EU AI Act Tweaks Swap Flexible Effort for External Benchmarks
New AI literacy rules remove the 'best effort' standard, potentially raising compliance costs for companies despite added state support.
Key points
- The revised EU AI Act removes the 'best extent' qualifier from AI literacy obligations for providers and deployers.
- Commission and member states will now provide support and official documentation, changing the compliance landscape.
- The shift from internal best-efforts to external benchmarks may increase documentation and audit complexity.
A recent provisional agreement on the EU AI Act has introduced a subtle but significant shift in how organizations must handle staff training. While headlines focused on delayed deadlines for high-risk systems, an edit to Article 4 replaces a flexible internal standard with a framework that relies on external benchmarks. This change could make compliance more complex rather than simpler.
The previous rule required providers and deployers to ensure staff had sufficient AI literacy to the 'best of their extent.' This phrasing allowed companies to document their own efforts without proving specific knowledge levels. The revised text removes this qualifier, leaving organizations to meet standards that may be defined by the Commission and member states rather than their own internal assessments.
Removal of best-effort language
The original version of Article 4 gave companies a degree of autonomy. They were responsible for taking measures to ensure literacy, but the standard was tied to their own capacity and resources. By dropping the phrase 'best extent,' the new agreement removes this safety valve. Companies can no longer simply prove they tried their hardest; they must now align with broader institutional expectations.
According to analysis from the IAPP, this shift turns a self-assessment obligation into one that is harder to predict and document. While the Commission and member states will now 'support and facilitate' these efforts, the burden of proof still lies with the private sector. The absence of the 'best extent' clause means there is no longer a clear, internal baseline for what constitutes adequate training.
State support changes the dynamic
The new framework introduces a role for public authorities that was not present in the 2024 enacted law. The Commission and member states are now tasked with fostering AI literacy and providing official documentation. On the surface, this looks like a relief for companies who previously had to build training programs from scratch.
However, this institutional involvement creates a new dependency. Companies must now track and integrate official guidelines and resources to demonstrate compliance. Instead of managing a purely internal process, organizations must navigate a landscape where external bodies define the quality and scope of acceptable literacy measures. This adds a layer of regulatory monitoring that did not exist before.
Compliance risks rise for providers
For deployers of high-risk AI systems, the stakes are particularly high. Other articles of the Act require robust governance and documentation. If the standard for literacy is no longer defined by the company's own best efforts, auditors may look for evidence of alignment with state-endorsed standards. This creates a higher bar for proof.
The trade-off is clear: organizations gain access to official resources but lose the flexibility of self-defined standards. The removal of the 'best extent' qualifier means that what counts as sufficient literacy is no longer under the company's sole control. This could lead to inconsistent interpretations and increased legal uncertainty during audits.
