AI literacy for the team: the silent obligation already in force
Since February 2025, every employee using AI must have "sufficient literacy". Most SMBs don’t yet know this rule is theirs — and it isn’t hard to meet.
One of the least-commented provisions of the EU AI Act is also the only one already in force since 2 February 2025: Article 4. It requires that all staff interacting with AI systems have "sufficient literacy" to do so responsibly.
"All staff" includes the receptionist using ChatGPT to draft emails, the sales rep using a tool with autocomplete suggestions, and the CEO signing a vendor contract without reading it.
What counts as "sufficient literacy"
There’s no closed definition in the legal text — which is both good and bad. Good because each company adjusts to its context; bad because many SMBs assume "we’ll see" and end up exposed.
The emerging consensus among European regulators points to four minimum components:
- Understand what AI is and what it isn’t (a spreadsheet with formulas doesn’t count).
- Know the limits (hallucinations, bias, inability to guarantee facts).
- Know the internal rules (what can and can’t go in a prompt: personal data, commercial information, proprietary code).
- Know when to stop and hand off — in high-impact decisions, AI is never the final decider.
How this gets solved in an SMB without expensive training
Three things any SMB can do next month:
- One 60-minute session for the whole team: what generative AI is, what it isn’t, what the company allows.
- A short document (one page) with practical rules — our responsible use policy.
- A record of who attended the session and signed the document. Without a record, there’s no proof.
What inspectors will ask for (when they ask)
- Documented evidence of training: attendance, materials, dates.
- Internal policy approved by management.
- Real examples of application — showing the policy is followed, not just written.
The common mistake: assuming the team "already knows"
If the team is young and uses ChatGPT at home, it’s easy to assume literacy is handled. It isn’t. Personal use is not professional use — at work there’s sensitive data, internal rules, and legal responsibility. Assuming otherwise is what puts companies in the headlines, like the Korean manufacturer that exposed proprietary code two years ago.
One well-run morning of training today avoids that kind of headline tomorrow.