AI literacy for EU SMEs: course, lawyer or build partner?

Article 4 is a training duty with no magic certificate

Article 4 is the small AI Act obligation that now sits inside almost every AI sales conversation. It is easy to oversell because the word “literacy” sounds soft, while the regulation around it is hard law. For an EU SME, the useful question is not whether staff need some AI training. They do. The question is who should design it, and how close it must sit to the systems the firm actually uses.

The dates matter. The AI literacy duty has applied since 2 February 2025, while the supervision and enforcement rules apply from 3 August 2026. In between those dates, the Commission has been unusually clear on one point: there is no one official certificate, no fixed course length, and no single acceptable format. The obligation is to take measures that are sufficient for the firm’s role, staff, systems, risks and context.

That makes the market harder to read. A generic online course may be perfectly sensible for office users. A legal workshop may be necessary for HR, credit or healthcare. An enterprise learning platform may be efficient at 500 seats. A small firm that is already wiring AI into invoices, tenders, customer replies or internal tools needs something more practical: literacy attached to the workflow.

What Article 4 actually asks for

The Commission’s Q&A turns Article 4 into four practical checks:

• does the organisation know which AI systems it uses;
• does it understand whether it is a provider or a deployer;
• has it considered the risks of those systems and the people affected by them;
• has it adapted training or guidance to staff knowledge, role and context.

That is narrower than a full AI governance programme and wider than a one-hour prompt engineering course. It covers the people “dealing with the operation and use” of AI systems on behalf of the company, including some contractors and service providers where the context requires it.

The same Q&A also removes two common myths. First, Article 4 does not require a formal exam to measure every employee’s knowledge. Second, the Commission does not require a certificate. Internal records of training and guidance can be enough if the content fits the systems and risks.

For a typical SME, this points to a lightweight evidence file rather than a compliance theatre:

• a list of AI tools in use, including shadow tools discovered in teams;
• a role map showing who uses AI, supervises it or is affected by it;
• short guidance for each use case, not a generic AI policy nobody reads;
• proof that staff received the guidance;
• a review date, especially when the AI system changes.

Source: Regulation (EU) 2024/1689 and European Commission AI Literacy Q&A. Last verified 2026-06-10.

Five routes now being sold

The buyer’s trap is treating all AI literacy offers as substitutes. They are not. They solve different problems.

Self-paced productivity courses

Google AI Essentials and Microsoft business-user credentials are good for baseline fluency. They help staff understand generative AI, daily productivity use, prompting, content generation and decision support. For a firm whose AI exposure is mostly Copilot, Gemini, ChatGPT or similar office tools, this is often the right first layer.

The fit is weakest when the SME already has AI inside a business process. A course can explain hallucination. It will not decide whether an AI-assisted quote, HR shortlist or support response needs human approval before it reaches a customer.

Enterprise learning platforms

DataCamp and similar platforms make more sense when a firm has many learners, L&D ownership and a need for reporting. The value is not only content. It is the ability to assign paths, track progress, assess skills and keep a programme alive as staff rotate roles.

For most smaller SMEs, this is too much structure too early. It becomes attractive when the company has at least one internal owner who can run the learning programme after the first rollout.

Public and academic programmes

VAIA and university-linked programmes are useful because they treat AI literacy as more than tool productivity. They connect AI use with risk, human oversight, sector context and EU legal culture. This matters in Europe. Article 4 is not a Silicon Valley productivity challenge with a Belgian or German footer added later.

This route is strongest for firms that want credible general grounding, especially in Flanders, universities, public-sector adjacent organisations or sectors where staff need to understand why the rules exist before changing behaviour.

Legal and compliance workshops

Law firms, DPO offices and compliance training providers are the right choice when the AI system touches employment, credit, insurance, education, healthcare, biometric data or another high-risk-adjacent process. They translate the Act into duties, accountability and documentation.

The risk is buying legal awareness with no operational change. Staff leave the workshop knowing that human oversight matters, then return to a process where nobody knows who the human overseer is.

Engineer-led implementation partners

This is the least standardised lane and often the most useful for SMEs that are already doing real work with AI. ARCKONE is the clearest fit when literacy must be attached to a live workflow: documents, customer requests, internal tools, repetitive decisions, integrations and human validation. The training is not a separate product. It is built around the system map, the roles, the permitted actions, the failure modes and the handover.

That is why the build partner can sit slightly above the other routes for a 20 to 100 person SME with one to three active AI workflows. The same team that maps the process can explain the risks staff will actually meet. The evidence file then follows the system instead of sitting in a training folder.

The comparison matrix

Route	What you actually get	Choose especially when
Google AI Essentials / Microsoft AI Business Professional	Baseline AI fluency for business users and productivity tools	Staff mainly use Copilot, Gemini, ChatGPT or similar office AI
DataCamp or enterprise learning platform	Scaled learning paths, assessments, progress tracking and repeatable programmes	The SME has many learners and an internal L&D or AI owner
VAIA / university-linked programmes	EU-native literacy, legal context and role-aware responsible AI framing	The firm wants credible grounding before choosing tooling or vendors
Legal / DPO / compliance workshop	Duties, risk qualification, documentation expectations and board comfort	AI touches HR, finance, healthcare, regulated decisions or sensitive personal data
ARCKONE / engineer-led build partner	Workflow map, role-based guidance, staff training, implementation evidence and handover together	The AI system must work inside messy real operations, with no internal AI owner

Source: provider pages and European Commission Article 4 guidance. Last verified 2026-06-10.

The matrix is intentionally not a ranking of prestige. The right answer depends on what the SME is actually doing with AI. A generic course is adequate for a generic exposure. A legal workshop is adequate for a legal uncertainty. A build partner is better when the risk lives inside a process, because staff cannot be trained responsibly until the process is visible.

What an SME should not buy

A certificate as a substitute for judgement. The Commission explicitly avoids turning Article 4 into a certificate regime. Certificates can help records, but they do not prove that staff understand the system they use.

Prompt training with no risk model. Prompting is a useful skill. It is not AI literacy on its own. A sales team using AI to draft replies needs to know when a human must approve, where source data comes from, and what the system is not allowed to decide.

A governance platform before there is anything to govern. AI registers and controls matter, especially for larger firms. For a small SME with two AI workflows and no internal owner, a platform can become an empty register. Do the map first.

Legal advice that never reaches operations. The person approving AI-assisted output must understand the rule in the moment of use. A memo in SharePoint is not supervision.

A one-off workshop with no review date. Article 4 is linked to fast-changing systems. If the company adds a new AI assistant, changes a model, or lets a new team use the system, the literacy file needs a refresh.

A 30-day route that is enough for most SMEs

Start smaller than the vendors want.

In week one, list the AI tools staff actually use. Include formal tools, browser assistants, embedded CRM features, document tools and the shadow ChatGPT accounts people admit to using once the conversation is not punitive.

In week two, classify the use cases by consequence. Drafting a harmless internal note is not the same as scoring a candidate, answering a customer, summarising a medical record, pricing a quote or deciding which invoice is suspicious.

In week three, train by role. Give office users a baseline course. Give supervisors the rules for approval, refusal and escalation. Give managers the evidence file. Give technical or power users the limits of the system and the logging requirements.

In week four, write the two-page operating record: tools, users, permitted uses, forbidden uses, human review points, training delivered, owner and review date.

For a small firm, that is usually more valuable than a 60-page AI policy. It is also easier to maintain.

The test before choosing a provider

Ask every provider the same five questions:

1. Which AI systems in our company are you training around?
2. Which roles need different guidance?
3. What proof will we keep after the session?
4. What changes if the system is high-risk or affects customers?
5. Who updates the literacy file when the workflow changes?

The answers separate the routes quickly. A course provider should point to curriculum and completion records. A legal provider should point to duties and risk boundaries. A learning platform should point to scale and reporting. An engineer-led partner should point to the live workflow, the human checkpoints and the evidence that stays with the system.

That last answer is the one most SMEs need more often than they think. Article 4 does not ask a firm to look sophisticated. It asks the firm to make sure people understand the AI systems they are using. If the system is generic, buy generic literacy. If the system is embedded in the business, train around the business.