Most of the discussion about the European AI Act concerns high-risk systems, conformity assessments and the obligations of the companies building models. That is the loud part, and for the overwhelming majority of procurement departments it is not the relevant part.
The relevant part is Article 4, it is two sentences long, and it has been in force since 2 February 2025. It requires providers and deployers of AI systems to take measures to ensure a sufficient level of AI literacy among their staff and among others operating such systems on their behalf, taking into account their technical knowledge, experience and training, and the context in which the systems are used.
Why this reaches you
The word doing the work is deployer. You do not have to build anything. If your organisation uses an AI system in the course of its professional activity, you are a deployer. A procurement team using Microsoft Copilot to draft supplier correspondence is deploying an AI system. So is one using ChatGPT to summarise tender documents, whether or not anybody authorised it.
There is no threshold for company size. There is no exemption for using somebody else's tool rather than your own. And the obligation attaches to the organisation, not to the individual who opened the browser tab.
What the obligation is, and is not
- Not a certificate. The Act does not name a qualification, and no authority issues one for this.
- Not a one-off. Literacy is judged against the systems actually in use, which change.
- Is proportionate. A team using a chat assistant needs less than one deploying automated supplier scoring.
- Is something you should be able to evidence: who was trained, when, on what, to what end.
What sufficient actually means
The Act does not define a syllabus, which has produced a certain amount of anxious guessing. The recitals are more helpful than the article: the point is that the people using these systems should understand what they are doing, be aware of the opportunities and risks, and be able to interpret the output and recognise possible harm.
Translated into a procurement context, that means the people in your team should be able to answer questions of this kind without hesitating.
- What does this tool do with the text I put into it, and where does that text go?
- Which supplier information am I allowed to paste in, and which am I not?
- How would I notice if the summary it produced left out a material clause?
- When is the output good enough to send, and when does it need a second pair of eyes?
- Who do I tell if it produces something obviously wrong?
A team that can answer those is compliant in substance. A team that has a certificate but cannot is not, whatever the folder says.
The obligation is unusually well aligned with self-interest. The training that satisfies Article 4 is roughly the training that stops people making expensive mistakes.
The awkward part: shadow usage
In practice the first finding of any honest assessment is that AI tools are already in use and nobody knows the extent. Personal accounts, free tiers, browser extensions, a plug-in somebody installed to summarise PDFs. This matters for procurement more than for most functions, because the material being pasted in — draft tenders, price comparisons, contract clauses — is exactly the material a competitor would most like to have.
Prohibiting it outright is the reflex, and it does not work; usage simply becomes less visible. The arrangement that does work is a sanctioned tool that is at least as convenient as the unsanctioned one, plus a written and genuinely short set of rules about what may go into it, plus the training that makes the reasoning behind those rules obvious.
A reasonable order of work
Establish what is actually in use, without threatening anybody. Decide which tools are sanctioned and under what contractual terms. Write the ground rules down — one page is enough and better than ten. Train the people, using their own work as the material. Keep a record of who attended, what was covered and when. Revisit it when the tool landscape shifts, which it will.
This is a plain-language summary written by a process consultant, not legal advice. Where the answer matters commercially, have your counsel look at your specific deployment.