AI literacy for SMEs means taking practical, risk-based measures so that staff and others using AI understand the systems, their limitations and the safeguards required by Article 4 of the EU AI Act.
The European Commission’s guidance on AI literacy confirms that Article 4 of the EU AI Act applies to all providers and deployers of AI systems, including small and medium-sized enterprises (SMEs). Businesses must take measures to support the development of AI literacy among staff and other people who operate or use AI systems on their behalf. The obligation does not require every employee to become an AI expert. It requires organisations to provide knowledge and guidance suited to the people involved, the systems they use and the risks those systems create.
AI literacy is an existing obligation for businesses using AI.
Article 4 entered into application on 2 February 2025, and national market surveillance authorities have been responsible for supervising and enforcing it since August 2026. The requirement applies to providers that develop or market AI systems and to deployers that use AI systems under their authority. This means that an SME using commercially available generative AI, recruitment software or an AI-enabled customer-service platform may already fall within its scope.
The 2026 AI Omnibus amended Article 4 but did not remove the obligation. Providers and deployers must take measures to support AI literacy, while the amended wording makes clear that they do not have to guarantee a prescribed or “sufficient” level of literacy for every individual. The Commission and Member States must support implementation, particularly for SMEs, and the AI Board is expected to develop recommendations and common objectives.
AI literacy should reflect the organisation’s role and the systems it uses.
A proportionate programme begins with understanding whether the business is a provider, a deployer or both. It should then identify the AI systems used, the tasks they support and the people who interact with them. This connects AI literacy with the inventory and risk-assessment work that should already form part of an SME’s governance framework.
A team using a generative AI assistant for low-risk administrative drafting does not need the same depth of instruction as staff using AI to shortlist job applicants or support decisions affecting customers. Employees operating a high-risk system may also need specific training to perform effective human oversight. The nature of the system, the business context and the potential effect on individuals should determine what people need to know.
The obligation may extend beyond an organisation’s employees.
Article 4 refers to staff and to other persons dealing with the operation or use of AI systems on behalf of a provider or deployer. Depending on the arrangement, this may include contractors, service providers or others working within the organisation’s operational remit. Businesses should therefore consider who actually uses or supervises each system, rather than limiting training automatically to people on the payroll.
Contractual requirements may help clarify responsibilities where an external provider or contractor operates an AI system on the organisation’s behalf. However, a contractual clause alone will not show that the relevant people understand the system. The organisation should consider whether guidance, access controls and escalation routes work across the full operating model.
Employees need practical knowledge of both capability and risk.
The Commission recommends that organisations build a general understanding of what AI is, how it works and which systems are used internally. Staff should also understand the opportunities and risks of the particular tools relevant to their work. For generative AI, this may include hallucinations, bias, unreliable citations, confidentiality risks and the possibility that prompts or uploaded information will be retained or reused by a provider.
People should know when an AI output requires verification, when human judgement must remain decisive and when a use should be escalated. They also need rules on personal and confidential information, intellectual property, cybersecurity and transparency towards individuals. Training is most useful when it connects these principles to recognisable work scenarios rather than presenting abstract descriptions of the AI Act.
SMEs can use different learning measures for different roles.
The AI Act does not impose a single training format. A short induction may be suitable for occasional users of approved tools, while staff involved in procurement, system configuration, recruitment or customer-facing decisions may require more detailed role-specific learning. Managers should understand accountability and escalation, and technical teams may need instruction on testing, monitoring and the interpretation of system outputs.
AI literacy measures can include live training, concise written guidance, scenario exercises, approved-tool instructions, reminders within workflows and periodic briefings when systems change. Merely circulating a provider’s instructions for use may be ineffective, particularly where staff need to understand legal, ethical or organisational risks that the product documentation does not address.
A proportionate programme still needs evidence and review.
Article 4 does not require a particular certificate, examination or governance structure. The Commission’s Q&A indicates that organisations can keep internal records of training and other guidance initiatives. For an SME, a simple record can identify the target group, system or use case, subject matter, date, delivery method and any follow-up action.
Documentation should show the reasoning behind the programme, not just attendance. Businesses should be able to explain how they consider users’ existing knowledge, the context in which the AI operates and the people affected by it. Completion records, policy acknowledgements, examples used in training and updates prompted by incidents or system changes can help demonstrate a continuing approach.
AI literacy should work with data protection and security training.
Where AI involves personal data, literacy measures should reinforce GDPR responsibilities. Staff should understand why data minimisation applies to prompts and uploads, when a data protection impact assessment may be needed, and how individuals’ rights or transparency duties may be affected. They should also know how to report a suspected personal data breach or inappropriate disclosure through an AI tool.
Integrating AI scenarios into existing privacy, information-security and acceptable-use training can reduce duplication for smaller organisations. The organisation should still make the AI-specific risks visible, particularly where a familiar business tool has gained new AI features that change how information is processed.
Businesses should treat AI literacy as an ongoing governance process.
AI systems and their uses change quickly. A one-off course may become outdated when a provider introduces new functions, a team starts processing different information or a system is moved into a higher-impact context. AI literacy should therefore be reviewed alongside the AI inventory, internal policy, supplier oversight and risk assessments.
SMEs can begin with a focused programme covering current tools and common risks, then expand it as their use of AI develops. The objective is not to reproduce a multinational training academy. It is to ensure that the people making decisions with AI understand enough to use it responsibly, recognise its limits and apply the organisation’s controls in practice.
Discover how Aphaia helps organisations make AI literacy part of practical governance.
Aphaia helps organisations identify their AI literacy needs, develop role-based guidance and connect staff awareness with AI Act, GDPR and cybersecurity responsibilities. A proportionate programme can support compliant adoption while giving employees the practical confidence to use AI systems responsibly.
