Free resource · Word + Excel kit

Sponsor's AI Act Kit: The 2026-2027 Roadmap for Your Organization

This is what actually applies to a large organization using AI, how to build the AI ​​literacy program required by Article 4, how to prepare for high risk before December 2027, and what evidence to retain. All without fear-mongering.

📄 Word, 31 pages📊 Excel Workbook, 5 tools🇪🇺 Omnibus IA 2026 Update🆓 Free

Download the kitSee the 2026-2028 calendar

The question always arises in the same way. An administrator, an auditor, a staff representative, or a client asks if the organization is "AI Act compliant." The person leading the AI ​​program then looks for an answer and finds, on one hand, firms selling audits, on the other, training organizations advertising "mandatory AI training" that doesn't exist in that form, and in between, governance platform providers. No one simply tells them what an implementer should do, in what order, and how to prove it.

This page provides the answer, and the accompanying toolkit makes it operational. It focuses on the only obligation that now applies to all employees of an organization using AI: AI literacy, as outlined in Article 4. This is because it's the one the sponsor has control over, and because, when implemented effectively, it fosters both adoption and compliance. The toolkit addresses the remaining issues—transparency, high risk, governance, and social dialogue—to the extent that a sponsor needs to know to manage the project effectively, with consistent references to the decision-making bodies.

1. What really applies to a deployer, after the Omnibus AI

A large organization that deploys Copilot, ChatGPT, Claude, Gemini, or Mistral, that activates an AI function in its HR software or CRM, or that configures agents with its vendor's tools, is deployer In the sense of the regulation, not a supplier. This is the general case, and it is the one the kit addresses. Regulation (EU) 2026/1744, known as Omnibus IA, published on July 24, 2026, and in force since July 27, has postponed the most stringent obligations and reformulated Article 4. Here is the timetable as it applies to a deployer.

Date	This applies	What you must have done
2th February 2025	Prohibited practices (article 5). AI literacy (article 4).	Prohibited practices eliminated, AI literacy program launched.
August 2, 2026	General application. Transparency (Article 50). Designation of national authorities and commencement of control, including Article 4.	Chatbots identified as such, generated content labeled, AI literacy plan documented, evidence retained.
2th December 2026	End of the marking period for systems prior to August 2, 2026. New prohibited practice (non-consensual intimate content, pedocriminal content).	Written commitment from publishers regarding the tagging of generated content.
2th December 2027	High risk of Annex III: obligations of the deployer (Article 26), impact assessment on fundamental rights (Article 27), registration of public authorities (Article 49).	Qualified register, trained supervisors, logs, information for employees and individuals, impact analysis where appropriate.
2th August 2028	High risk from Annex I (safety components of regulated products).	This mainly concerns manufacturers who integrate AI into products.

Oversight falls under the jurisdiction of national authorities, not the European AI Bureau. In France, the government announced in September 2025 a sector-based allocation of responsibilities, subject to the law: the CNIL (National Commission for Information Technology and Civil Liberties) for biometrics, employment, and education; the DGCCRF (Directorate General for Competition Policy, Consumer Affairs and Fraud Control) for content transparency and coordination; Arcom (French Regulatory Authority for Electronic Communications and Posts); the ACPR (French Prudential Control and Resolution Authority) for credit; and the ANSM (French National Agency for Medicines and Health Products Safety) for medical devices. Penalties can reach up to €15 million or 3% of global turnover for breaches of deployment and transparency requirements. Article 4 does not include a specific cap, but the Commission indicates that a lack of AI literacy will carry significant weight when an incident is attributable to insufficient training. The toolkit details the four situations covered by the regulation, what the AI ​​omnibus has changed, and what other relevant legislation continues to apply: GDPR, labor law, and security.

2. Article 4: the only obligation that already concerns everyone

Since the omnibus regulation (EU) 2026/1744, Article 4 requires suppliers and deployers to "take measures to promote the development of AI proficiency" among their staff and those using their systems on their behalf, taking into account their knowledge, experience, and the context of use, without guaranteeing a specific level for anyone. The Commission's Q&A, updated on July 27, 2026, reflects this: it is an obligation of means, proportionate and differentiated by profile; it covers contractors and temporary workers; it requires neither certification nor testing, an internal training register is sufficient; it has been applicable since February 2025 and is subject to monitoring since August 2026; and for deployers of high-risk systems, training for those responsible for human supervision remains a full-fledged obligation.

The key to this system is differentiation by user profile, something that off-the-shelf e-learning doesn't achieve. The kit distinguishes five user groups, defined by their exposure to AI, with specific learning objectives, formats, and durations for each.

Population	What she needs to know	indicative format
Assistant users	The common ground in eight points: what generative AI is, the authorized tools, what is never entrusted, hallucinations and biases, verification, transparency, sensitive uses, who to contact.	Practical one-hour workshop in groups of twelve, on use cases of the profession, followed by online review.
Managers	What a manager can or cannot delegate to AI, how to review assisted work, informing their team, declaring created agents.	Two hours, integrated into management training programs.
High-risk professions	The obligations of article 26 at their post: supplier's notice, human supervision, when not to follow the system, logs, informing people, incidents.	Half a day per system, individual authorization, before commissioning.
Technical functions, data, purchasing	System qualification, exemptions from Article 6, documentation, publisher clauses, marking, logging, agent security.	A day or modular course.
Management and control functions	The framework, the timeline, the responsibilities, the decisions to be made, the indicators, the incident scenarios.	A one-and-a-half-hour conference, followed by an annual review.

3. Evidence to be retained, without a score file

Since no certificate is required, compliance with Article 4 is demonstrated through documentation, and the key principle is proportion: proving that appropriate measures have been taken, without creating a file of individual results that the GDPR would not justify. The core elements consist of seven pieces of evidence: a dated and validated AI literacy plan, a versioned summary of training materials, a session log (date, duration, target audience, facilitator, participants), coverage rates per target audience, a list of authorized supervisors per system, AI committee reports and CSE minutes, and the link between each sensitive system and the training courses that cover it. The kit provides a two-page plan template and an Excel spreadsheet that holds the log, the evidence register, and the coverage rates.

4. Transparency, starting now

Article 50 has been in effect since August 2, 2026, and has not been postponed. Two obligations are placed on the provider, which you should verify: chatbots and agents must identify themselves as AI and state on whose behalf they are acting; synthetic content must be machine-readable, with a deadline of December 2, 2026, for older systems. Two obligations are placed on the deployer: informing individuals exposed to emotion recognition or biometric categorization, uses which are otherwise prohibited in the workplace; and visibly labeling deepfakes and generated text published to inform the public without editorial review. The Commission published its final guidelines on July 20, 2026, and recognized the code of good practice on labeling. The toolkit derives a five-point checklist from this, to be assigned to the communications and IT departments.

5. High risk at fifteen months: five stages

The postponement to December 2, 2027 is a preparation period, not a waiver. Fifteen months is the time it takes for a large organization to spot its systems, candidates for high risk, use by use (recruitment, evaluation, credit, life and health insurance pricing, public services), including at its service providers; to make them to qualify through legal means, with the publisher's documentation, in light of the Commission's draft guidelines of 19 May 2026; contract what Article 26 requires us to obtain from publishers (notice, journals, assistance with supervision, information on changes); organizer human supervision, procedures, consultation with relevant bodies, informing individuals, and, where required, impact assessments on fundamental rights; and prove, with one file per system. The kit translates each of the twelve paragraphs of Article 26 into an action, a responsible party, and evidence.

6. Social dialogue: what the judges decided

Regulations require informing employee representatives before the implementation of a high-risk system in the workplace (Article 26, paragraph 7). French law goes further and earlier: the Social and Economic Committee (CSE) must be consulted on the introduction of any new technology (Article L. 2312-8 of the French Labor Code), and four recent court decisions have established the guidelines. The Nanterre Judicial Court ruled on February 14, 2025, that a pilot program where employees actually use the tools constitutes an implementation requiring prior consultation. Then, on January 29, 2026, the court ruled that replacing software with AI-integrated tools constitutes a new technology, the determining factor being its impact on work. The Paris Judicial Court held on February 10, 2026, that a limited and voluntary Copilot trial, without any demonstrated impact on work, did not warrant an expert assessment. The Paris Court of Appeal confirmed on May 21, 2026, that authorizing and regulating already used tools through a charter amounts to introducing them. The resulting rule is that the Works Council (CSE) must be consulted before any deployment. A pilot program that equips an entire department, is implemented over time, or affects working conditions already constitutes a deployment (Nanterre Court of Appeal, February 14, 2025); only a truly voluntary test, limited in time and scope, can precede it (Paris Court of Appeal, February 10, 2026). The toolkit derives four practical rules from this, including the following: present the AI ​​literacy plan to the Works Council at the same time as the tool, because the minutes of the meeting become evidence under Article 4.

7. What the kit contains

The Word document has 31 pages, in eight parts and six annexes: the user guide; what applies to a deployer in 2026-2027 (role, four situations, what the AI ​​omnibus has changed, timetable, authorities, sanctions, what continues to apply); the self-assessment in twelve questions; Article 4 in depth (the text, the four questions from the Commission, the five populations, the eight-point core, the formats and the typical timetable, the evidence, the seven common mistakes); transparency; high risk (areas of Annex III, exemptions, deployer obligations translated into actions, impact analysis, publisher clauses, five-step plan); governance, the role matrix and social dialogue; the 90-day and 12-month roadmap with its milestones and indicators. The appendices provide the AI ​​literacy plan template, the note to the steering committee, the thirty-point checklist, the frequently asked questions, the glossary, and dated sources.

The Excel workbook includes the tools in five tabs: the population matrix with the calculation of coverage rates and hours to be planned, the session log of the AI ​​literacy plan with its summary, the pre-filled evidence register with the ten typical evidence, the settlement calendar with the countdown to each deadline, and the self-diagnosis which calculates your profile.

The kit, part by part: what each part contains and what it's for. The templates to fill out are in the Word document and the Excel workbook.

Part 1. What applies to a deployer in 2026-2027

1.1 Supplier or deployer: you are almost always a deployer

You become a supplier in four cases (Article 25): you affix your name or trademark to a high-risk AI system already on the market, you make a substantial modification to it, you change its purpose to the point of making it high-risk, or you develop, or have developed according to specifications, a system that you put into service.

1.5 Who has the controls in France, and what are the sanctions?

The penalties under Article 99 are graduated: €35 million or 7% of global turnover for a prohibited practice, €15 million or 3% for other obligations, including those of the deployer and transparency, and €7,5 million or 1% for incorrect information. The risk under Article 4 is not the fine itself, but rather the inability to demonstrate, on the day of an incident, that the organization had taken the necessary steps.

1.6 What continues to apply alongside the AI Act

The GDPR, labor law (consultation of the CSE, article L. 2312-8 of the Labor Code), trade secrets, intellectual property and security (ANSSI recommendations, charter of use), and sectoral law: banking secrecy, medical secrecy, public procurement, product regulations.

Part 2. Where are you now? Self-assessment in twelve questions

Read your result

Twelve yes/no questions (register, assistants, literacy plan, recruitment, credit and insurance, public status, internal development, chatbots, published content, works council, publisher contracts, designated manager), compiled in the "Self-assessment" tab of the Excel workbook. Fewer than four yes answers: start now. Four to eight: underway. Nine or more: consolidate by switching to review mode.

Part 3. Article 4: Building the AI ​​Literacy Program

3.2 The Commission's four questions

The Commission's four-step Q&A approach, which serves as a benchmark against which an authority will compare your program, covers: general understanding of AI, the role of the organization (supplier or deployer), risks specific to the systems used, and actions tailored to knowledge, experience, and context. The toolkit translates each step into a framework: a common core, modules by user group and by tool, and a user group matrix.

People we forget

The service providers, temporary workers and apprentices who use your tools, for whom the foundation is integrated into the reception; the newcomers, without whom coverage erodes every year; and the people concerned by the decisions (candidates, clients, users), who fall under information (articles 26, paragraph 11, and 50), not training.

3.4 The common core curriculum in eight points

The hour that every assistant user should have received, in a practical workshop: what generative AI is (a language model predicts plausible text, it does not consult a truth), the authorized tools, what you should never entrust to a tool, hallucinations, bias and manipulation, checking before using, transparency, sensitive uses, who to contact and how to report.

3.5 Formats, frequency and typical schedule

Waves of one-hour workshops in groups of twelve reach two thousand people over four to six months, facilitated by a part-time facilitator or a network of ambassadors (one for every 30 to 50 employees). A twenty-minute online module serves as a refresher, without replacing the workshop. The typical timeline runs from the initial decision in month 1 to the final coverage assessment in month 12.

Three GDPR precautions regarding evidence

Retain participation data only to the necessary level (who completed what, when), and no more: no quiz scores with names attached without a defined purpose, no unlimited data retention, and employees must be informed about this tracking. The Data Protection Officer (DPO) validates the evidence system as with any other data processing.

3.7 The seven most frequent mistakes

A generic module bought off the shelf; training without a register; confusing tool training with AI literacy; forgetting service providers and newcomers; scoring individuals without purpose; training only once, while the tools change every six months; not dating anything, because a program without a validated plan or session log is worthless in the eyes of an authority.

Part 4. Article 50: Transparency, now

The five-point transparency checklist

Inventory of systems that communicate with external parties; written rule for labeling generated content, with an example of a label; written commitment from publishers on machine-readable marking before December 2, 2026 for older tools; prohibition in the charter of any emotion recognition or biometric categorization; a point in the AI ​​literacy framework.

Part 5. High risk at fifteen months

5.1 The areas of Annex III that concern a large organisation

Employment and workforce management (point 4), access to essential services (point 5: credit, life and health insurance, public benefits), education (point 3), biometrics (point 1), critical infrastructure (point 2). The protective interpretation is that of use, not of the product: a general-purpose assistant used to sort applications falls within the scope of employment.

5.2 Article 6 exemptions and guidelines in preparation

Four presumed cases of exemption (Article 6, paragraph 3): narrow procedural task, improvement of an already performed human activity, detection of deviations without replacing human assessment, preparatory task subject to substantial human review. According to the draft guidelines of May 19, 2026, tools that filter, score, or rank candidates will, in principle, be considered high-risk. The exemption must be documented: request this document from the provider.

5.3 The deployer's obligations, translated into actions

Each paragraph of Article 26 becomes an action, a person responsible and a proof: follow the instructions (§1), designate and train supervisors (§2), control input data (§4), monitor and report incidents (§5), keep logs for at least six months (§6), inform the CSE and employees (§7), inform persons subject to assisted decision-making (§11).

5.4 The impact assessment on fundamental rights (Article 27)

Mandatory before the first use of a high-risk Annex III system for public bodies, private entities providing public services, and any operator of solvency or life and health insurance pricing systems. It complements the GDPR impact assessment without duplicating it; the Commission and EDPB guidelines expected at the end of 2026 should clarify how to combine the two into a single document.

5.5 What you need to get from your publishers

The qualification of the system and the documentation of any exemption, the user manual (article 13), access to logs, assistance with human supervision, information on system changes, marking of generated content, declaration of conformity and allocation of responsibilities in the event of a serious incident.

Part 6. Governance, roles and social dialogue

6.1 Who does what

A RACI matrix distributes eleven activities, from the register to the annual review, among the sponsor, legal, DPO, IT, procurement, HR, and business units. Three roles emerge: the sponsor, who leads the AI ​​literacy plan; the AI ​​lead, who maintains the register; and a small AI committee, meeting monthly and then every six weeks, which decides on the outcomes.

6.2 Social dialogue: what the regulations say, what the judges say

Four practical rules drawn from the decisions of 2025 and 2026: consult the CSE before any deployment, knowing that a pilot which equips an entire service, is installed over time or affects working conditions is already one and that only a truly voluntary test, limited in time and scope, can precede the consultation, and before formalizing by a charter of already installed uses; document the effect on work, a criterion which the judge retains; present the AI ​​literacy plan at the same time as the tool; allow one to two months of consultation, more with an expert.

6.3 Interaction with the GDPR and the AI ​​Charter

The DPO is a member of the AI ​​committee, validates the evidence framework of Article 4, and conducts impact assessments with the business units. The AI ​​charter defines what each party is authorized to do, the register defines who validates what, and the AI ​​literacy plan communicates both.

Part 7. The Roadmap

7.1 The first 90 days

Six dated actions per week, each with its deliverable: appoint the sponsor and the AI ​​referent, establish the register and pass the self-diagnosis, validate the AI ​​literacy plan, verify transparency, launch the first wave of the foundation and the register of evidence, identify the candidate systems at high risk.

7.2 The first twelve months

At least 80% coverage of the core at twelve months, 100% for exposed trades before any commissioning; all candidate systems qualified, supervisors trained, impact analyses conducted, review to the management committee at six and twelve months.

7.4 Performance indicators

Coverage rate by department and population, share of qualified, high-risk or exempt systems, share of authorized supervisors, reported incidents and processing time, share of compliant publisher contracts, date of last plan review.

Appendices. Ready-to-adapt templates

Appendix A. AI Literacy Plan Template (Section 4)

Two pages which, completed, dated and validated, constitute the first proof of your compliance with article 4: context and scope; populations and staff with a coverage objective; content; formats, schedule and means; evidence and follow-up; review.

Appendix B. Sample memo to the management committee

One page, in a factual tone, to obtain the mandate and the resources: what applies to us, what we risk, what we propose (a three-part program over twelve months), what we ask for and what it brings.

Appendix C. Deployer Compliance Checklist

Thirty checkpoints, sorted by deadline, from "now" to December 2, 2027, to be ticked, dated and filed in the evidence register.

8. Frequently Asked Questions

Is AI training mandatory in companies?

No, not in the sense of a number of hours, a prescribed program, or a certificate. What has been mandatory since February 2, 2025, is to take measures to promote the development of AI skills among the people who use your systems, tailored to their profiles and your specific needs, and to be able to demonstrate this. Training is the most natural way to do this, and the one that the authorities will most readily recognize.

Are individual certificates required?

No. The Commission indicates that an internal register of training courses and other initiatives is sufficient. Individual certificates are only relevant for supervisors of sensitive systems, whose authorization must be traceable.

Our practices are of minimal risk: are we safe?

For high-risk obligations, yes, as long as your practices do not affect individuals in the areas listed in Annex III. However, Articles 4 and 50 apply regardless of the risk level, and minimal use can become high-risk due to the purpose a business assigns it. Hence the AI ​​systems register.

Does the postponement of the high risk to December 2027 mean that we can wait?

No. The postponement only applies to high-risk systems, and fifteen months is the time needed to qualify the systems, obtain the necessary information from the vendors, train the supervisors, and consult with the relevant bodies. Organizations that wait until the second half of 2027 will be late to the game.

Our tools are those of Microsoft, Google or OpenAI: isn't compliance their business?

Their role, yes: design, content tagging, documentation. Yours remains: your users' literacy, how you use the tools, transparency with your stakeholders, and, for high-risk situations, human oversight and keeping people informed. A compliant tool does not guarantee compliant use.

Where do we begin if we haven't done anything?

Three things, in order: appoint someone, inventory the systems, and launch the AI ​​literacy platform for assistant users, while informing employee representatives. The toolkit's 90-day roadmap is written for this situation.

9. Going further

This kit is the roadmap that brings together three other free resources from NextStart.AI: the AI charter template sets the rules of use, the AI Systems Governance Kit provides the AI Act register and qualification grid, the AI Ambassadors Kit organizes the network that disseminates AI literacy as close as possible to the teams. Organizations that want to move quickly entrust the foundation of Article 4 to waves of one-hour workshops facilitated on their own use cases, with a proof-of-concept package delivered at the end of each wave: this is the purpose of the AI training in companies and the mission Governing your agents.

Read also : AI Project Sponsor Security and Data Kit, GDPR Kit for AI Project Sponsors, AI systems governance: the 2026 toolkit, AI Charter in Business: The 2026 Model (Downloadable), AI Ambassador Network: The 2026 Toolkit et AI Adoption Roadmap in 12 Months: The 2026 Toolkit.

The entire series of free kits. To drive adoption: AI charter template, AI Ambassadors Kit, Manager's toolkit for dealing with AI, Adoption Roadmap Kit, AI maturity grid, AI Measurement and ROI Kit et AI Governance KitFor the AI ​​project sponsor: GDPR kit, Security and data kit, AI and Social Dialogue Kit, frugal AI kit, AI Sovereignty Kit et responsible AI kitBy profession: AI HR kit, AI marketing kit, AI finance kit, AI kit for lawyers, AI kit for salespeople, AI toolkit for project managers, AI innovator kit et communicator's AI kit.

10. Sources

The regulatory facts cited on this page and in the toolkit are based on the following dated sources. The consolidated texts published in the Official Journal of the European Union are authoritative.

• European Union, Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence, and Regulation (EU) 2026/1744 (Omnibus IA) published on 24 July 2026, in force on 27 July 2026.
• White & Case, EU AI Omnibus enters into force, amending the AI ActJuly 2026; Future of Privacy Forum, The AI Act implementation timeline: what changes under the AI ​​Omnibus, 2026.
• European Commission, AI Literacy, Questions & Answers (Article 4), updated on 27 July 2026, and Living repository to foster learning and exchange on AI literacy.
• European Commission, code of best practices on the marking and labeling of AI-generated content and guidelines on the transparency obligations of Article 50, July 2026; analysis: Faegre Drinker, Commission confirms transparency code of practice as adequate, July 2026.
• European Commission, draft guidelines on the classification of high-risk AI systems, May 19, 2026; analysis: DLA Piper, key points, June 2026.
• Directorate General for Enterprises, The authorities responsible for implementing the European regulation on artificial intelligence, September 9, 2025.
• CNIL, Entry into force of the European regulation on AI: the CNIL's first questions and answersUpdated August 17, 2026.
• Y. Bouaïcha, Consultation with the Works Council and artificial intelligence tools: what the judges decided in 2025-2026, Village of Justice, 2026.
• DINUM, DITP and DGAFP, AI Usage Guide for State Public Servants, June 2026.