AI Literacy Training for Your Staff: What the AI Act Asks and How GDPRWise Helps

If your team uses AI tools at work, from ChatGPT to the Copilot button in your office software, the EU AI Act asks you to take measures that support their AI literacy. For a small business that does not mean a training programme. It means clear rules on which tools and data are allowed, and a short, practical training for everyone who uses them. GDPRWise offers a free course for exactly that, and the official exam in the app.

What the AI Act asks: Article 4 on AI literacy

Article 4 of the AI Act (Regulation (EU) 2024/1689) deals with AI literacy. It has applied since 2 February 2025, and the Digital Omnibus on AI (Regulation (EU) 2026/1744) rewrote it in July 2026. The current text says that providers and deployers of AI systems must take measures to support the development of AI literacy of their staff and of other people who operate AI systems on their behalf.

Three points matter for a small business:

• You are a deployer. Anyone who uses an AI system under their authority for work is a deployer (Article 3(4)). A bakery whose staff write product texts with ChatGPT is one. Only purely personal, non-professional use falls outside.
• The measures must fit your situation. The article asks you to take into account your staff’s technical knowledge, experience, education and training, the context in which the AI is used and the people it affects. A team that drafts emails with AI needs less than a team that uses AI to screen job applicants.
• You do not have to guarantee a result. Since the 2026 amendment, the text states that it does not require you to guarantee a specific level of AI literacy for any individual. The duty is to make a real effort, and you should be able to show what you did.

The Commission and the Member States must support businesses in this, with particular attention to small and medium-sized enterprises, including through practical examples published by the Commission.

Why the GDPR matters here too

The AI Act does not replace the GDPR. As soon as an employee types personal data into an AI tool, the GDPR applies in full: you need a legal basis, a processing agreement with the provider when it processes the data on your behalf (Article 28), and appropriate security measures (Article 32). Article 32(4) also asks you to make sure that people who work under your authority only process personal data on your instructions.

In practice, the biggest risk is not the AI itself but what staff put into it: a customer list pasted into a free consumer account, a CV uploaded to a tool without a processing agreement. That is why AI literacy and GDPR awareness belong together. Our article on AI tools and the GDPR explains the privacy issues in more detail.

What proportionate AI literacy looks like for a small team

For most small businesses, four elements are enough:

1. Clear rules. An AI policy that says which tools are allowed, with which account type and which data. Without rules, training has nothing to point to.
2. A short training for everyone who uses AI. Practical, with recognisable situations: what you may type in, how to check the output, when to tell a customer that AI was involved.
3. More depth where the risk is higher. Staff who use AI for decisions about people, such as recruitment, need more than the basics.
4. A record. Who took the training, when, and which version of the policy they confirmed.

The free Using AI safely course

GDPRWise offers the Using AI safely course for free. It runs in the browser, needs no account and takes about 30 minutes. It is available in English, Dutch, French and German. The seven modules cover:

• Welcome: AI at work - what AI tools are good for, and what safe use means in your organisation.
• What happens to what you type? - where your text and files go, and the difference between a free or personal account and a business account.
• What can you put in? - green, amber and red data, and where personal data hides in everyday documents.
• Checking the result - you sign off, not the AI: errors, bias and genuine human review.
• Being open about AI - when to say that AI helped, and how to handle recording and transcribing meetings.
• AI used against you - fake voices, deepfake video calls and fake AI apps, and why you verify through a second channel.
• When things go wrong, and new tools - what to do when you typed in something you should not have, why every hour counts, and how to ask before using a new tool.

The course ends with a free practice quiz, so everyone can check what they learned.

The official exam and certificate of attendance in the app

The official exam is part of the training feature in the GDPRWise app, which is included in the paid plans. Staff take the exam in the app and confirm your organisation’s AI policy as part of it. Each employee who completes it receives a certificate of attendance in their name.

The free course and the app do different jobs:

• The practice quiz on the website has five questions to check yourself. Nothing is recorded and there is no certificate.
• The official exam in the app has 20 questions from a separate pool that is not on the website, a pass mark of 70%, and the confirmation of your AI policy. It gives each employee who passes a certificate of attendance that you can keep as your record.

In the app, the account owner assigns the training to staff and follows each person’s progress, completion and score. That is the record from point 4 above, without a separate list.

This connects to the rest of your AI compliance in GDPRWise. You first set your AI policy: you list the AI tools your staff use, link their vendors and set a rule per tool. Our guide to the AI Permissible Use Policy walks you through it. The next compliance item, Implement AI staff training, then covers the training itself.

The certificate shows attendance and confirmation of your policy. It is not a professional certification, and the course alone does not make your use of AI compliant. It is one well-documented measure among the ones described above.

Getting started in five steps

1. Make an inventory of the AI tools your team uses, including AI features inside existing software.
2. Set your AI policy: which tools are allowed, with which account and which data.
3. Ask everyone who uses AI to take the free course. New colleagues take it when they start.
4. Have staff take the official exam in the app and confirm the policy, so you have a record.
5. Repeat once a year, and whenever you approve a new tool or change the policy.