---
title: "AI literacy: what the EU AI Act now asks of your firm, and a proportionate programme to meet it"
canonical: https://www.grcmana.io/vault/ai-governance/ai-literacy
published: 2026-10-23
updated: 2026-10-23
author: "Harry West"
framework: "AI Governance"
control: "Guide AI literacy: what the EU AI Act now asks of your firm, and a proportionate programme to meet it"
journeyStage: intermediate
---

# AI literacy: what the EU AI Act now asks of your firm, and a proportionate programme to meet it

## Key takeaways

AI literacy is the skills, knowledge and understanding to use AI in an informed way and to be aware of its risks. Since Regulation (EU) 2026/1744, EU AI Act Article 4 requires providers and deployers to take measures to support it, with no set level and no certificate. A UK firm meets it with a tiered programme and one dated internal record.

- **Article 4 as amended** — Providers and deployers must take measures to support the development of AI literacy of staff and others acting for them. No specific level is required for any individual.
- **Supervision** — Article 4 has applied since 2 February 2025. National market surveillance authorities supervise and enforce it from 2 August 2026, with penalties set in each Member State's national law.
- **Evidence** — The European Commission says no certificate is needed. An internal record of trainings and other guiding initiatives shows what a firm did to meet the duty.
- **High-risk overseers** — Article 26(2) requires deployers of high-risk AI systems to assign human oversight to people with the necessary competence, training and authority. For Annex III systems this applies from 2 December 2027.

An enterprise customer's security questionnaire has a new section, and one question in it asks how your staff are trained on AI. Half the team already uses AI assistants every day, and nobody can say what they were told about the risks. AI literacy is the EU AI Act duty behind that question, and the rule changed in July 2026.

This guide is for founders, COOs and compliance leads at UK B2B tech firms of 25 to 250 people. It shows whether the AI literacy duty reaches you, how to meet it with a proportionate programme in four tiers, and how to keep one record that answers regulators, auditors and customers alike.

## What is AI literacy?

AI literacy is the skills, knowledge and understanding that let people use AI systems in an informed way and stay aware of their opportunities, risks and possible harm. Under the EU AI Act, providers and deployers must take measures to support it for their staff and others acting for them. No set level and no certificate is required.

The definition sits in [Article 3(56) of the EU AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). It covers providers, deployers and affected persons, each in the context of their own rights and obligations. For a business, the practical reading is simple: the people who use, buy, build or supervise AI on your behalf should understand what it does, where it goes wrong and what to do about it.

AI literacy is not the same as AI skills. A skills course teaches someone to get more out of a tool. AI literacy teaches them when not to trust its output, what data must never go into it, and who to tell when something looks wrong.

For the Act itself, including risk classes and roles, see our [EU AI Act overview](https://www.grcmana.io/vault/eu-ai-act). This page covers only the literacy duty.

## What does Article 4 of the EU AI Act require now?

Article 4 requires providers and deployers to take measures to support the development of AI literacy among their staff and others who operate or use AI on their behalf. Regulation (EU) 2026/1744, the Digital Omnibus on AI, removed the old wording about ensuring a "sufficient level". The duty is now an obligation of effort, not of result.

The [Digital Omnibus on AI](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng) was adopted on 8 July 2026, published in the Official Journal on 24 July 2026, and entered into force on the third day after publication. It replaced Article 4 in full.

|  | Article 4 as first adopted (2024) | Article 4 after Regulation (EU) 2026/1744 |
| --- | --- | --- |
| Core duty | Take measures to ensure, to their best extent, a sufficient level of AI literacy | Take measures to support the development of AI literacy |
| Required level | A "sufficient level", undefined | None. The text says the duty does not require any specific level for any individual |
| Who is covered | Staff and other persons dealing with AI on the firm's behalf | Unchanged |
| What to weigh | Technical knowledge, experience, education, training, context of use, the people the AI is used on | Unchanged |
| Support from authorities | Not stated | The Commission and Member States must support firms, especially SMEs, and the Commission publishes practical examples |

Three things did not change. AI literacy is still a legal obligation on providers and deployers. Article 4 has applied since 2 February 2025, and national market surveillance authorities supervise and enforce it from 2 August 2026, according to the [Commission's AI literacy Q&A](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers). Penalties are set by each Member State's national law and must be proportionate.

The amendment lowered the bar on outcome, not on effort.

A firm that has done nothing is still out of line. What changed is that a regulator can no longer demand proof that each employee reached a defined level.

## Does the AI literacy duty apply to a UK firm?

The AI literacy duty applies to a UK firm that provides or deploys AI reaching the EU. That means placing AI on the EU market, deploying it through an EU establishment, or producing AI output used in the EU. A firm can also be pulled in as "other persons" acting for an EU customer.

Article 2 of the Act sets the territorial scope, and the Commission's Q&A confirms that Article 4 follows it. Work through four questions:

1. **Do you place an AI system on the EU market?** If your product includes an AI feature and you sell it to EU customers, you are likely a provider. Providers are in scope wherever they are established.
2. **Do you have an EU establishment that uses AI?** An EU subsidiary or office that deploys AI tools is a deployer located in the Union.
3. **Is the output of your AI used in the EU?** Article 2(1)(c) reaches providers and deployers in third countries where the AI system's output is used in the Union. A UK service that delivers AI-generated analysis to EU clients can fall here.
4. **Do you act on an EU customer's behalf?** The Commission's Q&A says "other persons" can include a contractor, a service provider or a client. An EU customer meeting its own Article 4 duty may expect your staff who operate its AI systems to be AI literate too.

If every answer is no, the EU duty does not reach you. Customers may still ask, and the same programme answers them. Our guide to [EU AI Act obligations for SaaS](https://www.grcmana.io/blog/eu-ai-act-saas-obligations) works through the provider and deployer roles feature by feature.

## How do you build a proportionate AI literacy programme?

Build a proportionate AI literacy programme by listing the AI systems your firm provides or uses, deciding your role for each, judging the risks, and then giving each group of people the measures their exposure calls for. The Commission's Q&A says differentiated levels of training are appropriate, and that no single format is mandatory.

Start from what is actually in use. If you do not yet know which AI tools your team relies on, our guide to [shadow AI governance](https://www.grcmana.io/blog/shadow-ai-governance) covers how to find and register them. That register is the first input to the programme.

Then follow the four considerations the Commission sets out as minimum content:

1. **A general understanding of AI.** What AI is, how it works, which AI the firm uses, and its opportunities and dangers.
2. **Your role.** Whether you develop AI systems, use systems built by others, or both.
3. **The risk of each system.** What people need to know to use it safely, and which risks they must avoid or mitigate.
4. **The people.** Their existing technical knowledge, experience, education and training, and the context and purpose of each system.

We recommend turning those considerations into four tiers. Most firms of 25 to 250 people need the first three; the fourth applies only where high-risk systems are in play.

| Tier | Who | What they need to understand | Typical measures |
| --- | --- | --- | --- |
| 1. Everyone | All staff and long-term contractors | What AI is, which tools are approved, what data must never go in, how to report a problem | A short session at induction, the acceptable use rules, an annual refresher |
| 2. Regular AI users | People who use AI assistants or AI features in daily work | The limits of the specific tools they use, such as made-up output, and how to check results before relying on them | Tool-specific guidance, worked examples from their own role |
| 3. People who build, buy or approve AI | Engineers, product owners, procurement, leadership | The firm's role under the Act, risk assessment of AI systems, supplier questions, legal and ethical aspects | Deeper sessions tied to the AI risk process and supplier reviews |
| 4. High-risk overseers | People assigned to oversee a high-risk AI system | How the system works, its failure modes, when to intervene or stop it | System-specific training, with the authority and support to act |

Tier 4 carries its own legal hook. Article 26(2) requires deployers of high-risk AI systems to assign human oversight to people "who have the necessary competence, training and authority, as well as the necessary support". The Commission's Q&A says this duty "remains in place" after the amendment. For systems that are high-risk under Annex III, it applies from 2 December 2027, the date Regulation (EU) 2026/1744 set for the Chapter III rules that include Article 26.

The Commission also answers a common question directly. Staff who use a general-purpose chatbot to write advertising copy or translate text are in scope, and should be told about specific risks such as hallucination. Technical staff with an AI background are normally literate already, but the firm should still check they know its own systems and their risks.

Do not build a separate training plan for AI. Fold the AI literacy tiers into the firm-wide programme described in our [compliance training guide](https://www.grcmana.io/vault/compliance/compliance-training), so one schedule, one owner and one set of records covers both.

## What evidence shows you met the AI literacy duty?

Good evidence of AI literacy is an internal record of the measures you took, who they reached and when. The Commission's Q&A states there is no need for a certificate and that organisations can keep an internal record of trainings and other guiding initiatives. Article 4 does not oblige firms to test staff knowledge.

A record that works holds, for each measure:

- the tier and the people or roles it covered;
- the AI systems it related to;
- what the measure was, such as a session, guidance note or walkthrough;
- the date delivered and the date it is next due;
- the evidence it happened, such as an attendance log or acknowledgement.

A training completion rate is not AI literacy. A record of who uses which system, and what they were told about its risks, is.

The same record serves an AI management system. ISO/IEC 42001:2023 follows the common management system structure, in which clause 7.2 covers competence and clause 7.3 covers awareness. An auditor of an AI management system will look for evidence that people in AI roles are competent and that staff know the AI policy and their part in it. A tiered AI literacy record is that evidence. Our [ISO/IEC 42001 overview](https://www.grcmana.io/vault/iso-42001) explains how the standard fits together.

The Commission also runs a [living repository of AI literacy practices](https://digital-strategy.ec.europa.eu/en/library/living-repository-foster-learning-and-exchange-ai-literacy) with examples collected from organisations taking part in the EU's AI Pact. It is useful for ideas, but copying a practice from it does not by itself give a presumption of compliance with Article 4.

## How does an AI literacy record answer customer questionnaires?

An AI literacy record answers customer questionnaires because the AI sections of those questionnaires ask the same things a regulator would: which AI tools staff use, what they were trained on, how often, and how you know. A dated, tiered record lets you answer each question with evidence rather than a policy statement.

Questionnaire sections on AI tend to cluster around a few themes:

- **Use and approval.** Which AI tools staff are allowed to use, and who approved them. The tool register and tier 1 rules answer this.
- **Data handling.** Whether customer data can go into AI tools. Tier 1 and tier 2 guidance answer this.
- **Training.** How staff are trained on AI risks, and how often. The record's dates and coverage answer this.
- **Oversight.** Who checks AI output before it reaches the customer. Tier 2 and tier 4 measures answer this.

Keep a short, customer-ready summary of the record: the tiers, the population each covers, refresh cycles and the date of the last review. That summary turns a scramble across inboxes into an answer you can paste.

## Is there an AI literacy requirement in the UK?

There is no UK law that imposes an AI literacy duty on businesses. In the UK, the pressure comes from three other places: data protection law where AI processes personal data, customer contracts and questionnaires, and the EU AI Act for firms whose AI reaches the EU. Each one rewards the same tiered record.

If you have a data protection officer, [UK GDPR Article 39](https://www.legislation.gov.uk/eur/2016/679/article/39) makes monitoring compliance one of their tasks, including "awareness-raising and training of staff involved in processing operations". Where AI tools process personal data, AI literacy belongs in that training. The [ICO's guidance on AI](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/) sets out how UK GDPR principles apply to AI systems.

Customer contracts are the faster driver for most suppliers. An enterprise buyer with its own EU obligations will push them down the supply chain, and the questionnaire is often where that pressure arrives first.

## What are the most common AI literacy mistakes?

The most common AI literacy mistakes are buying one generic course for everyone, treating a certificate as proof, training on AI in general rather than the tools staff actually use, leaving contractors out, and keeping no dated record. Each one either wastes effort or leaves the firm unable to show what it did.

1. **One course for everyone.** Article 4 asks you to weigh each person's knowledge and context. A single module ignores both.
2. **Chasing certificates.** The amended text sets no required level, and the Commission says no certificate is needed. Spend the effort on relevance instead.
3. **Teaching AI in general.** People need to know the limits of the tools on their own screens, not a history of machine learning.
4. **Forgetting other persons.** Contractors and service providers acting for you are in scope, and so are your staff when you act for an EU customer.
5. **No record.** A programme you cannot evidence is, to a supervisor or a customer, a programme that did not happen.

An AI policy nobody has been walked through is a document, not a measure.

The fix is the same in every case: start from the tool register, tier the people, and write down what you did. Done that way, AI literacy stops being a compliance chore and becomes part of how the team uses AI safely.

## Frequently asked questions

### Is AI literacy training mandatory?

Some measure is mandatory for providers and deployers in scope, but formal training is not the only option. The Commission's Q&A says there is no one-size-fits-all approach and no mandatory format. Guidance notes, walkthroughs and tool-specific briefings can count, as long as they suit the people and the AI systems involved.

### Do staff need an AI literacy certificate?

No. The amended Article 4 does not require any specific level of AI literacy for any individual, so there is no pass mark to certify against. A course certificate can still sit in your record as evidence that a measure happened, but on its own it does not show that someone understands the AI tools they actually use.

### Do we need an AI officer to meet the AI literacy duty?

No. The Commission's Q&A says no specific governance structure is mandated to comply with Article 4. We recommend giving ownership to whoever already runs compliance training or the AI tool register, so AI literacy sits inside an existing process rather than a new role.

### How often should AI literacy measures be refreshed?

The Act sets no frequency. We recommend an annual refresher for everyone, plus a prompt update whenever a new AI tool is approved or an existing one changes materially. Tools change faster than annual cycles, so tie tier 2 guidance to the tool register rather than the calendar.

### What happens if we ignore the AI literacy duty?

National market surveillance authorities supervise Article 4 from 2 August 2026, and penalties are set in each Member State's national law. The Commission says enforcement will be proportionate, and that action is more likely where an incident follows from a lack of training or guidance.