Article 4 of the EU AI Act made AI literacy a legal duty for anyone who builds or uses AI at work — and enterprise buyers started asking for the evidence long before regulators did. This is the role-based training plan, rollout schedule and evidence set we use with SMEs.
Article 4 of Regulation (EU) 2024/1689 — the EU AI Act — is short, but it is one of the first obligations to apply, and it applies horizontally rather than only to high-risk systems. Providers and deployers must ensure, to their best extent, a sufficient level of AI literacy among staff and others operating AI systems on their behalf, taking into account their technical knowledge, experience, education and training, and the context in which the systems will be used.
The practical effect is that almost every organisation using AI at work is in scope, including UK and non-EU businesses whose AI outputs are used in the Union. Regulators are unlikely to prosecute a small firm over a training register, but buyers will ask for it. Enterprise procurement teams already include AI literacy questions in vendor questionnaires, and an unanswerable question is a lost deal long before it is a fine.
Start with an AI inventory rather than a curriculum. List every AI system in use — product features, embedded vendor AI, and the general-purpose assistants your staff already reach for. For each entry record the owner, the data it touches, whether outputs influence decisions about people, and which roles interact with it. That inventory is the same artefact ISO 42001 Annex A.4 expects, so the work counts twice.
Then group people by what they actually do with AI, not by department. Four tiers cover most SMEs: everyone (baseline), frequent users, decision-makers whose AI-informed judgements affect customers or staff, and builders who configure, fine-tune or integrate models. Assigning each person to a tier takes an afternoon and turns an unbounded obligation into a finite piece of work.
Tier 1 should leave knowing which tools are approved, what may never be pasted into a prompt, that outputs can be confidently wrong, and who to tell when something looks off. Keep it concrete and local: use screenshots of your own approved tools and three real examples of a bad output caught internally. Generic AI ethics content generates no behaviour change.
Tier 2 adds prompt hygiene, confidentiality and retention settings, and the difference between consumer and enterprise tiers of the same product. Tier 3 covers human oversight in the Article 14 sense — the ability to understand a system's limits, interpret its output, decide not to use it, and override it — plus bias, adverse impact and how an affected person challenges a decision. Tier 4 covers data provenance, evaluation and testing, logging and traceability, model change management and decommissioning.
Week one: build the AI inventory and assign tiers. Week two: approve the AI acceptable-use policy so training has something authoritative to teach against; a policy adopted after training always contradicts what people were told. Week three: deliver Tier 1 to everyone and Tier 2 to the heaviest users, and capture acknowledgements as you go. Week four: run the Tier 3 and Tier 4 sessions as live workshops using your own systems as the worked examples.
Resist the urge to buy a large off-the-shelf course first. Most SMEs get better results from a short internal deck plus a 30-minute live Q&A, because the questions people actually ask — 'can I put a client email in this?' — never appear in generic courseware. Buy external content later for the technical tiers, where depth genuinely matters.
An AI literacy programme that leaves no trace is indistinguishable from no programme. Six artefacts do the work: the dated syllabus per tier, the delivery record showing who attended which version and when, the comprehension or scenario check with pass results, the signed acknowledgement of the AI acceptable-use policy, the AI inventory the training was scoped from, and the review date with named owner.
ISO 42001 Clause 7.2 and 7.3 expect exactly this competence-and-awareness evidence, and ISO 27001 Clause 7.2 already asks for the equivalent on information security. Run one competence process across both management systems and file the outputs in the same evidence vault. When a buyer asks how you ensure AI literacy, you should be able to answer with a link rather than a paragraph of reassurance.
ISO-STANDARD.app holds your AI inventory, acceptable-use policy, acknowledgements and training records in one workspace, so the Article 4 question in a buyer questionnaire is answered with a link.
ISO-STANDARD.app ships a ready-to-adopt ISO 42001 / EU AI Act workspace with the risk register, controls catalogue, policies and audit-ready exports already wired together — no spreadsheet sprawl, no consultant lock-in.
Prefer a conversation? Email hello@iso-standard.app — a real human responds within one business day.
Not sure where you stand? Score your ISMS against clauses 4–10 and Annex A in a few minutes.
Free gap analysis