Article 4 — AI literacy
People who operate or oversee AI need training for their role. A once-a-year slide with no assignment trail is not a system.
EU AI Act
It asks whether the organisation knows what it deploys, at what risk, with which people trained, and with which evidence when something goes wrong.
Why the AI Act exists
Regulation (EU) 2024/1689 classifies uses on a risk pyramid: prohibited practices, high-risk systems, limited-risk transparency, and minimal-risk uses that still sit inside an organisation that must not drift into a banned pattern by accident.
Most buyers of this module are not placing a medical device on the Union market. They are employers and public bodies that buy SaaS, embed models, and let staff use tools. That is the deployer role — and it is already regulated.
Obligations that fall on companies
People who operate or oversee AI need training for their role. A once-a-year slide with no assignment trail is not a system.
You must screen uses, not hope you are not running a banned pattern.
Use high-risk systems as intended, assign human oversight, keep logging meaningful, inform workers where the law requires it.
Fundamental-rights impact assessment for public bodies and certain private deployers of high-risk systems before use.
People must know they are talking to a chatbot or looking at labelled synthetic content.
Serious incidents recorded and notified; where Article 86 applies, individuals can seek an explanation of a high-risk decision.
What For Business does
Overview KPIs, classification wizard, SaaS catalogue, systems inventory, high-risk register, FRIA, transparency notices, incidents, human oversight, explanations, literacy assignments, supplier and model catalogues, dossier export, reminders, evidence links to Drive and QMS.
The AI Act copilot can draft under Confirm. We do not certify compliance, perform conformity assessment, CE mark, or file in the EU database of high-risk systems.
Open gaps
Every AI system in use — the internal copilot, the vendor assistants staff turned on, an OCR step nobody registered — carries its own open duty: an oversight procedure not linked, a transparency statement missing, literacy evidence incomplete, a conformity assessment never recorded. Severity is stated, an owner is named, and the evidence links to the Drive and QMS documents you already keep. That is a control system, not a policy PDF.
If you have no control system
Prohibited practices: up to €35 million or 7% of worldwide annual turnover. Other operator obligations: up to €15 million or 3%. Incorrect information to authorities: up to €7.5 million or 1%. SMEs typically take the lower of the euro amount and the percentage.
Money is not the only lever. Authorities can order you to stop a use. Without an inventory, literacy register, FRIA trail and incident log, diligence is hard to demonstrate. For Business does not pay your fine. It makes diligence visible.
This page is commercial information, not a legal opinion, not a prospectus, and not certification. Take specialist counsel before you rely on any figure. Availability and scope depend on contract and product maturity.