AI literacy for SMEs: how to build a short internal program people will actually use

Let's discuss your project →

Many SMEs are already using AI tools, but not always in a controlled way. The real issue is rarely whether the technology exists; it is whether employees know when to use it, what not to share, and when a human must review the result. Under Article 4 of the EU AI Act, organisations must take measures to support AI literacy for staff and others working with AI on their behalf. The European Commission says those measures should fit the people involved, taking into account technical knowledge, experience, education, training and the context of use. It also clarifies that no individual certificate is required, although an internal record of training and related initiatives can be kept. European Commission FAQ

In practice, AI literacy should be treated as a small operating system for the company, not as a one-off awareness session.

What to define before any training session

Before launching a session, define three basics:

Which AI tools are approved for work use.
Which roles can use them and for which tasks.
Which outputs must be reviewed by a person before being sent or acted on.

This matters because the Commission explicitly ties AI literacy measures to the organisation’s context and the users’ experience level. For high-risk AI deployers, the general literacy obligation does not replace the more specific human oversight training requirements. European Commission FAQ

A simple three-level program

A useful SME program can be built in three layers.

1) Basic level: safe everyday use

Goal: make sure everyone understands the tool’s limits.

Cover:

what the tool can and cannot do;
which data must never be entered;
when a generated answer must be checked;
how to report an error or suspicious output.

2) Operational level: workflow control

Goal: define where human review happens.

Cover:

the point at which a person must validate the result;
when to escalate to IT, HR, legal or a manager;
which use cases are allowed, limited or prohibited;
how to record incidents and corrections.

3) Role-specific level: apply the rules to real work

Goal: adapt the rules to day-to-day tasks.

Examples:

Customer service: draft replies may be AI-assisted, but urgent or contractual messages need review before sending.
Administration: AI can help reformat information, but amounts, dates and missing fields must be checked manually.
HR: no automated decisions about candidates or employees should be taken without proper human review.
IT: access, logs, versions and approved integrations need to be documented.

The Commission’s guidance supports this kind of segmentation because it asks organisations to consider knowledge, experience, education, training and context rather than applying a single generic course to everyone. European Commission FAQ

A concrete example: AI-assisted customer reply

Simulated input

“Rewrite this message in a professional, concise tone. The customer is asking for delivery by Friday, but the warehouse has not confirmed availability yet.”

Illustrative output

“Thank you for your request. We are checking warehouse availability and will update you as soon as we have confirmation on the delivery date.”

What to check before using it

The text does not promise a delivery date that has not been confirmed.
The tone matches the company’s communication style.
The operator knows the reply must be reviewed if the customer issue is urgent or contractual.
The request is logged if the company keeps a record of AI-assisted interactions.

This is a didactic example, not a test of a specific model. It shows the type of control an SME should apply before using any generated text.

A minimal internal record that is actually useful

The Commission says organisations do not need a certificate, and that an internal record can be a practical option. European Commission FAQ

A minimal record can include:

date of the session;
team or department involved;
tools covered;
rules agreed;
open questions;
follow-up actions.

Acceptance check after each session

The manager or session owner should verify that:

each participant knows where to find the rules;
escalation paths are clear;
the record has been updated;
a review date has already been scheduled.

Common mistakes to avoid

The Commission’s FAQ and the AI Act Service Desk materials point in the same direction: AI literacy should be proportionate and supportive, not turned into abstract bureaucracy. AI Act Service Desk FAQ

The most common mistakes are:

training everyone the same way, regardless of role;
using examples that have nothing to do with the tools actually in use;
keeping no internal trace of training or guidance;
confusing general AI literacy with the stricter human-oversight obligations for high-risk use cases.

A good first-week plan

For most SMEs, the first step is a 60–90 minute micro-program:

list the AI tools already in use;
define three basic data-handling rules;
assign a person responsible for doubts and escalation;
record the session;
schedule a follow-up in 30 days.

If you want examples to compare, the European Commission’s AI Office has also launched a repository of AI literacy practices, including e-learning, in-person training, bootcamps and collaborations with universities or industry. It is useful for inspiration, but the Commission warns that copying a practice does not automatically create compliance. AI literacy practices repository

When to involve IT, HR or legal

IT: if AI touches access, logs, integrations or internal systems.
HR: if the training changes people-related workflows or evaluations.
Legal or external advisors: if the use case involves sensitive data, regulated customers or high-risk systems.

The practical takeaway

For SMEs, AI literacy is not a checkbox. It is a light but structured way to make AI use clearer, safer and easier to govern. The goal is simple: people should know what the tool is for, where it is not enough, and when to ask for a human decision.

If you need to turn that into a short internal process, start from the workflow you want to improve: the tools involved, the people who use them and the points where review matters. Then build the training around those real decisions, not around generic AI theory.

If you want to shape this into a practical training path, describe the process you want to improve.