After the Article 4 rewrite, AI literacy depends on managers and permission as well as courses

On 27 July 2026 the EU lowered the legal bar for AI literacy. Article 4 of the AI Act once told providers and deployers to take measures "to ensure, to their best extent, a sufficient level of AI literacy" ^[1]. It now asks them to "take measures to support the development of AI literacy" and guarantees nothing about any individual ^[2]. The rewrite did not change the underlying need: BCG's 2026 survey found only 36% of employees feel they have had adequate upskilling ^[3].

Our argument is narrower than "literacy is a management problem". The lighter rule leaves the design of literacy to employers, and the adoption data we found links use to conditions a course alone does not supply: permission to experiment, managers who model use, peers close to the work, and checks against ground truth. All of that support is correlational, and training still matters: BCG links regular use to five or more hours of training plus coaching ^[4]. A champions network could combine the two, but we found no controlled study of AI champions, so the model below is a design to test.

What the rewrite changed, and what it did not

Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July. It replaced Article 4 but left the start date alone: Chapters I and II have applied since 2 February 2025 ^[2]. The Commission had proposed on 19 November 2025 to replace the company duty with a promotion duty on itself and the Member States. Parliament kept a lower-standard company duty, and the plenary approved the agreement on 16 June 2026 by 423 votes to 57, with 174 abstentions ^[6].

Our reading is that the standard fell because strict outcomes were costly to evidence, which is what the recital says: such obligations create "an additional compliance burden, particularly for smaller enterprises" ^[2]. The same recital still calls AI literacy a strategic priority.

What counts as evidence

The Commission's Q&A is the most practical guidance so far. It says there is no need for a certificate and that organisations can keep an internal record of trainings and other guiding initiatives ^[7]. A record alone is not enough: the same Q&A says relying on the instructions for use is not sufficient ^[7]. Article 4 does not require measuring employees' AI knowledge or a governance structure ^[7]. Staff using general tools are in scope and should be told about risks such as hallucination ^[7]. Germany's Bundesnetzagentur suggests identifying needs, designing measures, then keeping records of type, content, duration and participants ^[8].

Supervision sits with national authorities from 2 August 2026, and the Commission policy page repeats that date ^[7][9]. Penalties follow national law: in our reading, Article 99(4) does not name Article 4 in either text, so check national rules ^[1][2]. Two things stay open. From 2 December 2027 for Annex III systems, deployers of high-risk systems must still assign human oversight to people with "the necessary competence, training and authority" ^[1], and the Q&A says staff must be "sufficiently trained to handle the system and ensure human oversight" ^[7]. And at the time of writing we could not find the Commission's promised practical examples or the AI Board's recommendations; its policy page still lists them as future actions ^[9].

The public frameworks are general or education-focused

The reference frameworks are real, but none describes a workplace role. UNESCO's student and teacher frameworks ^[10][11] and the Commission and OECD AILit framework, published in 2026 ^[12][13], target education. DigComp 3.0, from November 2025, is a general digital competence framework that integrates AI across its competence areas ^[14].

Recital 8 names DigComp and AILit as references for Member States ^[2]. The statutory definition is equally general: skills and knowledge for "an informed deployment of AI systems" and awareness of risks ^[1]. We could not open a workplace-specific framework from UNESCO or the OECD, so we do not claim one exists. The JRC news item on DigComp says 30% of EU workers use AI systems and only 15% have received AI training, but it names no survey, year or definition, so we treat those figures as indicative only ^[14].

What the adoption data says about courses, managers and permission

A Danish survey of 100,000 workers found that employer restrictions and required training often hold workers back from ChatGPT. In an experiment, giving workers expert assessments moved their beliefs and intentions but had limited effect on actual adoption ^[15]. That tested information, not training, so it cannot show that courses fail. The paper also found younger, less experienced and male workers the most likely adopters ^[15]. It is a 2024 working paper, and we report only its abstract's findings.

More recent data points to the conditions around training. Gallup's February 2026 US survey of 23,717 employees looked at organisations that make AI available to their employees. Within them, 78% of employees who strongly agreed their manager actively supports AI use were frequent users (a few times a week or more), against 44% of those who did not strongly agree ^[16]. The pattern repeats for support for experimenting, clear AI policies and integration with systems and processes.

Other sources agree on direction, with caveats. BCG's 2025 survey reported much higher regular use with at least five hours of training plus in-person coaching, which favours training alongside coaching ^[4]. Microsoft's 2026 survey found organisational factors carried about twice the weight of individual mindset in its model, which the report calls association, not causation ^[5]. A separate Microsoft People Science survey (July 2025, 1,800 employees including leaders and managers) found manager modelling of AI use was associated with a 17-point higher reported AI value ^[5]. All of this is self-reported and correlational, and some is vendor research. Our reading is that training, permission and manager behaviour travel together, so a course cannot easily be separated from the conditions around it.

Calibration is the quieter problem. In two experiments (N=246 and N=452) where participants used AI on LSAT logic problems, higher AI literacy was linked to less accurate self-assessment ^[17]. Self-assessment is an unreliable stand-in for skill, though the task was narrow.

What the evidence on champions does and does not show

An integrative review of 199 healthcare articles found champions consistently reported as important positive influences, but over 80% treated them as one of several key factors. More than 90% coded them as present or absent, no study validated a way to identify them, and only four randomised champion presence ^[18]. A study of 11 US maternity hospitals found that not all of six champion attributes were needed for success, and that having all did not guarantee it. The authors say they cannot tell which attributes are necessary or sufficient and call their findings hypothesis-generating, while framing a champion's success as depending on who they are as well as what they do ^[19].

A Cochrane review of 24 studies found local opinion leaders improved professional compliance by a median of 10.8 percentage points, with an interquartile range of 3.5 to 14.6 and moderate certainty. The role was poorly described in most studies, so the review could not say how to improve it ^[20].

On who to pick, one cluster trial in 32 Honduran villages seeded 5% of villagers with a nutritional intervention. The best arm seeded one friend named by each randomly chosen villager, not the most-named people. For the multivitamin intervention it gave 12.2% higher uptake than random seeding; we could not confirm a matching benefit for chlorine. Seeding the most-connected villagers did no better than random for either intervention, and was numerically worse for multivitamins (61.0% against 66.2%) ^[21].

Enterprise AI evidence is thinner. A preprint on an eight-week Copilot pilot at a US state department of transportation (124 employees after screening) found 68% of baseline survey 'Champions' (a cluster of 19 people) moved to less enthusiastic groups after use. These were the most enthusiastic survey respondents, not designated champions, so this shows enthusiasm can fade, not that programmes fail ^[22]. The Commission says it set up an AI Champions network but has published no structure or results ^[7]. Telefónica, Smals and TIM describe champion, ambassador or community roles in the April 2025 snapshot of the Commission's repository, all self-reported and not evaluated, and entries may have changed since ^[23][9].

The NKK Champions Operating Model

The model separates two jobs that the word champion blurs. The Microsoft charter describes champions as trusted changemakers who experiment with AI and demonstrate its value in practice. Its three pillars are to explore, to influence peers and to build their own AI fluency, and it says champions "don't replace IT, compliance, training, or Copilot adoption program teams" ^[24]. Telefónica's certified champions act instead as governance intermediaries with the business ^[23]. The Commission's own network is about adoption ^[7]. We treat these as separate roles. We also keep more than one champion per unit. That is an NKK design choice informed by thin evidence: five articles in the healthcare review questioned the effectiveness of a single champion and suggested that several needed to work together, while one study it cites found a single well-placed champion could implement a new technology, with more needed when behaviour had to change ^[18].

Roles, sizing and mapping

Start with at least two domain champions per business unit, and roughly one per 25 to 50 staff in a function. Both numbers are NKK assumptions with no source behind them. Test them against queue lengths at office hours and revisit after 90 days.

The cost is not small, so add it up. An illustrative 500-person organisation, using our time-boxes and a 40-hour week, needs 10 to 20 domain champions (20 to 80 hours a week), plus about 8 hours for the lead, 2 to 3 for the liaison, 2 for the host and 1 each for the reviewer and sponsor. That is roughly 33 to 94 hours, or 0.8 to 2.4 full-time equivalents, with each champion giving 5 to 10% of their week. A lighter 90-day pilot starts with two champions in one unit, a part-time lead, and the weekly and monthly beats, adding roles only when the queue justifies them. The governance liaison is the NIST-style piece: the AI RMF Playbook expects documented roles and lines of communication (GOVERN 2.1) and training for personnel (GOVERN 2.2) ^[25].

Map the roles to ADKAR, Prosci's model for individual change, which Prosci itself says is not a complete change methodology ^[26]. Awareness comes from the AI inventory and briefing, desire from permission, reward and sponsor behaviour, knowledge from role-based content, ability from coaching in the workflow, and reinforcement from the cadence and records.

Selecting champions

The trial seeded one friend named by each random person. It did not seed the most-named people, so it gives no support for ranking by nomination count, which would resemble the most-connected arm that did no better than random. It is the only randomised selection evidence we found, in a different setting ^[21]. Our method follows its logic: ask a random sample of colleagues in each unit to name one person they go to when stuck with AI at work, take the named people as candidates, then screen them with the manager on credibility and available time. Using counts to spot overloaded names is an untested NKK extension. Check the mix by gender, tenure and function ^[15].

Where it breaks

A heavy network can become compliance theatre that produces records but not skill. Champions cannot fix missing permission or policy, as the Gallup pattern suggests ^[16]. Nominations can reproduce existing social advantage, and the credibility screen is subjective. Article 4 requires none of this ^[7], so keep what pays for itself.

Turning champion activity into Article 4 evidence

The Commission asks for no levels or tests, but a staged model gives you something to record and a way to avoid overconfidence. We borrow the idea of staged progression from UNESCO's student framework, whose levels are Understand, Apply and Create ^[10], and build three levels for the workplace. A separate role overlay covers people assigned human oversight of high-risk systems. It is a role-based duty, not a fourth rung: Article 26(2) requires oversight to be assigned to people with "the necessary competence, training and authority" ^[1].

Use self-rating sparingly. Newly published objective instruments such as AICOS exist partly because many existing scales rely on subjective data ^[27]. In NKK's view, none is validated for every workplace role. A practical alternative is the quarterly calibration review: score a sample of real outputs against ground truth, and compare with what the author predicted. Keep levels out of performance management, or people will game them.

What to do next

1. Establish your role and inventory. Decide whether you are a provider or deployer, and list where AI is used, including general tools such as ChatGPT ^[7].
2. Fix permission before launching a network. If staff are unsure what is allowed, champions will relay uncertainty ^[16].
3. Write a one-page charter. Use Microsoft's ten elements as a checklist, especially "what Champions don't own" and escalation paths ^[24].
4. Nominate, then screen. Ask a random sample to name one colleague each, then check credibility, time and mix; the trial seeded named friends, not top-ranked names ^[21].
5. Start the record now. Log type, content, duration and participants of every measure ^[8].
6. Add calibration and a 90-day review. Decide in advance what you will measure: usage, office-hours queue, escalations and sample error rates.
7. Re-check the Commission page. Revisit the charter when practical examples or AI Board recommendations appear ^[9].

Conclusion

The legal floor moved down; the evidence suggests that AI literacy depends on managers, permission and peers as well as on courses. A champions network is a plausible way to combine training with those conditions. It has support in healthcare and has not been tested in AI adoption. Run it as an experiment with a charter, a cadence and measures you set in advance, and let the results decide whether it grows.