Sector
AI literacy training for healthcare and pharma.
Clinical documentation, summarisation, literature search and quality tools are already in daily use. Article 4 calls for proportionate measures so the people using them know what the tools do and where they fail, and here a confidentiality or accuracy failure can reach a patient.
Where AI is already in the work
- Ambient note-taking and clinical documentation assistants
- Summarisation of patient records, referrals and discharge letters
- Literature search and regulatory drafting in pharma and medtech
- AI features inside laboratory, imaging and quality management software
- General-purpose chatbots used for correspondence and translation
What the AI Act asks of you
Article 4 applies to every organisation whose staff use an AI system at work, and it has applied since 2 February 2025. Supervision and enforcement by national authorities started on 2 August 2026. The duty is to take measures that support the development of AI literacy among your staff and the people using AI on your behalf, calibrated to the tools in use, the people using them and the context. The Commission's Q&A is explicit that no certificate is required and that organisations can keep an internal record of training and guidance.
AI that is a medical device, or a safety component of one, and requires third-party conformity assessment under the EU medical device rules is high-risk under Annex I of the AI Act. The Digital Omnibus moved the application date for that category to 2 August 2028. Most of the tools your staff use every day are not in that category, and Article 4 covers them regardless.
The specific risks the Commission's Q&A asks you to inform staff about, hallucination being its example, matter most where a fabricated detail lands in a patient record or a regulatory submission. Add the GDPR rules on special category data, and the question of what may go into a tool at all becomes the core of the session.
Which workshop fits
Clinical and quality teams typically take the full day so the people who configure or sign off on AI-assisted documentation get training matched to their role and a policy on what may go into a tool. Pharma and medtech firms with oversight leads tend to take the two day.
This is general information about the EU AI Act, not legal advice. Enforcement is proportionate and case by case, and your sectoral regulator may issue guidance that applies to you.
Questions from this sector.
Is an AI note-taking or summarisation tool a high-risk AI system?
Usually not. High-risk status under Annex I attaches to AI that is a medical device, or a safety component of one, requiring third-party conformity assessment. A documentation assistant typically is not. Article 4 still applies to the people who use it, and a fabricated detail can still end up in a patient record.
Can staff put patient information into ChatGPT?
That is a decision for your organisation under the GDPR, not something the AI Act settles. What Article 4 asks for is proportionate measures that help the people using a tool understand its specific risks, including confidentiality and what may and may not go into it. An acceptable-use policy, which the full day drafts with you, sets that answer down, and your training record shows the measure you took.
We are a pharma company. Does the AI Act treat us differently?
Not for Article 4, which applies to every provider and deployer. Product obligations depend on what the AI does: an AI system that is part of a regulated medical device falls under Annex I, while general-purpose tools used for drafting and research do not. The tool inventory sorts one from the other.
Related insights.
Scope
Does the EU AI Act apply to us if staff only use ChatGPT?
Yes. The European Commission's Q&A says a company whose employees use ChatGPT for tasks like writing or translating must comply with Article 4, and should inform staff about specific risks such as hallucination.
Records
What record should we keep to show we met Article 4?
Keep an internal record of the training and guidance you provided: what was covered, who attended, when, and why that depth suited those roles. The Commission says no certificate is required and that organisations can keep an internal record instead.