An obligation that already applies
Many businesses associate the EU AI Act with high-risk systems, large corporations and deadlines that still feel far away. One provision, however, has applied since 2 February 2025 – and it affects almost every organisation where staff use ChatGPT, Microsoft Copilot, DeepL or the AI features built into everyday software: Article 4, the AI literacy obligation.
Under Regulation (EU) 2024/1689, providers and deployers of AI systems must take measures to ensure, “to their best extent”, that their staff and other people dealing with AI systems on their behalf have a sufficient level of AI literacy. Technical knowledge, experience, education and training, and the context in which the AI is used all have to be taken into account.
Who is affected?
In AI Act terms, a “deployer” is anyone who uses an AI system under their own authority in a professional capacity. That covers not just software companies but also the tax adviser drafting letters with ChatGPT or the medical practice summarising reports with an AI tool. In its questions and answers on AI literacy, the European Commission states explicitly that a company whose employees use ChatGPT for tasks such as writing advertising copy or translating texts falls under Article 4. The obligation applies regardless of the risk level of the system.
Besides employees, it also covers people working with AI on your behalf, such as freelancers or service providers.
What does “sufficient” AI literacy mean?
The AI Act does not set a fixed level or require a certificate. According to the Commission, what is needed depends on people’s roles, their existing knowledge and the risk of the specific use. As a minimum, it suggests covering:
- a general understanding of what AI is and how it works,
- your organisation’s role (provider or deployer),
- the risks of the systems you use – with language models, for example, hallucinations: convincing but incorrect answers,
- what staff need to know in practice to deal with those risks.
In the Commission’s view, simply handing out the user manual will rarely be enough. For businesses that only use standard tools, though, the effort is manageable.
Documentation and consequences
No particular form of documentation is prescribed. The Commission considers an internal record of training sessions and guidance sufficient, and Article 4 does not require you to appoint an “AI officer”. Austria’s AI Service Desk at RTR additionally recommends a written AI policy, a training plan and a record of who attended which session and when.
The AI Act itself does not lay down a specific administrative fine for Article 4. According to the Commission, national market surveillance authorities are to supervise compliance from August 2026, with penalties set by the Member States. In practice, liability matters more: if harm occurs because staff used AI without adequate instruction, the lack of training may be attributed to the employer, as RTR points out. If you are unsure how this applies to you, check with your legal adviser.
A practical plan in four steps
1. Take stock of your AI tools
Find out which AI tools are actually in use – officially and unofficially. Include AI features that arrive with updates to existing software, for example in Microsoft 365, in the browser or in industry-specific applications. Note who uses which tool, for what, and with which data.
2. Write an internal AI policy
A short, clear policy removes guesswork: Which tools are approved? Which data may be entered? Who checks results before they go to clients or patients? Who decides on new tools?
3. Train by role
Not everyone needs the same thing. An assistant drafting emails needs different content from someone who incorporates AI output into expert opinions or medical reports. A short baseline session for everyone, role-specific modules and a refresher when new tools arrive work well. New starters should get the baseline session when they join.
4. Build in data protection
AI literacy and data protection go hand in hand, and the GDPR continues to apply alongside the AI Act. The most important everyday rule: do not enter personal data, client data or patient data into public AI services unless a reviewed contract and technical safeguards are in place. Law firms and medical practices also have professional secrecy to consider.
If you want to use AI with real documents, you need a technical solution. One option is a filter such as houdini, which replaces personal data with placeholders on your own premises before a prompt reaches the AI model. Other routes include business editions with suitable contracts or locally hosted models.
Checklist: AI literacy in your organisation
- List of all AI tools in use (including AI features in existing software)
- A named person responsible for AI matters
- Written AI policy covering approved tools and data rules
- Baseline training for everyone, role-specific modules planned
- Attendance and content of training sessions recorded
- “No personal data in public AI” rule communicated and technically enforced
- Annual review date in the diary
Looking ahead: the next AI Act dates
The AI Act takes effect in stages (Art. 113):
| Date | What applies |
|---|---|
| 2 February 2025 | AI literacy (Art. 4) and prohibited AI practices (Art. 5) |
| 2 August 2025 | Obligations for providers of general-purpose AI models, governance, penalties framework |
| 2 August 2026 | Most remaining provisions, incl. high-risk AI under Annex III and transparency obligations |
| 2 August 2027 | High-risk AI embedded in regulated products (Art. 6(1)) |
For most small and medium-sized businesses using AI as a tool, AI literacy and transparency remain the key points. If you use AI in recruitment, for instance, check whether high-risk obligations will apply from August 2026.
How IT United can help
We help you take stock of the AI tools in use, draft a workable AI policy and run training that fits your processes. On the technical side, we make sure AI is integrated securely into your IT environment and Microsoft 365. Find out more under AI consulting.
Want to know where your organisation stands on AI literacy? Book a free initial consultation and we will go through the points with you.
