AI literacy for small and mid-sized companies

A checklist, an internal policy template and a training record form

Since February 2025 the EU AI Act requires that employees who use AI tools understand what those tools do and where their limits are. The obligation applies to companies that merely use AI, not only to those building it. This document contains the three parts that are enough to evidence your measures: a list of tools, a one-page internal policy and a training record.

1. List of AI tools in use

One row per tool. If several people use it with different accounts, record whether the paid (business) or the free version is in use.

Tool	What it is used for	Version	Person responsible	May customer data be entered

If a tool is not on the list, it does not exist as far as the company is concerned. In practice most of the risk comes from tools someone introduced on their own, without management knowing.

2. Internal AI usage policy (template)

Copy into your own document, add the company name and date, and sign it. One page is enough.

What is allowed

Drafting text, translations, summarising publicly available material.
Help writing quotes and product descriptions from your own material.
Data analysis without personal data of customers or employees.

What is not allowed

Entering personal data of customers, employees or candidates into free versions of tools.
Entering price lists, drawings, contracts or other trade secrets without approval.
Sending an AI answer to a customer without an employee checking it.

Employee obligations

Responsibility for content stays with the person sending it, not with the tool.
An incorrect answer is reported to the person responsible listed in part 1.
A new tool is introduced only with the approval of the person responsible.

Company	Date	Person responsible	Signature

3. Training record

The evidence of your measures is not a certificate but a record: who was briefed, when and on what. Filled in once per employee and updated at every new session.

Name	Role	Date	Topic	Duration	Signature

Minimum content of a session

What the model does: it predicts the next word, it does not verify truth.
Why it makes things up and how to spot it.
Which data never goes into a tool, and why.
The difference between the free and the business version of a tool.
Who a mistake is reported to and who approves a new tool.

Questions about applying this in your company: info@uvedi.ai · +385 91 2205 068