What Article 4 requires today
Article 4 of the EU AI Act has applied since 2 February 2025 to two kinds of organisation: providers, who develop or place AI systems on the market, and deployers, who use AI systems in their professional activity. An SME whose staff use ChatGPT, Copilot, Gemini or a CRM with AI features is a deployer.
Regulation (EU) 2026/1744, in force since 27 July 2026, reworded the article. The obligation is now to take measures to support the AI literacy of staff and other people using AI on the organisation's behalf, taking into account their technical knowledge, experience, education and training and the context the AI is used in. You no longer have to guarantee a specific level for each person, but the obligation still exists. National market surveillance authorities have supervised it since August 2026.
In one sentence: do something reasonable and proportionate so your team understands the AI it uses, and be able to show what you did.
What it does not require
- No certificate. The European Commission FAQ says no certificate is needed; keeping an internal record of trainings and other initiatives is enough.
- No official course or accredited provider. You can use your own material, internal sessions or external resources.
- No formal “AI officer”. A named point of contact helps, but the law does not require a new role.
- No one-size-fits-all training. The opposite: measures should fit each person's role and use of AI.
The Commission does say that simply pointing staff to a tool's instructions for use is often not enough. Its example is clear: if your staff use ChatGPT to write or translate, they should know about specific risks such as hallucination.
The Article 4 checklist in 6 steps
This is the web version of our free checklist. You can also tick it off in the free online register. For an SME with 10 to 50 people, it can be done in an afternoon.
1Build an inventory of AI tools
- List every AI tool in use: assistants such as ChatGPT, Copilot or Gemini, and AI features inside software you already pay for (CRM, email, translation, customer support).
- Note who uses each tool, what for and with which data.
- Include contractors or suppliers who use AI on your behalf: the FAQ counts them as “other persons”.
Use the register template (CSV) or the free online register: one row per tool. Unofficial use is usually bigger than expected, so ask each team.
2Work out your role and risk level
- Do you only use AI (deployer) or do you also build or sell it (provider)?
- Could any use be high-risk under Annex III, such as recruitment, worker evaluation or credit scoring? Then further obligations apply (for example, Article 26 requires human oversight by people with the necessary competence and training). Get professional advice.
- Could any use be a prohibited practice under Article 5? Stop it.
3Plan measures by role
According to the FAQ, the minimum content to consider includes:
- General understanding: what AI is, how it works, which AI the company uses, its opportunities and dangers.
- The risks of each tool: hallucination, personal and confidential data, bias, intellectual property.
- Tailoring by role: management, HR, sales and marketing, customer support, technical teams.
- Basic legal and ethical aspects: the AI Act and the GDPR.
A short session per role, built around a real example from your work, usually lands better than one long generic course.
4Write an AI acceptable-use policy
- Approved tools and who may use them.
- What must never go into unapproved tools (personal data, client data, contracts).
- Human review of anything sent externally or used in decisions about people.
- An internal contact for questions and new tools.
One page is enough. What matters is that staff read it and that you record it.
5Keep a record of what you do
This is the step most often skipped, and the one that lets you show you acted. A simple internal record can have these columns:
| Field | Example |
|---|---|
| Person and role | Laura M. · Sales |
| Date | 20 Oct 2026 |
| Content | AI in sales: client data and reviewing proposals |
| Duration and format | 45 min · internal session + short quiz |
| Policy read | Version 1.0 · acknowledged 20 Oct 2026 |
6Review regularly
- Update the inventory and training when you add a tool or change how one is used.
- Do a general review, for example every six months.
- Include AI literacy in onboarding for new starters.
Common mistakes
- Buying an “official certificate”. There is none and none is required. What counts is what you did and that it is documented.
- Forgetting embedded AI. Many everyday tools include AI features even if they are not labelled “AI”.
- One course for everyone. Someone drafting emails and someone building sales reports need different guidance.
- Leaving no trace. Training with no record is hard to demonstrate.
Free public resources
- The AI Office's living repository of AI literacy practices, linked from the Commission FAQ.
- The European Digital Innovation Hubs (EDIH) network, with support points for SMEs in every country.
- Our online register, register template and checklist, free with no sign-up.
Sources
General information, updated 18 October 2026. Not legal advice.
Frequently asked questions
Is an AI literacy certificate mandatory?
No. The European Commission FAQ says no certificate is needed; an internal record of trainings and other measures is enough.
Does it apply if my team only uses ChatGPT?
Yes. Using ChatGPT at work makes you a deployer. The Commission uses this example: staff should know about risks such as hallucination.
What changed with Regulation (EU) 2026/1744?
Article 4 now requires taking measures to support AI literacy, without guaranteeing a specific level for each person. The obligation still exists and national authorities have supervised it since August 2026.
How long does it take?
For an SME, the inventory, the policy and a short session per role can be done in a few hours. What matters is that it fits your use of AI and is recorded.
Handle Article 4 in an afternoon
Short role-based training, an AI-tool register and an evidence pack. Joining costs nothing.