AI governance sounds like a committee, a framework and a budget. In a company of two hundred people it is four things, and they fit on one page: a list of the AI tools actually in use, the written rules for using them, one named person who decides when the rules do not cover a case, and a dated record of what you did about AI literacy. Most companies we talk to have none of the four, and the ones that have a policy usually have only that one.
Article 4 of the AI Act asks providers and deployers to take measures that support the development of AI literacy among the people who operate AI systems for them. The Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) rewrote it and added that the obligation does not require you to guarantee any particular level for any individual. Read that carefully and it changes what is worth building: there is no exam to pass and no certificate to collect, so what you can actually show is the record. Dated measures, mapped to roles and to the systems those roles deal with, with a line on why the content fitted that group. The duty itself has applied since 2 February 2025.
Writing the rules is the easy half. The half that fails is the case nobody wrote a rule for, which arrives within a month: a client asks whether their data went through a model, somebody wants to connect an assistant to the shared drive, a team has found a tool that is better than the approved one. If no name is attached to that decision it gets made anyway, quietly, by whoever is in a hurry. One owner, a stated escalation path, and the standing permission to say not yet is worth more than ten pages of principles.
Both are voluntary frameworks, and your buyers are the reason they come up: enterprise procurement questionnaires increasingly ask suppliers what their AI governance looks like, long before any regulator does. Neither framework is a thing you buy; both ask you to produce artefacts, and two of them are the tool inventory and the training record on this page, which means the work overlaps even if you never pursue a certificate. Be clear about what we are, though: we design training. We are not an auditor, not a certification body and not a law firm, and nothing we hand over certifies anything. What we leave you is written material and a record you can show to whoever asks.
First, the inventory lists what the IT team bought rather than what people use, so the tool causing the actual exposure is absent from the document meant to cover it. Second, the rules exist and nobody has read them: a policy in a drive folder is a governance artefact and a behavioural no-op, which is why the written rules and the training are two steps of one approach here rather than two products. Third, it is done once. Governance that was accurate in the spring describes a stack that has changed by the autumn, and an out-of-date register is harder to defend than an honest gap, because it shows you stopped looking.
Diagnostic, acceptable use policy, interactive tracks by function, adoption follow-up. The four steps work together, and the free 30-minute call scopes all of them.
See the four stepsAI governance, for a company that has no AI team
No. The policy is one of the four pieces, the one that tells an employee what they may do. Governance is the set: what is in use, what the rules are, who decides the uncovered case, and what you can show about the measures you took. A company with a policy and nothing else has written the rules and kept no evidence that anybody was ever brought up to speed on them.
Below a few hundred people, usually not, and setting one up is a common way to spend six months without changing what anybody does on a Tuesday. One named owner with the authority to decide, a short rule set, and a date in the calendar to review both is the version that survives. A committee becomes worth its meetings when several functions deploy AI systems into decisions about people or money, and that is a different conversation.
A table, usually on one or two pages. Per group of people: which tools that group uses, what they were taught and when, how long it took, why that content suited their level and their context of use, and who to ask about it. Ours comes out of the tracks themselves, because the platform already records who completed what and when. If you build it by hand instead, build that table.
Yes, if your teams use AI systems for their work, which is the ordinary case. Article 4 covers deployers as well as providers, and a deployer is anyone using an AI system under its own authority in a professional capacity, with no exemption based on company size. The obligation follows the use, not the headcount and not whether you build models yourself.
We go through how your teams use AI today, what is missing to frame it, and what the first quarter would look like. You leave with enough to decide, whether you work with us or not.