Primer
This reading takes about three minutes. Then you take the check. Together they are a training measure, not only a test.
Article 4 of the EU AI Act applies to providers and deployers. A provider develops an AI system, or has it developed, and places it on the market under its own name. A deployer uses an AI system under its own authority, other than in a purely personal activity. A company whose staff use a chatbot or a copilot at work is usually a deployer.
The duty has applied since 2 February 2025. Since 27 July 2026, Regulation (EU) 2026/1744 words it as a duty to take measures that support AI literacy. Those measures take account of the person's knowledge, experience, and education, the tool, and the people the output can affect. The law does not set one score for every person. Your employer's own rules still apply. This primer is general. It is not legal advice.
What AI and generative AI are
An AI system, in the Act, is a machine-based system that works with some autonomy and infers, from the input it receives, how to produce predictions, content, recommendations, or decisions. Generative AI is the kind that writes or draws new content: text, images, audio, or code. It does that by continuing patterns from its training data. It does not look answers up in a store of checked facts. A fluent paragraph can still be wrong.
Hallucinations and verification
A hallucination here means a confident false statement: a made-up fact, a citation that does not exist, or a number that was never measured. The tool has no duty to stop when it is unsure. Before you send a factual claim to a customer, put it in a file, or rely on it for a decision, check it against a source you trust, or ask the person who owns the topic. If you cannot find a cited case, article, or link, do not use it.
Confidential and personal data in prompts
A prompt is data you hand to someone else's system. A customer's name, a staff review, a contract clause, a password, or health information can be personal data, or a confidence you owe your employer. Do not paste it into a tool your employer has not approved for that kind of data. Share the smallest slice that still lets you do the task. Deleting the chat on your screen does not by itself undo a copy held elsewhere. The GDPR still applies to personal data, including the duties to minimise it and to keep it confidential.
Bias
Models pick up patterns from past data, including unfair ones. They can favour or sideline people because of gender, age, language, disability, or postcode even when you never named those traits. Treat a ranking of people, a shortlist, or a risk score as a draft that a person reviews. Do not let it be the only reason someone is hired, denied, or flagged. If similar people are treated differently and you cannot explain why, stop and ask.
Human oversight
Human oversight means a person can understand the output, can decide not to use it, and is actually in a position to do that. Clicking OK without reading is not oversight. For a high-risk system the Act sets specific oversight rules in Article 14. For an everyday tool the same habit matters whenever the output can affect a person, money, or a published statement: read it, check it, and own the decision.
Prohibited practices in outline
The Act bans some uses outright. In outline, these include manipulating people so that they are harmed, exploiting vulnerabilities linked to age, disability, or social or economic situation, social scoring that leads to unrelated or disproportionate harm, predicting crime from profiling alone, building face-image databases by untargeted scraping, inferring emotions at work or in education except for medical or safety reasons, and some biometric categorisation. Two further bans, on non-consensual intimate imagery and on child sexual abuse material, apply from 2 December 2026. If a use sounds like one of these, do not try it out. Escalate.
Transparency and disclosure
If people might think a chatbot is a human, tell them they are dealing with an AI system, unless that is obvious. If you publish a deepfake, or another AI-generated image, audio, or video of a real person or of an event that did not happen, disclose that it was generated or manipulated. Article 50 has applied since 2 August 2026. A hidden mark you never mention is not a disclosure to the reader.
When to escalate
Stop and ask a person when the output would affect someone's rights, pay, access to a service, health, or safety; when you are about to paste confidential or personal data into a tool that is not approved for it; when you suspect a banned use; when a citation does not check out; or when you do not know your employer's rule. Follow your employer's own AI policy. A general product cannot supply that policy. The person who owns the decision should be the one to make it.