September 1, 2026
The rapid spread of Generative AI (GenAI) tools in business has created a double challenge for SMEs: fast operational optimization and regulatory risk management.
Small and medium businesses often practice flat-rate training — sending the entire team to a generic prompting course — ignoring the principle of proportionality, which can eventually create compliance problems. AI literacy is not a static skill; it's a function directly dependent on the level of decision-making and the risk tied to each role.
1. The three-level AI literacy matrix
To avoid both operational risk (technical errors) and legal risk (regulatory penalties), an SME needs to stratify training across three tiers of responsibility:
- Level 1: Operational → Quality control (epistemic vigilance)
- Level 2: Tactical → Data governance (preventing Shadow AI)
- Level 3: Strategic → Compliance & minimum auditable documentation
Level 1: Operational (staff and users who use AI daily)
- Goal: Exercising epistemic vigilance — the systematic ability to spot plausible but incorrect information (AI hallucinations) before it produces operational effects.
- Risk focus: Preventing degraded output quality and decisions based on blind trust in the model (automation bias).
- Scenario: A sales rep uses an AI assistant to draft a complex commercial proposal. Level 1 training doesn't teach them how neural networks work — it requires them to apply a verification protocol to critical figures, contract clauses, and proposed discounts before sending the document.
Level 2: Tactical (middle management and department decision-makers who decide which tools get used in the organization)
- Goal: Implementing governance at a small scale — assessing data flows, managing technology vendors, and controlling access.
- Risk focus: Preventing leaks of confidential data, trade secrets, or personal data (PII) through unapproved tools (Shadow AI).
- Scenario: A marketing manager wants to automate customer behavior analysis using an external SaaS tool. Level 2 training gives them the skill to evaluate the platform's terms of use — making sure customer data isn't used by the vendor to retrain public models — and to set anonymization protocols before processing.
Level 3: Strategic and legal (administrators, C-level, legal/DPO staff — those who carry liability)
- Goal: Securing legal accountability and building a defensible compliance architecture.
- Risk focus: Misclassifying use cases and exposure to legal penalties arising from unassessed use of high-risk systems.
- Scenario: An SME adopts an AI solution for CV pre-screening in recruitment. Level 3 management needs to know that automated processing in HR is classified as High-Risk, which triggers assessment, documentation, and human oversight obligations. The compliance deadline for this category has been pushed to December 2, 2027 — but once the system is deployed, it will still need to meet the requirements from that date.
2. The regulatory implication: Article 4 of the AI Act
This tiered approach is a management-efficiency recommendation, and it directly reflects legal obligations introduced by the European regulatory framework.
Article 4 of Regulation (EU) 2024/1689 (the AI Act) requires providers and deployers of AI systems to take measures for the AI literacy of staff and other persons operating or using these systems on their behalf — a level calibrated explicitly against three variables:
- The technical knowledge, experience, education, and training of the people involved;
- The specific context in which the AI system will be used;
- The persons or groups of persons on whom the AI system will be used.
Worth noting: the EU's "Digital Omnibus on AI" (in force since July 2026) softened this obligation's wording — from requiring providers to "ensure" an adequate level of AI literacy, to merely "support the development of" it.
3. Implementation guide: minimum defensible documentation architecture
For an SME in Romania or the CEE region to demonstrate compliance in an audit or a security incident, AI governance needs to produce three fundamental elements:
- Internal AI register (AI inventory)
- Differentiated training matrix
- Human verification protocol
Outlook
A sustainable AI adoption strategy for an SME means moving from perceiving the technology as a simple tool to integrating it into a modular governance framework. The shift toward more complex architectures — such as autonomous agents (Agentic AI) — will make it even more essential for every level in the organization to understand exactly where the system's responsibilities end and human accountability begins, or how to work alongside AI.