Somewhere in your business, someone is using ChatGPT for work. They did not ask permission, because it did not occur to them that they needed to, and in fairness it is not obvious that you would say no.
That arrangement has a legal dimension. The AI literacy duty under Article 4 of the EU AI Act has applied since 2 February 2025, its wording was softened in July 2026, and market surveillance authorities began supervising it on 2 August 2026. It reaches almost every organisation using these tools, regardless of size or sector.
It is called AI literacy, and it is the least dramatic and most useful thing in the entire Act.
What the obligation actually says
Providers and deployers must take measures to support the development of AI literacy among their staff and anyone operating these systems on their behalf, taking account of their knowledge, experience, education, the context of use, and who is affected.
That wording is deliberate and it changed. Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced the original “ensure a sufficient level” with “support the development of” on 27 July 2026. It is now an obligation of effort rather than of result: you support people getting there, you are not required to guarantee that every individual reaches a measurable standard.
Notice what is still not there. No named qualification. No mandatory training provider. No certificate to renew annually. No register to file.
The standard is proportionate, which means what is reasonable for a bank is not what is reasonable for a twelve-person firm. For most small businesses this is a short policy, a conversation, and a refresher when tools or risks change. It is closer to a decent induction than to a compliance programme, though “we mentioned it once” is not the same as taking measures.
Which is exactly why it is worth doing properly rather than resenting. The obligation is asking you to do something you should already want to do.
Why this one matters more than the scary parts
The parts of the AI Act that generate headlines mostly do not touch ordinary businesses. Prohibited practices and high-risk systems are real, but unless you are screening job applicants or making decisions about access to services, they are somebody else’s problem.
Literacy is different. It applies where the actual damage happens.
In practice, harm in small businesses does not arrive as a regulatory breach. It arrives as somebody confidently sending a client a figure that a model invented, or pasting a full customer list into a public tool to “tidy it up”, or a quote going out with a number that was never checked because the output read so fluently that nobody thought to.
None of that is a technology failure. All of it is a knowledge gap, and every bit of it is preventable in an hour.
What to actually cover
Five things. If your team understands these, you have discharged the obligation and, more importantly, removed most of the real risk.
- It predicts, it does not know. These tools generate the next plausible piece of text. Plausible and true overlap most of the time, which is precisely what makes the gaps dangerous. A wrong answer looks exactly like a right one.
- Confidence is not a signal. There is no tone change when a model starts inventing. Staff should know that fluency carries no information about accuracy.
- Anything factual gets checked. Names, figures, dates, legal points, anything going to a customer. The tool drafts, a person verifies.
- What must never be pasted in. Customer personal data, anything covered by a confidentiality agreement, financial detail, credentials. This deserves its own clear line, and it has a genuinely complicated answer under GDPR.
- Say when it was used. Not for everything, but where it matters. A customer is entitled to know they are talking to a machine.
That is the syllabus. It fits on one page and it does not need a consultant to deliver.
Write down what is allowed
The second half is a short written policy. Short genuinely means short: a page, in plain language, that anyone will actually read.
Cover which tools are approved, what may go into them, what must not, what always needs a human check, and who to ask when it is unclear. That last line matters more than the rest, because the alternative to asking is guessing.
Resist the temptation to ban everything. A ban does not stop the use, it moves it onto personal accounts and personal phones where you have no visibility at all. A permissive, clear policy beats a strict, ignored one every time.
Start with the inventory
Before writing anything, find out what is already in use. This is consistently more than expected, because AI features now arrive inside software you already pay for, switched on by default, without ever being called AI in the interface.
Your email client, your CRM, your accounting package, your helpdesk, your meeting recorder. Ask the team directly and without any suggestion that they are in trouble, because you want the true answer rather than the safe one.
The inventory tends to be useful twice. It satisfies the obligation, and it is the honest starting point for deciding where AI is worth using deliberately rather than by accident.
The honest summary
A real obligation with a proportionate standard. For most small businesses it amounts to a page of written guidance, an hour with the team, a named person who approves new tools, and a refresher when something changes.
If you would rather not start from a blank page, the policy template and the record sheet are here, free and editable. The record is the part that matters most, because an obligation of effort is only demonstrable if you wrote the effort down.
If somebody tries to sell you a certified AI literacy programme for a twelve-person company, you are being sold something the law did not ask for.
Where it stops being simple is if AI touches hiring, credit, or who gets access to a service. That is a different tier with genuinely different requirements, and those obligations now start on 2 December 2027 rather than August 2026, having moved under the same July 2026 amendment. If you are unsure which side of that line one of your systems sits on, describe what it does and you will get a straight answer rather than a proposal.
Sources
Article 4 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, both on EUR-Lex, and the European Commission’s AI literacy material. Checked 6 August 2026. General information, not legal advice.
Common questions
Does AI literacy mean paying for a certified course?
No. Nothing in Article 4 names a provider or a qualification, and since July 2026 it asks you to support the development of AI literacy rather than guarantee a level. For a small business that is a page of guidance and an hour with the team.
Who exactly needs to be trained?
Anyone using these tools on the organisation’s behalf. That usually turns out to be more people than expected, because AI features arrive switched on inside software nobody thinks of as AI.
How do we prove we did it?
Write down what you covered and when, and note it for new starters. There is no prescribed record, but a dated page describing what staff were told is a reasonable answer to the question.