What rules apply when my business uses AI, and do I need certified training?
Lesson 2 of a free course: what AI Act Article 4 asks after the Digital Omnibus, why no certificate is needed, GDPR, professional secrecy and a training log.
AI-generated image: Internet of Things News / Google Gemini
After reading this article you will be able to:
- Explain what Article 4 of the AI Act asks of a business that uses chatbots, and why no certificate is required
- Decide which customer data can go into a chatbot, and what to check about the plan and its contract
- Keep a simple training log that shows who learned what about the AI tools your business uses
On this page
- What does the AI Act ask of a business that uses ChatGPT?
- What did the Digital Omnibus change?
- Do you need a certified course?
- What does privacy law mean for customer data in a chatbot?
- What about professional secrecy?
- How do you keep a training log?
- Where does this answer stop?
- Where to go next
- Common questions
Three sets of rules matter most for a small business in the EU that uses AI tools such as ChatGPT or Copilot at work. The AI Act asks you to help the people who use AI for your business understand it, for example by telling them that chatbots can make things up. No certified course is required: the European Commission says that “There is no need for a certificate” and that a business can keep an internal record of the training instead. The GDPR, the EU privacy law, applies as soon as customers’ or staff’s personal data go into a chatbot. And professionals such as lawyers, accountants and doctors keep their duty of secrecy; in Italy, Law 132 of 2025 adds rules of its own.
This is lesson 2 of “AI for small business: a free course”. It explains the rules in plain words, with a training log to copy. It is not legal advice, and following this course does not by itself make your business compliant with the AI Act or the GDPR. For your own case, ask a lawyer, your trade association or your professional body.
This site is written with AI tools, including Claude by Anthropic. This page uses only what makers, public authorities and published studies say, with links.
What does the AI Act ask of a business that uses ChatGPT?
The AI Act is the EU law on artificial intelligence. When your business uses an AI tool for work, the law calls it a “deployer”: a person or organization “using an AI system under its authority”, except for personal, non-professional use (Article 3). A shop that drafts its emails with a chatbot is a deployer.
Article 4, on “AI literacy”, says that providers and deployers “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”. The article makes no exception for small businesses; instead it asks the Commission and the EU countries to support them.
The European Commission’s questions and answers on AI literacy, last updated on 20 October 2026, answers the case of a company whose employees use ChatGPT to write advertising text or translate: “Yes, they should be informed about the specific risks, for example hallucination”, meaning answers the AI invents. “Other persons” can include a contractor, a service provider or a client working with AI on your behalf.
From the same page:
- Article 4 has applied since 2 February 2025.
- National market surveillance authorities supervise and enforce it from 2 August 2026, with penalties set by each country’s law.
- “Any sanction must be proportionate”, and a sanction is more likely when an incident shows that staff lacked training or guidance.
What did the Digital Omnibus change?
The Commission proposed simpler AI rules, called the Digital Omnibus on AI, on 19 November 2025. For Article 4, the proposal moved the duty to promote AI literacy onto the Commission and the EU countries. The text that was adopted, Regulation (EU) 2026/1744 of 8 July 2026, kept it as a duty for businesses. It was published in the Official Journal of the EU on 24 July 2026 and entered into force on 27 July 2026. According to the Commission, the amendments:
- keep AI literacy as an obligation for providers and deployers, but with no specific or “sufficient” level that has to be reached;
- ask the Commission to publish practical examples of how to comply;
- ask the European AI Board to adopt recommendations.
The amended Article 4 adds that the obligation “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”. So the duty was not dropped, as the 2025 proposal had planned.
Do you need a certified course?
No. The Commission’s answer is short: “There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives.” It adds that “no strict requirements or mandatory trainings are imposed”, that there is no obligation to measure what employees know, and that “no specific governance structure is mandated”, so you do not need an AI officer.
There is a catch: the Commission also says that only asking staff to read the instructions “might be ineffective”. As a minimum, it suggests covering four points:
- What AI is and which AI tools your business uses, with their opportunities and dangers.
- Your role: you are using tools made by others, not building them.
- The risks of those tools and what staff need to know about them; for a chatbot, for example, invented answers, personal data and confidential documents.
- Who needs to know what, depending on their job, what they already know and where the AI is used.
For free help, the Commission points small businesses to the European Digital Innovation Hubs, which “can assist as first help desk on the AI Act”, and to the AI Skills Academy, operating since 1 May 2026.
What does privacy law mean for customer data in a chatbot?
Personal data is “any information relating to an identified or identifiable individual”, in the words of the EU data protection authorities’ guide for small business. A customer’s name, email, order history or health details are personal data, and health data belong to the special categories that “deserve more protection”.
When you paste customer data into an AI service, your business decides why the data are used, so it is the controller. A company that handles personal data only on your instructions is a processor, and the same guide says this relationship “must be governed by a contract”, often called a data processing agreement (DPA). On most personal plans, the maker can also use your chats to improve its AI under its own privacy policy. Business plans come under separate terms, usually with a data processing agreement; lesson 3 compares them and their costs.
In practice:
- Leave out what you do not need. Replace names, addresses and numbers with made-up ones before pasting.
- Keep health data, ID documents and staff records out of personal accounts.
- Check the settings. What happens to what you type shows, for each assistant, whether chats are used for training and how to switch it off.
- In Italy, the Garante, the data protection authority, publishes its decisions and guidance on AI on its artificial intelligence page.
What about professional secrecy?
Using a chatbot does not change the duty of secrecy that lawyers, accountants, doctors and other professionals already have. The Council of Bars and Law Societies of Europe, in its guide on generative AI of 2 October 2025, warns that lawyers “may be in breach of their professional obligations and/or relevant data protection laws already at the point of inputting the data into a system”.
In Italy, Law 132 of 23 September 2025, in force since 10 October 2025, adds two rules:
- Professionals (Article 13). In the “intellectual professions” (the law does not list them; lawyers and accountants are examples), AI may be used only for activities that support the professional’s work, and the professional’s own intellectual work must prevail. The professional must tell the client about the AI systems used “con linguaggio chiaro, semplice ed esaustivo” (“in clear, simple and complete language”).
- Health care (Article 7). AI systems support prevention, diagnosis, treatment and the choice of therapy, but the decision “è sempre rimessa agli esercenti la professione medica” (“is always left to the medical profession”), and patients have the right to be informed when AI technologies are used.
The same law (Article 11) says employers must inform workers about the use of AI in the cases set by Article 1-bis of Legislative Decree 152 of 1997, which covers automated systems that help decide on hiring, tasks, evaluation or dismissal, or that monitor workers. Your professional body may have rules of its own: before putting client or patient information into an AI tool, ask it.
How do you keep a training log?
The Commission does not prescribe a format. A simple table, kept with your other staff records, shows who learned what and when. Copy it into a document or spreadsheet, one row per person and session. The two filled rows are made-up examples, not real people:
| Name | Role | AI tool used | What they learned | Lesson or material | Date | Signature |
|---|---|---|---|---|---|---|
| A. Bianchi | Front desk | Gemini (business account) | Chatbots can invent facts; check prices and dates; no customer names in chats | “AI for small business” course, lessons 1 and 2 | 2026-11-10 | |
| L. Verdi (external bookkeeper) | Accounts | Copilot in Excel | Recalculate figures by hand; no tax decisions from AI | Copilot in Excel FAQ, internal rules sheet | 2026-11-12 | |
Next to the log, keep a list of the AI tools your business uses and a one-page sheet of internal rules (what may go into a chatbot, who checks the drafts). Add a row when someone joins or you adopt a new tool.
This log is a model, not legal advice. Filling it in and taking this course do not by themselves make your business compliant.
Where does this answer stop?
- Higher-risk uses. The AI Act lists AI used to filter job applications, evaluate candidates or monitor staff performance among high-risk uses, with extra duties. Ask an adviser before using AI for decisions about people.
- Outside the EU the rules are different.
- Rules move. This page is checked every month against the sources above.
Where to go next
- Lesson 1: What can AI actually do for a small business? gives five jobs with requests to copy.
- What happens to what you type gives the data settings for each assistant.
- AI for everyone is the complete guide to today’s AI.
- Lesson 3: Which AI plan does a small business need? compares business plans, prices and data terms.
Quiz: check what you learned
Pick one answer for each question: you see at once whether it is right, and why. Your answers are not sent anywhere.
Common questions
Is AI training mandatory for employees under the AI Act?
A business that uses AI systems at work must take measures to support the AI literacy of the people who use them for it, under Article 4 of the AI Act. The European Commission says no specific training format is imposed: the measures depend on the tools you use, the risks and what your staff already know. For staff who use ChatGPT to write or translate texts, the Commission says they should be informed about the specific risks, for example invented answers.
Do I need an AI Act certificate for my staff?
No. The European Commission's questions and answers on AI literacy say: "There is no need for a certificate." Organizations can keep an internal record of the training and other guidance they give. A paid course can still be useful, but the law does not require one.
When are AI Act fines for missing AI training applied?
Article 4 has applied since 2 February 2025, and national market surveillance authorities supervise and enforce it from 2 August 2026, under each country's own law. The Commission says any sanction must be proportionate to the case, and that a sanction is more likely when an incident shows that staff lacked training or guidance.
Can a lawyer or an accountant use ChatGPT with client data?
Their duty of professional secrecy still applies. The Council of Bars and Law Societies of Europe warns that lawyers may breach their obligations as soon as they type client data into an AI tool. In Italy, Law 132 of 2025 says professionals may use AI only to support their work and must tell clients about the AI systems they use. Ask your professional body for its guidance.
Do I need an AI officer in my company?
Not for Article 4. The European Commission says that no specific governance structure is required to comply with it. What matters is that the people who use AI for your business know how it works, what it can get wrong and what they must not put into it.
Topics: AI for small business, AI course, AI Act, AI literacy, GDPR, professional secrecy, Italy, work