AI literacy and the EU AI Act: what a company must have in place

Most of the debate around the EU AI Act revolves around high-risk systems, so many companies conclude the regulation does not concern them. For a company of five or fifteen people using ChatGPT and a chatbot on its website, one short provision is what matters — Article 4 and the AI literacy obligation.

The Act (Regulation EU 2024/1689) entered into force on 1 August 2024 and applies in phases. The key distinction is between two roles: the provider, who develops an AI system and places it on the market, and the deployer, who uses it in their own business. Almost every small and mid-sized company falls into the second category — and for them the most important obligation is precisely AI literacy.

The timeline of application

These are the dates worth keeping in mind:

2 February 2025 — the general provisions and the AI literacy obligation (Article 4) start to apply, together with the prohibitions on certain practices in Article 5.
2 August 2025 — the rules for general-purpose models apply, the governance structure is established, and member states designate competent authorities and adopt penalty regimes.
2 August 2026 — most of the remaining rules apply, including the transparency obligations, and enforcement begins.

A legislative package postponing some of the high-risk deadlines is under discussion. That debate does not change the AI literacy obligation — it has applied since February 2025 and holds regardless of which kind of AI system you use.

What Article 4 actually requires

The wording is deliberately open: providers and deployers of AI systems must take measures to ensure a sufficient level of AI literacy among the people who operate those systems on their behalf. There is no prescribed curriculum, exam or certificate. Three things matter:

Scope. It covers everyone using AI on the company’s behalf — employees, but also contractors and agencies.
Proportionality. The depth of knowledge is measured against role and risk. A salesperson drafting a quote with AI and the person configuring automated enquiry handling do not need the same depth.
Measures, not outcomes. A supervisory authority will not ask whether every employee passed a test, but which measures you took. A company that took none has no answer.

What this looks like in a small company

A programme that serves the purpose in a company of up to fifty employees usually has four elements.

A list of tools. Record which AI tools are in use, who uses them and for which tasks. Most companies discover tools management never knew about.

Basic training. One hour for everyone who uses AI: how a model produces an answer, why it errs convincingly, what must never be entered and when human review is mandatory.

Internal rules. One page of text: permitted tools, forbidden data types, mandatory review before anything goes to a client, and who to report a problem to.

Records. Training date, list of participants, policy version. That is your evidence of the measures taken.

Prohibited practices and transparency

The Article 5 prohibitions rarely concern manufacturing and service companies — they cover things like social scoring or manipulative systems. It is more practical to look at the transparency obligations: when a chatbot communicates with a client it must say so clearly, and AI-generated content must in certain cases be labelled. A sentence like “you are chatting with a digital assistant” in the first message settles most of that.

Why this is a business question, not just a legal one

Companies sourcing suppliers increasingly ask in their questionnaires how AI is used, just as they ask for data-protection documentation today. Tidy internal rules and a training record clear that part of procurement faster than any statement of intent.

For most companies compliance is not a project but one list of tools, one training session and one page of rules — with the date recorded.

Next: what you may enter into ChatGPT · glossary