Training (Article 4) and a usage policy aren't the same thing
It's common to confuse having run a training session with having a policy. They're different, complementary things. Article 4 is a training obligation: making sure your staff understands the AI they use, its risks, and its limits. A usage policy is the written document that sets which tools are authorized, what data can go into them, and what process someone follows to adopt a new tool. You can have complied with Article 4 to the letter and still have no rule about whether an employee can paste a client contract into an AI assistant — they're different questions.
The 4 minimum blocks Article 4 requires
| Block | What it covers |
|---|---|
| General AI understanding | A baseline across the whole organization: what it is, what it isn't, and its real limits. |
| The company's role | Whether the company is a provider or only a user of the AI systems it employs — this changes which obligations apply. |
| Risk assessment of deployed systems | Training tied to the actual systems the company uses, not generic content disconnected from daily work. |
| Department-specific training | The risk of using AI in marketing isn't the same as in hiring — training should reflect that. |
What to add to the usage policy, beyond training
Inventory of authorized tools
An explicit list of what AI each team can use, versus what counts as shadow AI. You can't authorize what you haven't inventoried first.
What data should never go into an AI tool
Client data, trade secrets, proprietary code, sensitive HR information — named explicitly, not assumed.
Approval process for new tools
Who signs off on a new AI tool before a team starts using it routinely, and on what basis.
Contractual extension to third parties
Article 4 covers anyone using AI on the company's behalf — vendors and contractors included, not just direct staff.
Training log
Documented evidence that training happened — Article 4 doesn't require certification, but it does require that you can show it if asked.
What level of policy each company profile needs
| Company profile | What it needs |
|---|---|
| Small business with no high-risk systems | Basic usage policy + general Article 4 training. |
| Company using AI in HR or hiring (potential high-risk, Annex III) | Policy + human oversight procedure + technical documentation if classification confirms high-risk. |
| Company with external contractors using AI | Specific contractual clauses + extending the policy to those third parties. |
Frequently asked questions
Since when is AI literacy training mandatory?
Since February 2, 2025, under Article 4 of the AI Act. Market surveillance of this obligation began in August 2026, but the requirement was already in force before that.
Do I need to certify my employees?
No. Article 4 doesn't require certifications or mandatory staff assessments. It does require training proportionate to each person's role and documented evidence that the training happened.
Does the usage policy also cover external contractors?
Article 4 extends the literacy obligation to any third party using AI on the company's behalf, so it's worth extending the policy contractually to vendors and contractors, not just direct staff.
What if my employees are already using ChatGPT without the company knowing?
This is the shadow AI problem, and it's more common than the exception. The first step isn't discipline — it's an inventory of what's actually being used. From there you define what's authorized, with what data, and under what conditions.