The EU AI Act AI literacy duty: what insurance brokers need to document

What Article 4 asks of a broker

Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and others who operate or use AI systems on their behalf. The measures should reflect people's technical knowledge, experience and training, the context in which the AI is used, and the people affected by it. The duty has applied since 2 February 2025.

For a brokerage, this is a practical obligation rather than a certification exercise. The European Commission's guidance, as summarised by Covington, takes a flexible, risk-based approach and does not require a particular course or certificate. What it does expect is that you can show what you did: who uses which AI tools, what they were taught, and when.

Sufficient is the word that matters. A receptionist who uses an AI tool to summarise voicemails needs less than an account handler who uses one to compare policy wording before advising a client. The obligation scales with the use, so a brokerage that keeps AI to drafting internal notes has a light task, while one that uses AI in client advice has more to show.

This article is general information, not legal advice. Talk to your own counsel about your specific situation.

Small brokers are included

There is no exemption for small and medium-sized enterprises. A German Makler with twelve staff who uses Microsoft Copilot to draft client letters, an AI tool to summarise policy wording, or a chatbot on the website counts as a deployer of AI systems. So does a broker whose staff use ChatGPT for work, whether or not the firm officially approved it.

According to Cuatrecasas, supervision and enforcement by national authorities begins in August 2026. Documentation started now is easier than documentation reconstructed later, and an inventory of current AI use is usually the most revealing part of the exercise. Most principals find more tools in use than they expected.

Separately, the Act treats certain systems as high-risk, including AI used for risk assessment and pricing of individuals in life and health insurance. That is mostly insurer territory. If your firm uses a tool that scores individuals for life or health cover, get specific advice, because the obligations are much heavier than Article 4.

What the documentation looks like

A small brokerage can cover Article 4 with a handful of short documents kept up to date. None of them needs to be long. A two-page usage policy that staff actually read is better than a thirty-page one nobody opens.

Keep the documents where you keep other compliance records, with a named owner. When a new tool is approved, the inventory gets a new line and the training plan is checked. When someone joins, their onboarding includes the usage policy and the relevant training, and the record is updated the same week. Done this way, the whole file takes an hour or two a quarter to maintain.

• AI inventory: each tool in use, what it is used for, who uses it, what data it sees
• AI usage policy: what staff may and may not put into AI tools, and who approves new tools
• Role-based training plan: what account handlers, managers and support staff each need to know
• Training record: who attended which session or module, and when
• Review date: when the inventory and policy will next be checked

What role-based training covers for broker staff

For account handlers, the useful content is concrete. How the tools they use can be wrong, with real examples from policy summaries. Which client data may never be pasted into a tool. When an output must be checked against the source document, which for coverage questions is always. How to record that a person reviewed an AI-assisted recommendation.

Managers need a little more: how to approve a new tool, how to read a vendor's data terms, and how to spot unofficial AI use in the team. Neither group needs a lecture on neural networks. Your advice and documentation duties as a broker under insurance distribution rules do not change because a tool drafted the comparison, and training should say so plainly.

GDPR and the data processing agreement

The AI Act sits alongside GDPR, not in place of it. Any AI tool that processes client personal data is a processor, or uses processors, and needs a data processing agreement under Article 28 of the GDPR, the Auftragsverarbeitungsvertrag in Germany. Check where the data is processed, which subprocessors are involved, how long data is kept, and whether it is used to train models.

Broker files often contain special category data, such as health information on life, disability or health applications. Processing it through an AI tool needs a clear legal basis and, in many cases, a data protection impact assessment. If a tool cannot tell you where your data goes, it should not see client files.

For German brokers, the data protection authority of your Land is the relevant supervisor for GDPR questions, and many publish practical guidance on AI tools. Free consumer versions of chat tools are usually the weak point: they often lack a processing agreement on terms a broker can accept, which is a good reason to approve one business tool and say clearly in the usage policy that client data goes nowhere else.

The UK position

The UK is not subject to the EU AI Act. UK brokers work under UK GDPR and the Data Protection Act 2018, with guidance from the Information Commissioner's Office on AI and data protection, and under FCA rules including the Consumer Duty in how they treat retail customers. There is no UK equivalent of the Article 4 literacy duty today.

Two caveats apply. The EU Act can reach organisations outside the EU when the output of an AI system is used in the EU, so a UK broker serving EU clients should check its position. And the documentation described above is good practice anyway: an AI inventory, a usage policy and a training record are exactly what you would want to show the FCA, the ICO or a professional indemnity insurer if an AI-assisted error ever reached a client.

Starting small with compliance

Begin with the inventory. Ask every team which AI tools they use and for what, including personal accounts used for work. From that list, write the usage policy and decide who needs which training. Most brokerages can do the first pass in a week.

For EU and UK brokers, our five-day AI Workflow Sprint can include that inventory and a short usage policy alongside the workflow prototype, so the compliance paperwork and the first real use of AI are designed together rather than months apart.

Common questions