AI Act, Article 4: what the AI literacy obligation asks of a small company
If anyone in your company uses ChatGPT, Copilot or Gemini at work, this provision applies to you. It is not as frightening as it sounds, but it does not go away if ignored.
This is not legal advice. I describe the provision as a developer who helps companies meet it understands it. The final wording of your own rules is worth checking with a lawyer.
What the provision says
Article 4 of the EU Artificial Intelligence Act has applied since 2 February 2025. It says that providers and deployers of AI systems shall take measures to ensure a “sufficient level of AI literacy” among their staff and other persons dealing with the operation and use of AI systems on their behalf. Taking into account their technical knowledge, experience, education and training, and the context in which the systems are used.
Three things follow straight away. First, a “deployer” includes a company that simply uses an off-the-shelf AI tool at work. You do not have to build anything. Second, the provision contains no checklist, no number of hours and no certificate template. Third, the level is meant to match the people and what they use AI for: different for an accountant summarising regulations than for the person connecting an assistant to a database.
Does it apply to a small company
Yes, if staff use AI systems at work. The regulation does not exempt small companies from Article 4. The practical difference is that a small company can reasonably be expected to take proportionate measures: a short training, simple rules and a document that confirms them. Not a compliance department.
It is also worth knowing that, as things stand, the provision carries no separate penalty of its own for the mere absence of training. Supervision and any consequences depend on national authorities that are still being set up. That does not change the fact that the obligation exists, and that in a dispute (say, with a customer after a data leak through a chat tool) the question “were your staff trained?” will be asked.
What “sufficient” can mean in practice
The European Commission, in its answers to questions about Article 4, points in a direction: understanding what AI is, how the system used in the company works, what its limits and risks are, and how to interpret its output. Translated to a small company where people use assistants such as ChatGPT or Copilot, that comes to roughly this:
- An employee knows that a language model predicts text rather than checks facts, and can spot a fabricated answer.
- Knows what data must not be pasted into a tool and why a personal account differs from a business one.
- Knows which decisions stay with a human: tax, HR, legal, anything concerning customers.
- Knows who in the company to go to with a question or a problem.
People who configure AI tools or connect them to company data should know more: about permissions, where the data goes, and logging.
A minimal programme for a company of up to 50
| Element | What it is | How long |
|---|---|---|
| Introductory training | What AI does well, where it makes things up, how to check, what may be pasted, personal versus business accounts | 1–1.5 hours for everyone |
| AI usage rules | One page: tools, accounts, data, responsibility for the result, a contact person | An hour to adapt, adopted by management |
| Department part | Exercises on tasks from their work, with the limits for that department | 2–3 hours per department |
| Part for technical people | Permissions, accounts for AI, data, logging | 2–3 hours, only if someone connects AI to systems |
| Onboarding new staff | The introductory training and the rules on joining | An hour per person |
| Refresher | A short reminder when tools or rules change | Once a year |
What documentation to keep
The provision does not say what to document. Common sense and practice from other obligations (health and safety, the GDPR) suggest keeping to hand:
- The training programme with the date, duration and topics.
- A list of participants or named certificates.
- The adopted AI usage rules, dated and signed by a decision-maker.
- A list of the AI tools used in the company and who is responsible for each.
- A short note on how the company judged the level to be sufficient: who uses what and for what, who has had which training.
That is one folder. No more.
What not to do
Do not buy an “AI Act compliance certificate” for the whole company. There is no such certificate for Article 4. Do not send people on a generic online course “about AI” that has nothing to do with their work. Do not ban AI altogether, because staff will use it anyway, only on personal accounts and without rules. The provision is about literacy, not prohibition.
Module 0 of every training I run, Safe AI at work, was put together precisely for this obligation: an introductory session, a rules template and a certificate with the programme that you can put in the binder.