Internal AI Literacy Register for SMEs: turning the AI Act requirement into a useful process

Why an internal AI literacy register is useful for SMEs

The EU AI Act requires providers and deployers of AI systems to take measures that support the AI literacy of their staff and of people acting on their behalf, while considering their technical knowledge, experience, education and the context in which the AI system is used (AI Act, Article 4). The European Commission says this obligation has applied since 2 February 2025 and that the goal is not to certify a universal minimum level for every person, but to make sure training and support are proportionate to the real use of AI in the organisation (Commission FAQ).

For a small or medium-sized business, that means the value is not in a one-off course. The value is in a simple internal register that shows who uses AI, for what purpose, with which limits, and when that knowledge was last reviewed.

What to collect before building the register

Before opening a spreadsheet or internal page, gather four basic inputs:

Roles that actually use AI — for example customer care, marketing, administration, HR, sales, or IT.
Tools in use — for example a generative assistant, text summariser, ticket classifier, or internal automation.
Data touched by the workflow — public information, customer data, confidential documents, or personal data.
The owner of the register — a person or function responsible for updates, evidence, and review dates.

This first step keeps the register proportional. The European Commission’s repository of AI literacy practices is useful for ideas and comparison, but it is not a legal template and it does not automatically create compliance by itself (AI literacy repository).

Minimum fields the register should contain

A practical register can stay lightweight if the fields are stable:

role or role group
AI tool used
usage context
main risks and limits to know
assigned training
completion date
evidence stored
next review date
internal owner

The goal is not to build bureaucracy. It is to make the process readable later.

A simple way to classify training needs

The European framework for AI literacy groups competencies into four domains: engage with, create with, manage, and shape AI (European framework). For SMEs, that can be translated into a practical internal ladder:

Engage with AI: recognise when AI is being used and what the tool is doing.
Create with AI: write prompts, draft content, and verify results.
Manage AI: check errors, limitations, escalation paths, and human review.
Shape AI: adjust workflows, governance rules, and controls when the process changes.

You do not need every role to reach the same level. A customer support agent, for example, needs different training from the person who approves the tool or defines policy.

Example: a customer care workflow

Simulated scenario: an SME uses a generative assistant to summarise customer emails and draft replies.

Input to record

Role: customer care
Tool: generative AI assistant
Data: customer emails, attachments, ticket history
Key risks: summary errors, inappropriate tone, disclosure of sensitive data
Training: 45-minute basic module plus short verification
Review: every 6 months or after a tool change

Example output

Role	Tool	Training	Evidence	Review
Customer care	Generative AI assistant	Completed on 12/09/2026	Certificate + short test	03/2027
Marketing	Text-summarisation tool	Completed on 15/09/2026	Slides and checklist	After model change

This is an editorial model, not a legal form. It is meant to help a team start quickly with something consistent and auditable.

Step-by-step process for SMEs

1. Map the roles with the highest impact

Prioritise functions that use AI on customers, sensitive data, repetitive decisions, or operational workflows.

2. Set the minimum competence by role

Not everyone needs the same depth. People who generate content need to know how to spot mistakes and hallucinations. People who govern tools need to understand limits, incidents, and configuration choices.

3. Assign the training and keep light evidence

A short attendance note, internal certificate, brief quiz, or guided simulation is usually enough to show that training happened.

4. Update the register when something changes

New tool, new process, new provider, or internal incident: each one is a trigger for review.

5. Link the register to incidents

If an error is caused by misuse or poor instructions, the corrective lesson should be added to the register.

Acceptance checks: who checks what, and when

HR or training lead: confirms that each priority role has assigned training and stored evidence, every month.
IT or AI governance owner: checks that tools and use cases are updated after each process change, within 10 working days.
Function manager: confirms that training matches the team’s real work, at every new automation release.
Management: reviews the register at least once a year.

These checks are simple on purpose. The point is to make the process maintainable, not to create a document that nobody can update.

Limits to keep in mind

The register does not prove full compliance by itself. It does show that the company has a reasonable, documented, and proportionate process. That matters because the AI Act asks for support measures, not a one-size-fits-all certification of every employee (AI Act, Article 4).

Used well, the register becomes more than a legal artefact. It becomes a working tool for training, governance, and responsible automation. For SMEs that are introducing AI step by step, that is often the fastest way to move from informal use to controlled use.

If you want to turn your current workflow into a practical register, start from the roles, the tools, and the evidence you already have. Then define the next review date before the next change arrives.