ChatGPT in the team — without rules?
Unmanaged use is not a motivation problem, it is a liability risk. What to do now.
Answer · EU AI Act · Training obligation
What does Article 4 of the EU AI Act require from my business?
The short answer: since 2 February 2025, Article 4(1) of the EU AI Act has required deployers of AI systems of any size to ensure a sufficient level of AI literacy among everyone who works with AI — including the five-person firm where people “only” work with ChatGPT. Appropriate measures and evidence of them are required. Certificates or exams are not.
AuthorMatthias EgerCertified Manager for Applied AI Transformation (IHK)Last reviewed17 Jul 2026
To the verification recordWhat the law says.
Article 4 of the EU AI Act (Regulation (EU) 2024/1689) is among the provisions that have applied since 2 February 2025 — ahead of most other parts of the regulation. It addresses providers and deployers of AI systems. There is no exemption for small businesses, no privilege for the trades, no turnover threshold.
Article 4(1) EU AI Act — the core
“Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff […], taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in […].”
You become a deployer faster than you think: a deployer is anyone who uses an AI system professionally under their own authority. If your office drafts quotes with ChatGPT or your bookkeeping has an AI read receipts, you are deploying AI systems within the meaning of the regulation. Only purely private use is exempt.
What counts as “sufficient” depends on role and context: someone having emails drafted needs different knowledge from someone using AI to check invoices or contracts. The regulation does not require one-size-fits-all training — it requires that the competence fits the task.
In practice
What this means for your business —
three steps.
01
Know who uses AI for what.
Take stock — including the unofficial tools. In most businesses staff have long been using AI, only nobody knows exactly how. Without that picture you can neither build competence nor evidence anything.
02
Build competence that fits the task.
What AI can and cannot do, which data may go in, who checks results before they go out. The form is up to you: training, clear rules, guidance in day-to-day work — what matters is that people can genuinely do it afterwards.
03
Document how you built it.
Content, participants, date — put down in writing. If an authority asks, or the insurer does after a claim, the answer sits in a folder instead of in someone's memory.
That exact package — skill, rules, evidence — is what a documented one-day in-house workshop delivers. The AI Day: see the format
What Article 4 does not require.
A small market of fear has grown up around the training obligation. So, to be clear, here is what the law does not say:
- No compulsory certificate. Nobody has to sit an exam or acquire a particular seal.
- No prescribed form of training. No mandatory course, no prescribed provider, no catalogue of hours.
- No dedicated penalty regime. Honestly: the regulation provides no separate fine for breaches of Article 4.
Why you should still take the obligation seriously: supervisory authorities can check compliance, and if an AI causes damage in your name — wrong information, customer data in the wrong system — the immediate question is whether the business enabled its people. That is when documented evidence is the difference between an incident and an organisational failing.
“Article 4 is not a threat. It is the occasion to bring order to the sprawl before it gets expensive.”
Because the real risk is not the authority — it is the unmanaged day-to-day: your people already use AI, the only question is whether with guardrails or without. What unmanaged use in a team actually means →
Common questions
What owners want to know about Article 4.
Does the obligation apply even if we only use ChatGPT?
Yes. A deployer is anyone who uses an AI system professionally under their own authority — including the business whose office drafts quotes or emails with ChatGPT. Only purely private use is exempt.
Do my people need a certificate?
No. Article 4 prescribes neither certificates nor exams nor any particular form of training. What is required is competence that fits the role and the use — and evidence that you built it.
What happens if we do nothing?
There is no dedicated fine for Article 4 — and I am saying that against my own interest. But: supervisory authorities can check compliance, and after a claim the documented evidence decides whether your business met its duty of care. The bigger risk you carry every day anyway: using AI without rules.
Is a one-off training session enough?
The law names no interval. The yardstick is that the competence fits the current use: if new tools or tasks come along, the skill has to keep up. A cleanly documented start plus a brief annual review is sensible practice — not a permanent building site.
One day on site. Obligation met, team able to work.
The AI Day: an in-house workshop on your real tasks — rules, skill and the documented evidence under Article 4 included.