Your team already uses artificial intelligence. The question is whether anyone is governing it. The same pattern shows up every week: a contract, a payroll file or a report pasted into a chatbot “just to summarise it”; a customer database uploaded “to draw conclusions”; an AI-generated text sent without review, with facts or citations that do not exist. There is rarely bad intent. What is missing is that each person knows which data must not go in, how to spot an error, and which internal rule the organisation actually has. Article 4 of Regulation (EU) 2024/1689 requires providers and deployers to take measures to support that literacy. Legal Stones’ training is at Curso AI Act.
What shows up every week
An innovation project is not required for AI to be inside the company. Someone in a hurry is enough.
- A contract, a payroll file or a medical report pasted into a free chatbot “just to summarise it”.
- A customer database uploaded to a tool “to draw conclusions”.
- An AI-generated text sent without review, with facts or citations that do not exist.
There is rarely bad intent. The person wants to move faster. Nobody has told them which information must not leave the company, or what they must check before sending the result.
The consequences can be serious. Pasting a contract, payroll or client data into ChatGPT, Copilot or Gemini can involve personal-data processing and can take confidential information outside the company environment. A text with invented citations or figures can end up in a document the organisation sends as its own. That use is hard to explain afterwards. When the company cannot see it, it has a usual name: Shadow AI.
Article 4 is about the people who use the tool
Regulation (EU) 2024/1689 does not treat the organisation that builds a system and the organisation that opens it for daily work as the same case. One of the first duties to become applicable, on 2 February 2025, is to take measures to support AI literacy. The source is Article 4 on EUR-Lex. We do not reproduce the article. What it does not require is set out in AI literacy and Article 4.
Article 4 applies to providers and deployers of AI systems. Determine first whether the organisation falls into those categories. Using ChatGPT, Copilot or Gemini at work does not automatically make the company an AI provider. It is a reason to check whether it acts as a deployer: it uses the system in its professional activity, even if a third party built it.
Regulation (EU) 2026/1744 (Digital Omnibus), in force since July 2026, did two different things. It postponed certain duties for some high-risk systems in Annex III. And it replaced Article 4: the duty to take measures to support literacy remains. The current text makes clear that it does not require guaranteeing any specific level of AI literacy of any individual. It has not removed the duty. Waiting until 2027 because “high-risk was delayed” does not postpone this one. The full calendar is in the 2026 AI Act guide.
Literacy is not turning the staff into engineers
Measures must be adapted to context: knowledge, experience, training and what the system is used for. Summarising internal notes on an enterprise plan is not the same as pasting a medical report into a free account.
In practice, a useful measure for a team that already uses these tools is that each person knows three things. This is a Legal Stones specification, adapted to real use. It is not a closed list in the regulation, and it is not the only possible measure.
- Which data they must not enter into an AI tool: contracts, payroll, client data, health information or other confidential information, unless the company has written down which tool and which limits make that use acceptable.
- How to spot errors, bias and hallucinations: figures, citations or names the tool presents as true, which have to be checked before the text is sent.
- Which internal rules the organisation has: which tool, for which use, and whom to ask if there is a doubt. A company AI use policy can put that in writing. It is a recommended measure. It is not, by itself, the Article 4 duty.
Curso AI Act: the training, with a record for the company
Curso AI Act is Legal Stones’ AI-literacy programme: adapted training, an assessment and a documentary file of the training measures the company has carried out. It is designed to support organisations on measures related to Article 4. Seats are bought for the people who use AI at work. The whole workforce does not have to be trained. The fee is confirmed when you write.
Each person completes the course and an assessment. Indicative length: 3 to 4 hours, online and self-paced. There is a common block and videos by role. The public syllabus covers foundations, professional use, risks (errors, hallucinations, confidentiality) and responsible use: when not to trust an answer.
The company keeps, in one panel, the named diploma, who trained and when, and the assessment result. That diploma attests completion of the training activity indicated. It is not an official European Union certification and it does not, by itself, attest compliance with legal duties. The AI Act does not establish a single official course or an official European literacy certificate.
Curso AI Act trains the team. Advice on a specific use in the company is a different service. If the first need is to see which tools are actually in use, the starting point is the five questions of the AI Legal Assessment.
Team Pack: the rule, the seats and the file
When the company wants it closed as one engagement, the Team Pack is done in 10 days: a call on real use, an internal AI-use rule, Curso AI Act seats and the file. Up to 40 people and 6 tools. Hiring, health or credit uses are looked at separately. The fee is given by email, for that team.
Frequently asked questions
Has your team already had AI training?
If nobody can say who trained, on what content and when, the training is not documented. Curso AI Act keeps a diploma, a register and an assessment result. It is at cursoaiact.com.
Does Article 4 apply to any company that uses ChatGPT?
It is not automatic. Article 4 applies to providers and deployers. Determine first whether the organisation falls into those categories. Using ChatGPT, Copilot or Gemini does not make the company a provider. It is a reason to check whether it is a deployer.
Has the Digital Omnibus removed the literacy duty?
No. Regulation (EU) 2026/1744 postponed certain high-risk duties in Annex III and replaced Article 4. The duty to take measures to support literacy remains. It does not require guaranteeing a specific level for any individual.
Is Curso AI Act the official EU course?
No. The AI Act does not establish a single official course or an official European literacy certificate. The diploma attests completion of this training. It does not, by itself, attest compliance with legal duties.
Does the whole workforce have to be trained?
Not by default. Measures are adapted to context and to who uses the systems. On Curso AI Act, seats are bought for the people who use AI at work.
Does the course replace advice for the company?
No. Curso AI Act is team training. If you need to see real use or a specific case, the next step is Legal Stones’ AI Legal Assessment, not the diploma.
Curso AI Act: training, diploma and register →
Article 4: what the duty is and what it is not →
If you still do not know which AI the team uses: 5 questions →
What happens if client data is pasted in →
Sources
- AI Act Article 4: Regulation (EU) 2024/1689 (EUR-Lex).
- Amendment of Article 4 and postponement of part of the high-risk regime: Regulation (EU) 2026/1744 (EUR-Lex).
- Spanish Agency for the Supervision of Artificial Intelligence: AESIA.
This page links those sources. It does not reproduce the article and it does not classify a specific case.