AI literacy checklist for SMEs using ChatGPT, Copilot, or Claude

The 8-item checklist

If your company uses AI tools at work, Article 4 of the EU AI Act requires you to ensure staff have sufficient AI literacy. Here's a practical checklist you can complete in one afternoon.

1. Identify who uses AI

List every role that uses AI tools — ChatGPT, Copilot, Claude, internal AI, or any other system. Don't forget contractors and interns.

2. Write an AI-use policy

Cover: which tools are approved, what data can and cannot be entered, how to review AI output, and how to report problems. Keep it to 4-6 pages.

3. Deliver role-based training

At minimum: one general session for all staff, plus add-on modules for roles with specific risks (HR, marketing, developers). The Commission FAQ expects a role-based approach.

4. Log who attended

Record name, role, module, date, format (live, recorded, self-paced), and trainer. A spreadsheet is sufficient — no LMS required.

5. Schedule a refresher

Set a review date or trigger for each role. AI tools and guidance evolve. A scheduled annual review can be sensible, but Article 4 does not prescribe an annual course.

6. Publish the policy

Make the AI-use policy accessible to all staff. Intranet, shared drive, or employee handbook — wherever your other policies live.

7. Document the process

Keep a record of how you decided on the training content, who delivered it, and when. This helps explain why the measures were proportionate to the roles, systems and people affected.

8. Review on a schedule and when things change

Check that your policy, training, and records are current on your chosen cadence and whenever tools, use cases, roles, incidents or guidance materially change.

What you don't need

• No certificate or accreditation
• No external trainer
• No LMS
• No specific number of hours
• No submission to any authority

Free template

The AI training record log template gives you the spreadsheet structure for step 4. Download it free — email required.