What is AI literacy?
By Joey van Vliet, founderUpdated
In short
AI literacy is the knowledge and skill to work with AI responsibly: knowing what an AI system can and can’t do, being able to judge its output and recognising the risks. Article 4 of the EU AI Act asks organisations that build or use AI to take measures that support AI literacy among their people. The law doesn’t prescribe an exam or certificate.
What Article 4 asks
Article 4 applies to providers and deployers of AI systems, large or small. Most businesses are deployers: they use AI that someone else built, from Copilot to the AI features in their CRM.
The article was amended by the Digital Omnibus on AI. You now have to take measures to support the development of AI literacy among your staff and others who operate AI systems on your behalf. The new text adds that you don’t have to guarantee that any individual reaches a specific level. The obligation remains, but it is one of effort, not of result.
There’s no required number of hours, no exam and no recognised certificate. What’s appropriate depends on who works with AI, for what, and who is affected when it goes wrong.
Who it covers
Everyone who works with AI on behalf of your organisation or decides on its use. That’s a wider group than the people typing prompts:
- Direct users: anyone who operates an AI tool, from marketer to planner.
- Reviewers: managers who make decisions based on a summary or recommendation from AI.
- Management, IT and procurement: whoever has to judge whether a tool is suitable and allowed.
- Contractors and third parties: freelancers, agency staff and service providers who use AI on your behalf.
Customers who use your AI aren’t covered. The transparency rules in Article 50 apply to them instead.
What people need to know
The level differs per role, but the basics are the same for everyone. A language model predicts what sounds likely, not what is true. People who understand that check figures, legal articles, names and quotes before they go out, and recognise a hallucination. Everyone also needs to know which data must not go into an AI tool, which tools are approved and who to report to when something goes wrong.
Managers also need to recognise when an AI recommendation is skewed and when not to follow it. Anyone working with high-risk AI, for example in recruitment, also needs to know that specific system and how human oversight works.
Why it matters in practice
A common misconception: that one training day takes care of it. It counts as a measure, but afterwards people often don’t know which of their own tasks they should do differently. It’s better to train on the applications you’re actually introducing, using people’s own documents and tasks as practice material. How to choose between a workshop, an assessment and building straight away is covered in AI workshop, AI assessment or straight to implementation.
Make it demonstrable, too. Keep an overview of the AI systems you use, a breakdown by role of what each group needs to be able to do, a record of who attended which session and when, an adopted AI policy and an agreement on refreshers. The full step-by-step plan is in the AI literacy requirement.
Sources: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 on EUR-Lex. A general explanation, not legal advice.
Frequently asked questions
Is AI literacy mandatory?
Yes. Article 4 of the EU AI Act applies to providers and deployers of AI systems, including small businesses. Since the amendment by the Digital Omnibus on AI, you have to take measures to support AI literacy among your staff and others who use AI on your behalf. You don’t have to guarantee a specific level per person.
Do you need a certificate for AI literacy?
No. The regulation doesn’t prescribe a course, a number of hours, an exam or a certificate. You choose a format that fits the roles and risks in your organisation, as long as you can show which measures you’ve taken.
Does it apply if we only use Copilot or ChatGPT?
Yes. Those are AI systems too. The level needed is limited: understanding that output can be wrong, knowing which documents not to put into them and knowing that you remain responsible for what you send.
