Exitus AgencyExitus Agency

Service · EU AI Act

AI training and use policy

A workshop so your team uses AI with judgement, and a written, dated internal policy saying which tools may be used, with what data, and who reviews. Article 4 of the AI Act asks every company that uses AI to take measures so its staff know what they are doing. What we leave you with is that measure, done and documented.

What Article 4 says, after the Digital Omnibus

Article 4 of Regulation (EU) 2024/1689 has applied since 2 February 2025 and covers providers and deployers: any company that uses an AI system in its professional activity.

Regulation (EU) 2026/1744 (the Digital Omnibus, in force since 27 July 2026) rewrote it. It now requires taking measures to support the AI literacy of staff, taking into account their knowledge, experience and context of use, and makes clear it does not require guaranteeing any specific level for each person.

In plain words: nobody will make you sit an exam. You may be asked what you have done. The good answer is a dated document.

The workshop

A hands-on session with the tools you already use, and with cases from your own work, not textbook examples:

  • What AI does well and where it gets things confidently wrong.
  • What must never go into it: client data, health data, professional secrets, passwords.
  • How to ask so the result is usable, and how to check it.
  • What needs labelling when something made with AI is published.

It adapts to who is in the room: someone who writes, someone who serves clients and someone who signs need different things.

The use policy

A short document that actually gets read:

  • Approved tools, and on which plan (free or business).
  • What data may not go into each one.
  • When human review is required before sending or publishing.
  • How published material is labelled, under Article 50.
  • Who is responsible, and when it is reviewed.

Dated and signed, to file with the training. If anyone ever asks, the answer is already written, dated before the question.

When you don’t need it

If nobody in the company uses AI for work, Article 4 does not apply to you. We tell you, and that is it.

If there are two of you and you use it for little, one page and an hour’s talk are enough. We will not sell you a training programme you don’t need.

An honest note: we are not a law firm. We leave you the measure, done and documented; if you need a legal opinion, that is for your adviser.

Frequently asked questions

Who does Article 4 apply to?

To providers and deployers of AI systems: in practice, any company that uses AI at work, even if it is just ChatGPT. Purely personal, non-professional use is excluded.

Is there a fine for not complying?

Article 99 of the regulation does not attach a specific fine to Article 4. But market surveillance authorities can supervise it, and if there is an incident — client data in a tool it should not have gone into — having done nothing counts against you. Documenting it costs little.

What changed with the Digital Omnibus?

Regulation (EU) 2026/1744 rewrote Article 4: it used to require ensuring a sufficient level of literacy; it now requires taking measures to support it, without guaranteeing a specific level for each person. It is still an obligation, but of means, not of result.

Can we use free ChatGPT?

Your policy decides, which is what it is for. For text with nobody’s data in it, it may be fine. For client or sensitive data, you need a business plan with a data-processing agreement, or local AI.

How much does it cost?

Fixed quote, depending on team size and how many different roles there are. The policy is included with the workshop.

How many people use AI in your company?

Tell us how many you are and which tools you use. We tell you what you need, which is sometimes just one page.

Write to us →