Yes, the EU AI Act’s AI literacy rule (Article 4) can apply to Indian GCCs and IT services firms: when they build AI systems for the EU market, when they use AI whose output is used in the EU, or when their people operate AI on behalf of an EU parent or client. In July 2026 the Digital Omnibus on AI (Regulation (EU) 2026/1744) softened the rule. Organisations must now “take measures to support the development of AI literacy” rather than ensure a “sufficient level” of it. But the European Commission is clear that AI literacy remains an obligation, and national authorities supervise and enforce it from 2 August 2026.
This guide explains what Article 4 now says, how it reaches Indian teams, what the omnibus did and did not change, and a six-step programme your GCC or delivery organisation can put in place this quarter.
What Article 4 says now
Article 4 has applied since 2 February 2025. The Digital Omnibus rewrote it in 2026. The key differences:
| Original Article 4 (from 2 February 2025) | Amended Article 4 (after Regulation (EU) 2026/1744) | |
|---|---|---|
| Core duty | Take measures to ensure, to their best extent, a “sufficient level of AI literacy” | Take measures to “support the development of AI literacy” |
| Who must act | Providers and deployers of AI systems | Unchanged: providers and deployers |
| Who must be covered | Staff and other persons dealing with the operation and use of AI systems on their behalf | Unchanged |
| How to tailor | Technical knowledge, experience, education, training, context of use, and the people affected | Unchanged |
| Guaranteed level | Implied “sufficient” level | Expressly no requirement to guarantee any specific level of AI literacy of any individual |
| Support from the EU | None in the article | Commission and Member States must support providers and deployers, especially SMEs; the AI Board adopts recommendations |
In plain terms: the bar moved from an outcome (“make sure people are literate enough”) to an effort (“take real, tailored measures”). You still have to take those measures, and you should be able to show them.
How Article 4 reaches Indian GCCs and IT firms
Three parts of the AI Act matter here:
- Territorial scope (Article 2). The Act applies to providers and deployers established outside the EU where the output produced by the AI system is used in the EU, as well as to providers placing AI systems on the EU market. The Commission’s AI literacy guidance confirms the Act applies to actors inside and outside the EU.
- Who is a deployer (Article 3). A deployer is any organisation using an AI system under its authority, other than for personal, non-professional use. The Commission’s FAQ gives the example of a company whose employees use ChatGPT to write advertising text or translate: those employees should be informed about specific risks such as hallucination.
- “Other persons” on their behalf. Article 4 covers not just employees but others operating AI for the organisation. The Commission’s examples include contractors, service providers and clients.
India hosts 2,117 GCCs employing around 2.36 million professionals, according to the Nasscom-Zinnov GCC landscape report published in July 2026, and many of them serve European parents. Here is how the rule typically lands, in our reading. Always confirm your own position with legal counsel.
| Your situation | Likely role | What it means in practice |
|---|---|---|
| GCC of an EU-headquartered bank, insurer or manufacturer, using Copilot, ChatGPT Enterprise or internal AI tools | The EU parent is the deployer; GCC staff are “staff or other persons” acting on its behalf | Expect the parent to require AI literacy training and completion evidence for your teams, often through group policy |
| Indian IT services firm building or customising AI systems for an EU client | Provider, or acting for a provider | Engineering and delivery teams need training on the risks of the systems they build; clients will flow this down in contracts |
| Indian SaaS or product company selling AI features to EU customers | Provider | Product, engineering and support teams are in scope; customers may ask for evidence in security questionnaires (see this AI vendor security questionnaire for the kind of questions to expect) |
| Indian firm using AI with output used by EU clients (for example, AI-assisted analytics or content delivered to the EU) | Possibly a deployer under Article 2 | Treat Article 4 as applicable to the teams producing that output |
| Indian company using AI only for domestic operations, with no EU output or customers | Generally outside the AI Act | Article 4 does not apply, but the DPDP Act and sector rules still do |
What the Digital Omnibus changed, and what it did not
The omnibus was politically agreed in May 2026 and published in the Official Journal in July 2026. Points that matter for GCC leaders:
- Article 4 was softened, not removed. Early reports of the provisional deal suggested the direct duty might be replaced by an obligation on the Commission and Member States to encourage literacy. The adopted text keeps a direct duty on providers and deployers, in softer form.
- Enforcement timing did not move. The Commission says national market surveillance authorities supervise and enforce Article 4 from 2 August 2026, and can impose proportionate penalties and other measures.
- High-risk deadlines moved. Obligations for high-risk systems listed in Annex III now apply from 2 December 2027, and for those covered by Annex I product legislation from 2 August 2028.
- New prohibitions were added. Prohibitions on AI that generates non-consensual intimate or sexually explicit depictions of identifiable people apply from 2 December 2026.
- No certificate is required. The Commission states there is no need for a certificate, and that organisations can keep an internal record of trainings and other guiding initiatives.
Do not read “softened” as “optional”. Clients, parents and auditors will still ask what measures you took, for whom, and when. The difference is that you are judged on reasonable, tailored effort rather than on guaranteeing a level of knowledge for every individual.
A six-step AI literacy programme for GCCs
The Commission’s guidance suggests organisations build a general understanding of AI, work out whether they are a provider or deployer, assess the risks of the AI systems they use, and tailor actions to people’s knowledge and context. Here is how we turn that into a programme.
- Inventory your AI systems and your role for each. List the AI tools and systems in use or being built, which EU entity or client they serve, and whether you act as provider, deployer or on someone’s behalf. Include shadow AI: tools employees use without approval. A discovery tool such as AccuroAI shadow AI discovery can map them across browsers, desktop apps and SaaS.
- Segment your people by exposure. Typical groups: all staff who use general-purpose AI tools; teams using AI in sensitive processes (HR, credit, claims, customer service); engineers and product teams building AI; leaders who approve AI use.
- Deliver tailored training for each group. A baseline for everyone (how AI works and fails, approved tools, data red lines, verification), role-based modules for sensitive functions, and technical depth for builders. Our Safe AI at Work programme covers the baseline for the whole workforce.
- Brief your leaders. GCC heads and delivery leaders need to understand AI risk, ownership and what the EU parent or client expects. Our half-day AI Risk & Strategy for Leaders session is designed for this.
- Keep an evidence pack. Record the curriculum, version dates, attendance by person and role, assessment results and refresh dates. Make it easy to share with your parent or client.
- Align contracts and refresh regularly. Check client contracts and group policies for AI literacy flow-downs, and refresh training at least annually or when tools change.
The evidence your parent or client will ask for
| Evidence | Why it matters |
|---|---|
| AI system inventory with roles (provider or deployer) | Shows you know which obligations apply to which systems |
| AI policy and AI acceptable use policy | Defines approved tools, data red lines and human oversight |
| Training curriculum per audience | Shows measures are tailored, as Article 4 requires |
| Completion and assessment records | The internal record the Commission refers to |
| Records for contractors and vendors | Article 4 covers “other persons” acting on your behalf |
| Review log | Shows the programme is kept current |
One programme, several frameworks
Most Indian GCCs and IT firms are not dealing with the EU AI Act alone. The same training and evidence can support several requirements at once: the DPDP Act 2023 and DPDP Rules 2025 (core obligations from 13 May 2027), ISO/IEC 42001 for AI management systems, and the NIST AI Risk Management Framework that many US clients reference. Compliance, legal and risk teams can learn to map these together in our AI Governance & Compliance training.
Frequently asked questions
Does the EU AI Act apply to Indian companies?
It can. The Act applies to providers placing AI systems on the EU market and to providers and deployers outside the EU where the AI system’s output is used in the EU. An Indian company with no EU customers, EU output or EU parent is generally outside its scope.
Did the Digital Omnibus remove the AI literacy obligation?
No. It softened it. Providers and deployers must take measures to support the development of AI literacy, without having to guarantee a specific level for any individual. The European Commission describes AI literacy as remaining an obligation.
Is there a fine for not providing AI literacy training?
The Commission says national market surveillance authorities supervise and enforce Article 4 from 2 August 2026 and could impose penalties and other enforcement measures, which must be proportionate to the nature and gravity of the infringement. In practice, the more immediate pressure for Indian teams comes from EU parents and clients asking for evidence.
Do our employees need an AI Act certificate?
No. The Commission states that no certificate is needed. An internal record of the training and guidance you provide is enough, as long as the measures are tailored to people’s roles and the AI systems they use.
Does using ChatGPT or Copilot at work count?
Yes. The Commission’s FAQ gives the example of employees using ChatGPT to write advertising text or translate, and says they should be informed about specific risks such as hallucination. General-purpose AI tools used for work are within the scope of Article 4.
Get your AI literacy evidence in order
Product Innovation Academy helps Indian GCCs and IT firms design and deliver AI literacy programmes that stand up to EU parent, client and auditor scrutiny, from leadership briefings to company-wide training, with completion records ready to share. Request a proposal for your teams.
Sources
- European Commission, “AI Literacy: Questions & Answers” (updated 20 October 2026). digital-strategy.ec.europa.eu
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the European Union. eur-lex.europa.eu
- EU Artificial Intelligence Act, Article 4: AI literacy (consolidated text with amendments). artificialintelligenceact.eu
- EU Artificial Intelligence Act, Article 2: Scope. artificialintelligenceact.eu
- EU Artificial Intelligence Act, Article 3: Definitions. artificialintelligenceact.eu
- NicFab, “Digital Omnibus on AI: Regulation (EU) 2026/1744 Is Published in the Official Journal”. nicfab.eu
- Gibson Dunn, “EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes”, May 2026. gibsondunn.com
- The Tribune, “India’s GCCs are increasingly leading the AI mandate for global enterprises: Nasscom-Zinnov report”, 3 July 2026. tribuneindia.com
- MirvoLegal, “DPDP Rules, 2025: Compliance Timeline for Data Fiduciaries” (reviewed 20 September 2026). mirvolegal.com