AI Literacy Policy Template (EU AI Act Article 4)

The RegShelf AI Literacy Policy is a fill-in Word template that turns the open-ended wording of Article 4 into a concrete, defensible internal policy: who needs which level of AI literacy, how it is delivered, and what evidence you keep. Article 4 was softened by the Digital Omnibus (Regulation (EU) 2026/1744, adopted 8 July 2026, in force since 27 July 2026): organisations must now take measures to support the development of a sufficient level of AI literacy, taking into account staff members' technical knowledge, experience, education and training and the context in which the AI systems are used. A written policy plus recorded training is the most straightforward way for an SME to evidence those measures — which is exactly what this template, paired with the kit's training deck (doc 02) and attendance log (doc 03), is built to do.

Everyone in scope of the AI Act, which in practice means almost every company: Article 4 applies to providers and deployers of AI systems, regardless of company size and regardless of whether any system is high-risk. If your staff use a chatbot, an AI feature inside your CRM, a code assistant or a meeting transcriber in the course of work, you are a deployer and Article 4 applies to you. The duty covers employees, contractors and other persons operating AI systems on your behalf. Market surveillance authorities can ask how you meet it — a signed policy and completion records are the evidence you would show.

Three things matter, and SMEs frequently get all three wrong:

• Measures, not guarantees. As amended, Article 4 requires measures that support the development of sufficient AI literacy. There is expressly no duty to guarantee that any individual reaches a particular competence level.
• Training is one route, not the mandated one. Courses, guidance documents, tool onboarding and supervised practice can all count. A training programme is simply the easiest measure to evidence.
• Context-sensitive, not one-size-fits-all. The Act tells you to account for technical knowledge, experience, education, training and context of use — a developer shipping AI features needs more than a colleague using a spell-checker.

Article 4 prescribes no training cadence, no deadlines and no retention period. Any 30-day onboarding window, annual refresher or 5-year record-keeping rule is an internal control you choose — the RegShelf template says so explicitly wherever it recommends one.

Document 01 of the kit is a nine-part policy with five fill-in tables:

• Purpose and legal basis — Article 4 stated accurately, including the post-Omnibus "support the development of" standard;
• Scope — employees, contractors, temporary staff and interns, on company or personal devices;
• Plain-language definitions table — AI system, GPAI, provider, deployer, AI literacy, hallucination, high-risk system;
• Four role groups with cumulative literacy requirements — all staff, AI power users, builders and product teams, management;
• Training cadence table — onboarding within [30] days, annual refresh, event-driven briefings, role-change modules, each labelled as a recommended internal control;
• Responsibilities matrix, records and evidence rules (what to log per training event and the [5]-year recommended retention), a 12-month review cycle and a management signature block.

It cross-references the AI Literacy Training Deck (doc 02) and the Training Attendance Log workbook (doc 03), so policy, delivery and evidence line up.

Replace every [square-bracket] field with your details, adjust the four role groups in the table to how your teams actually use AI, and have management sign the approval block. Deliver the first training round with the kit's deck (or your own material), record completion in the attendance log, and publish the policy where staff can find it. Review it at least annually or when your AI use changes. Start from your AI system inventory so the role groups reflect the tools people really use.