AI Literacy Policy

Generated pursuant to Regulation (EU) 2024/1689, Article 4 · 29 July 2026

Purpose and Scope

Northwind Analytics Oy ("the Organisation") adopts this AI Literacy Policy to ensure that all personnel involved in the deployment, operation, oversight, or use of AI systems possess sufficient knowledge and skills to understand AI systems, their capabilities, limitations, and associated risks.

This policy applies to all employees, contractors, and third parties acting on behalf of the Organisation who interact with, supervise, or make decisions based on outputs from AI systems, including the AI system designated as ChatGPT Enterprise.

AI System in Scope

AI Literacy Requirements

The Organisation recognises that effective use and oversight of AI systems requires personnel to understand:

• The fundamental principles of how AI systems operate, including their probabilistic nature and limitations
• The specific capabilities, intended purpose, and known limitations of ChatGPT Enterprise
• The risks associated with AI outputs, including bias, errors, and hallucinations
• Applicable legal obligations under Regulation (EU) 2024/1689 and relevant sectoral law
• The Organisation's internal procedures for AI oversight, escalation, and incident reporting
• Ethical considerations in AI deployment, including fairness, transparency, and accountability

Training Programme

Mandatory training

All personnel whose role involves direct use of, or reliance on, outputs from ChatGPT Enterprise must complete mandatory AI literacy training before being granted access to the system. Training must be repeated whenever the system undergoes significant changes or when personnel change role.

Training covers at minimum:

• Introduction to AI: what AI systems are and how they make decisions
• System-specific training for ChatGPT Enterprise: intended use, outputs, and known limitations
• Human oversight responsibilities: when and how to override or escalate AI outputs
• EU AI Act obligations relevant to the personnel's role
• Data protection obligations when processing personal data through AI systems

Role-based requirements

Roles and Responsibilities

Training Records and Verification

The Organisation maintains records of all AI literacy training completed by personnel. Records include: name of participant, training content covered, date of completion, and assessment outcome where applicable. Records are retained for a minimum of three years and are made available to competent authorities upon request.

Completion of mandatory training is verified before access to ChatGPT Enterprise is granted. Access is suspended if mandatory refresher training is not completed within 30 days of its due date.

Incident Reporting and Continuous Improvement

Any personnel who observe AI outputs that appear erroneous, biased, or inconsistent with expected behaviour must report this immediately to their line manager and to the designated AI contact: compliance@example.com.

The Organisation reviews reported incidents on a quarterly basis and uses findings to update training content, refine oversight procedures, and improve AI literacy programme effectiveness.

Policy Review

This policy is reviewed annually and updated whenever there is a material change to ChatGPT Enterprise, a change in applicable law, or a significant incident. The next scheduled review date is twelve months from the date of adoption shown below.

All updates are communicated to affected personnel within 30 days of adoption.

Legal Basis

This policy is adopted pursuant to Article 4 of Regulation (EU) 2024/1689 of the European Parliament and of the Council on artificial intelligence (the AI Act), which requires providers and deployers of AI systems to take measures to ensure, to the best of their ability, a sufficient level of AI literacy among their staff and persons dealing with the operation and use of AI systems on their behalf.