Governance is a set of individual duties

Ask most people who is responsible for AI governance in their organisation and they will name a committee, a function, or a person with governance in their job title. That answer is understandable and it is wrong in a specific way that matters.

A committee can approve a policy. It cannot read the instructions for use of a tool it has never opened, notice that a model started behaving differently on Tuesday, or decline to act on an output that looks wrong. Those things are done by individuals in the course of ordinary work, and the whole apparatus rests on them being done.

What the Act actually asks of individuals

Look at where the duties land. Article 14 oversight is exercised by a natural person in front of a system, not by a governance body. Article 26 requires the deployer to use a system according to its instructions, which means somebody has to read them and follow them in daily use. Article 26(2) puts oversight on named people with competence, training and authority. Article 73 reporting runs from the moment the organisation becomes aware, and organisations become aware when a person notices something and says so.

None of these can be discharged centrally. A central function can build the register; it cannot populate it with the AI feature that appeared in your department last week. It can write the escalation route; it cannot be the person who uses it.

Article 4: an obligation of means, not result

Article 4 requires organisations to support the development of AI literacy among their staff and others operating AI systems on their behalf. Three features of that duty are worth understanding, because they are the source of most confusion about it.

It is an obligation of means, not of result. You are not required to produce a workforce that never misuses AI. You are required to take appropriate measures. What is appropriate is judged on effort and design, not on the absence of mistakes. This is a genuinely different standard from most compliance duties and it cuts both ways: a single training video does not discharge it, and one employee making a bad judgement does not breach it.

No certification is mandated. Nothing in the Act requires a qualification, an exam or an accredited course. Vendors selling AI literacy certificates are selling a product, not a legal requirement. A certificate may be useful evidence of effort; it is not the duty.

It is proportionate to role, context and the people affected. The claims handler deciding on someone's treatment authorisation needs a different depth than the person using a transcription tool in meetings. Proportionality is not an excuse for thin training everywhere; it is an instruction to put the depth where the consequences are.

Two further points of scope. Article 4 applies to all AI systems, not only high-risk ones, so an organisation with no high-risk systems still owes it. And it covers staff and others operating systems on your behalf, which the Commission reads to include contractors. If a contracted team runs a model for you, their understanding is your obligation.

The Digital Omnibus, Regulation (EU) 2026/1744, softened the wording from ensure to support the development of. The softening is real but modest. It moves the duty further towards means and away from any implication of guaranteed outcome. It does not remove it.

What AI literacy means in the Act

Article 3(56) defines it as the skills, knowledge and understanding that allow informed deployment and awareness of the opportunities, risks and possible harm. Note the three parts. Skills: being able to do something. Knowledge: knowing the facts. Understanding: being able to reason about a case nobody described to you in advance. Most corporate training delivers the second and calls it all three.

The three duties that are yours regardless of your job

• Tell someone what you are using. The register is only as good as what reaches it, and the entries most likely to be missing are the ones that arrived by vendor update or personal initiative.
• Say when something looks wrong. Facts, not conclusions, to a named destination, on the day you notice. The clock starts on awareness, and you are frequently the awareness.
• Do not let an output stand that you would not have signed yourself. This is the individual form of Article 14(4)(d), and it is the one that requires no policy to exist before you can act on it.

As of 24 September 2026.