Most Common AI Literacy Mistakes in Companies

The most common AI literacy mistakes in companies are as follows: employees use AI tools without any rules, blindly trust generated results, input personal or confidential data into them, confuse literacy with a one-off seminar, and believe that the EU AI Act does not apply to micro-enterprises. All these mistakes stem not from malice, but from a lack of understanding - and it is precisely this gap in understanding that AI literacy must fill.

The EU AI Act (Regulation (EU) 2024/1689) - Article 4 establishes that providers and deployers must take measures to support the development of AI literacy among staff and relevant persons, considering their knowledge, experience, training, context, and the people affected. This obligation has applied since 2 February 2025, with supervision and enforcement mechanisms entering into force on 2 August 2026. It applies in practice to almost all companies using AI at work - even those with only one or a few employees. These mistakes are a direct signal that the level of literacy in the company is insufficient.

What are the most common AI literacy mistakes in companies?

The summary table below will help you quickly assess whether any of these mistakes have already taken root in your company:

Each mistake has a clear practical solution.

Why is using AI without any rules the first mistake?

The most common and dangerous mistake is allowing employees to use AI tools without any company policy. When there are no written rules, each employee decides for themselves what they can do with ChatGPT, "Copilot", or an image generator. One may input client contracts, another may let AI draft a response to an inspection, and a third may generate code without any review.

The solution is simple: the company needs a clear, concise AI usage policy that specifies which tools are allowed, what data can and cannot be entered, who verifies the results, and who is responsible for errors. This does not need to be a lengthy document - a few pages are enough for a micro-enterprise. To understand how to properly document the tools and rules used in the company, it is worth reviewing the full list of AI literacy topics, where these issues are explained in more detail.

Can you blindly trust an AI-generated result?

No. The second widely spread mistake is employees considering an AI response "correct" because it sounds convincing and professional. Language models generate probable text, not verified truth. They "hallucinate" - confidently presenting non-existent facts, legal articles, quotes, or numbers.

A real example: an accountant asks AI to explain tax application and receives a smooth answer with a specific legal clause - which does not actually exist. If the answer is passed on to a client or inspection without verification, the company assumes full responsibility.

A fundamental principle of AI literacy: AI is a draft preparer, not the final decision-maker. Every important result - legal, financial, or client-facing - must be verified by a human. What AI literacy involves and how to support its development is explained in more detail in the article what is AI literacy.

How to avoid personal data leakage through AI tools?

The third serious mistake is entering personal or confidential data into public AI tools: client names, personal codes, contract terms, health information, or employee salaries. Many free tools may use such data for model training, which means the information leaves your control.

This is both an AI literacy and a GDPR compliance issue. Practical steps for micro-enterprises:

1. Set boundaries - clearly define in the policy which data is prohibited from being entered.
2. Anonymise - replace real names and codes with examples before using AI.
3. Choose business plans - paid plans often have settings that prevent data from being used for training.
4. Train employees to recognise - many people do not even realise that pasting text into a chatbot is transferring data to a third party.

A violation here means not only a risk under the AI Act but also under GDPR, and the latter’s fines can be significant even for small companies. Note that GDPR does not impose a blanket ban on AI tools; rather, it requires assessing lawful basis, data minimisation, the use of approved tools, and safeguards.

What is shadow AI and why is it a threat?

The fourth mistake is tolerating or ignoring shadow AI in the company: a situation where employees use AI tools independently, without management’s knowledge or inclusion in any registry. Research shows that employees actively use AI for work much more often than their managers realise.

Shadow AI is particularly dangerous because you cannot manage risks you do not even see. If you do not know that a sales manager is using AI for client emails, you cannot ensure data protection, result quality, or compliance. Additionally, to demonstrate compliance under Article 4, you need to know which tools are actually being used - which is impossible if half of them are hidden.

The solution is to create a culture of openness and an AI tool registry where employees can freely add the tools they use. Fear of punishment only pushes people to hide their usage further.

Is AI literacy just a one-off seminar?

No - and believing that "we held one training session, so we’ve met the requirement" is the fifth common mistake. AI literacy measures under Article 4 should reflect the changing use of AI; a one-off event may not address later changes. Tools change every few months, new features and new risks emerge, and new employees join the company who did not participate in previous training.

In practice, this means you need:

• introductory training for new employees;
• periodic knowledge updates when tools or rules change;
• knowledge checks to prove that the information has truly been absorbed, not just "attended" in a seminar.

Practical ways to assess employees’ learning needs are explained in the article on how to measure AI literacy. Knowledge checks can inform further training, but Article 4 does not require a particular measurement method or guarantee of an individual literacy level. Article 4 of the EU AI Act does not mandate specific certificates, a fixed number of training hours, external trainers, audits, or a dedicated AI officer - these are practical recommendations, not legal obligations. Our documents and quizzes are recommended tools but do not guarantee compliance.

Is it true that the EU AI Act does not apply to micro-enterprises?

No, this is a dangerous myth and the sixth mistake. Article 4 of the EU AI Act on AI literacy has no exemption based on company size. It applies to all "deployers" - that is, everyone who uses AI systems in their operations, regardless of whether it is a one-person company or a team of ten employees. If your accountant uses AI, your marketing specialist generates texts, or your programmer works with code tools - the obligation applies to you.

It is worth noting the key dates:

• 2 February 2025 - the obligation under Article 4 for AI literacy and prohibited AI practices came into force.
• 2 August 2026 - general application, transparency and enforcement provisions became applicable. General-purpose AI model rules had begun applying on 2 August 2025, subject to transitional provisions; Article 4 had applied since 02-02-2025.
• 2 December 2027 - requirements for high-risk AI systems listed in Annex III begin to apply.
• 2 August 2028 - requirements for high-risk AI systems embedded in regulated Annex I products begin to apply.

The official text of the regulation can be found in the EUR-Lex system (eur-lex.europa.eu), and explanations from the European Commission are available on the digital strategy page (digital-strategy.ec.europa.eu).

How to fix these mistakes without overburdening a small company?

All six mistakes share a common root: a lack of structured approach. A small company does not need a large compliance department. It needs a few simple elements that together form the foundation of AI literacy and compliance:

• AI usage policy - clear, concise rules.
• AI tool registry - a list of what and how is being used, eliminating shadow AI.
• Compliance record - a practical record of the measures taken and available supporting evidence.
• Employee AI guide - practical guidelines for daily work.
• AI literacy training with knowledge checks and certificates - periodically updated and measured.

nebedirbam.lt automatically prepares such a set of documents for a fixed price of €149 + VAT (€299) without any human intervention - it prepares the policy, registry, compliance record, employee guide, and provides AI literacy training with checks and certificates. These documents are practical aids but do not guarantee legal compliance. If you first want to assess your own knowledge, you can start with free AI literacy training and knowledge checks - this helps immediately see which of the above mistakes are still relevant to your team. The free path is for one signed-in participant; team training is included in the paid documentation package.

Brief Summary

The most common AI literacy mistakes in companies are using tools without rules, blindly trusting results, entering personal data into public tools, shadow AI, confusing literacy with a one-off seminar, and the false belief that the Act does not apply to micro-enterprises. All of these can be eliminated in the same way - with clear rules, a tool registry, periodic training with checks, and documents proving compliance. Start with a realistic assessment of the situation: which of the six mistakes are already present in your company?

---

The legal information in this article is based on the official provisions of Article 4 of the EU AI Act (Regulation (EU) 2024/1689), as explained on AI Act Service Desk and the European Commission’s Digital Strategy page.