# AI Act Article 4 checklist: AI literacy for SMEs (free)

Version 18 Oct 2026. General information, not legal advice.
Based on: Article 4 as amended by Regulation (EU) 2026/1744 (https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng) and the European Commission FAQ (https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers).

**What Article 4 requires today:** providers and deployers of AI systems must *take measures to support* the AI literacy of their staff and other persons operating AI on their behalf, taking into account their knowledge, experience, education and training and the context of use. It does not require guaranteeing a specific level for each person. No certificate is required. National authorities supervise it since August 2026.

## A. Inventory
- [ ] List every AI tool in use (including ChatGPT, Copilot, Gemini, AI features inside your CRM, translators…) → use `ai_tools_register_template.csv` or the free online register.
- [ ] Note who uses each one, what for and with which data.
- [ ] Include contractors/suppliers who use AI on your behalf (the FAQ counts them as "other persons").

## B. Role and risk
- [ ] Are we only users ("deployer") or do we also build or sell AI ("provider")?
- [ ] Could any use be high-risk (Annex III: e.g. recruitment, worker evaluation, credit scoring)? If so, further obligations apply (Art. 26: training for human oversight) → get professional advice.
- [ ] Could any use be a prohibited practice (Art. 5)? Stop it.

## C. Measures (per the FAQ, minimum content to consider)
- [ ] General understanding: what AI is, how it works, which AI we use, opportunities and dangers.
- [ ] Specific risks of each tool (hallucination, personal/confidential data, bias, intellectual property).
- [ ] Tailor by role: management, HR, sales/marketing, customer support, technical staff.
- [ ] Basic legal and ethical aspects (AI Act, GDPR).
- [ ] "Read the instructions for use" alone is not enough (the FAQ considers it often ineffective).

## D. Internal policy
- [ ] AI acceptable-use policy (which tools, which data must never go in, human review of outputs).
- [ ] Internal point of contact (no formal "AI officer" is required).

## E. Evidence (internal record)
- [ ] Training record: person, date, content, duration, format.
- [ ] Policy version and acknowledgement of reading.
- [ ] Periodic review (e.g. every six months or when adding a new tool).

## F. Free public resources
- The AI Office's living repository of AI literacy practices (linked from the FAQ).
- The EDIH network (European Digital Innovation Hubs), support points for SMEs.