the duties for the most capable models on their makers. Your duties are the ones in this memo: literacy measures, transparency where you deploy or publish, and, if a system you use is classified as high-risk, the high-risk requirements, which generally apply from December 2027.
A practical checklist
For the person who wants to know what to do this month.
- Keep doing what Memo 02 described: train and brief people for the AI tools they actually use, and set short rules for those tools.
- Write down what you did, with dates: who was trained or briefed, on what, and when. Keep it with your other compliance records.
- If a chatbot talks to the public on your behalf, check that it says it is an AI.
- If you publish AI-drafted text on public matters, name a person who reviews it properly and holds editorial responsibility, or label it.
- List any AI you use in hiring, education, credit or access to services, and check whether each system is classified as high-risk under Article 6, including whether the exception in Article 6(3) for narrow procedural tasks and similar cases applies. If it is high-risk, the requirements generally apply from 2 December 2027. Start preparing now.
- Know where to ask. In Denmark, the single point of contact is the Agency for Digital Government.
A note on Memo 02
Memo 02 quoted Article 4 as it read before 27 July 2026. Its practical advice still holds: train people for the tools they use, set a short policy, keep a record. Where Memo 02 speaks of a "sufficient level" of AI literacy, the law now asks for measures that support its development.
What the Foundation does
Our free AI fluency courses, in English and Danish, cover what the law calls AI literacy measures: what to hand over to AI, how to ask for it, how to judge what comes back, and what you owe the people who read it. We do not sell AI tools or training.
If you are unsure where to start, write to us.
Closing
The July changes made Article 4 easier to meet. In August the Act's enforcement began. For Article 4, a small organization can start from one question: what did you do to prepare your people, and can you show it?
Write it down this month.
Ali Al Mokdad
Founder, AI Literacy Foundation
This memo is plain-language explanation. It is not legal advice. It describes the EU AI Act as amended by Regulation (EU) 2026/1744, as of the date above. Guidance and national rules continue to develop. For obligations specific to your organization, consult a qualified lawyer.