A free kit for deciding what your team may put into an AI tool, and for showing that you actually trained them on it. Seven parts: templates, a worked example, a training outline, a records workbook and one small script.
Useful if you work in an EU organisation, people there already use AI tools, and nobody has written down what may go where. Especially if training and the paperwork around it landed on your desk.
Not for you if you use AI on your own with no colleagues, or if your organisation runs high risk AI under Annex III. That needs far more than this.
ZIP, about 25 KB. Markdown, one spreadsheet, one Python file. Nothing to install.
Context: Article 4 of the EU AI Act has required this since 02.02.2025, and national authorities took up supervision this month. The kit explains what that does and does not mean.
The one decision everything hangs on: Which material may travel on which lane. About an hour, done once, with whoever actually owns the risk.
The same decision, on one page people will actually read. Written to sit next to the laptop, not in a policy folder (which is where the other one still is).
The article quoted in full, what is genuinely required, and the three things people are wrongly told is mandatory. Plus a training shape that fits the proportionality clause.
A script that answers "may this go there" before anything is sent. No dependencies, exit codes you can wire into a real call, and a self test that breaks its own config on purpose.
Every template above, filled in for one fictional 140 person company: Including the argument that took them longest, and the step they got wrong.
The case every policy skips. What to do in the first 30 minutes, what never to do, and the paragraph to put in your policy today.
The one that decides whether the rest matters. Five places the class question can actually sit, cheapest first, plus the test that tells you honestly whether you are done. Includes the correction almost nobody makes: the script is a checker, not a gateway, and nothing you download can enforce a policy.
Per person records with refresh dates that compute themselves, amber 60 days out, red when overdue. Plus the tier reasoning sheet almost nobody writes.
$ python3 gate.py --data-class CONFIDENTIAL --lane public_ai DENY Damage on leak outweighs convenience. Keep it on your own machine. $ python3 gate.py --selftest 12 / 12 green
It deliberately does not classify for you. Classification is a human judgement, and a script that guesses it gives you false confidence, which is worse than no gate.
No black box, that would be a strange thing to ask of a file you install. This is every step it runs, what it stores, where that lives, and the things it deliberately refuses to do. If you are going to trust a rule, you should be able to read it end to end first.
Swipe the map sideways.
Testing is not required, though. There is no obligation to measure your staff's knowledge level. It may well be useful. It is just not a duty.
Certificates are not required. No named qualification demonstrates compliance.
Article 4 contains no record keeping duty. It says take measures. Records are how you show you did, which is why the kit has a workbook. Do not let anyone sell you documentation as a legal requirement in itself.
The first version of this kit actually got the first one wrong. It is corrected, and every claim now cites the regulation text or Commission material.
Researched 02.08.2026 against the regulation text and Commission material. Verify anything before you rely on it.
| Date | What applies |
|---|---|
| 02.02.2025 | EU AI Act Article 4. Ensure a sufficient level of AI literacy for people operating AI systems on your behalf. |
| 02.08.2026 | Article 99 paragraph 3: 35 million EUR or 7 percent applies only to Article 5, prohibited practices. |
| 02.08.2026 | Article 99 paragraph 4: 15 million EUR or 3 percent applies to Articles 16, 22, 23, 24, 26, 31, 33(1)(3)(4), 34 and Article 50 under letter g. |
| 02.08.2026 | Article 99 paragraph 5: 7.5 million EUR or 1 percent applies to false or misleading information given to authorities. |
| 02.08.2026 | Article 50 transparency applies. Article 4 does not appear in Article 99 and carries no penalty figure here. |
| 02.12.2026 | Transition deadline only for providers of generative systems already on the market before 02.08.2026: marking obligation under Article 50 paragraph 2. |
| 02.12.2027 | High risk systems, Annex III. |
| 02.08.2028 | High risk systems embedded in regulated products, Annex I. |
The Digital Omnibus has been in force since 27.07.2026 and did not change Article 50.
Not legal advice, and not advice on your case. Everything here is written for typical situations, the way a form book is. It does not look at your circumstances, it cannot, and it is not meant to. If you need someone to look at your actual situation, that is a lawyer's job and this is not a substitute for one.
I am not a lawyer. I am a training manager who built the technical half himself. Where this kit quotes the regulation, it quotes. Where it interprets, it says so. Check both before you rely on either.
It does not make you compliant. Nothing you download can. It gives you a decision structure and a paper shape, and both still need review by someone qualified in your jurisdiction.
It does not cover high risk use under Annex III, and it does not cover data protection. If personal data left your organisation, that runs on its own clock and on rules this kit does not touch.
Not my employer speaking. This is a private project about my own machine, written in my own time. No employer of mine has reviewed, approved or endorsed any of it.
This kit is provided free of charge. For gratuitous provision, German law limits my liability to intent and gross negligence (the standard in § 521 BGB). Within that limit I accept no liability for the accuracy, completeness or timeliness of the material, or for any decision taken on the basis of it.
Liability for injury to life, body or health, and liability for intent or gross negligence, remains unaffected and is not excluded. Statutory liability that cannot be limited by agreement stays in place.
The legal position described here reflects sources researched on 02.08.2026 and can change. Nothing here is kept up to date, and there is no obligation on me to update it.
Governed by German law. Place of jurisdiction, where legally permissible, is my registered seat as stated in the Impressum.
Regulation (EU) 2024/1689, Article 4 and Article 113 · European Commission, AI Literacy Questions and Answers · AI Act Service Desk · PagerDuty Shadow AI survey, June 2026
Do pretty much what you want with it. Adapt it, rename it, put your own logo on it, hand it to your team. No attribution required, no permission needed. If it saves you a day, that was the point.