AI literacy under the EU AI Act: a practical checklist for organisations

What the EU AI Act's AI-literacy provision asks of organisations that use AI, and a practical checklist for building and documenting staff AI literacy.

By the AiTrain editorial team · Reviewed under our editorial standards

The EU Artificial Intelligence Act includes a short but far-reaching provision on AI literacy. Article 4 asks providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and others dealing with AI systems on their behalf. The obligation has applied since 2 February 2025.

This guide translates that into practical steps. It is general information, not legal advice.

Key takeaways

• It applies broadly — not only to developers of high-risk systems, but to organisations that deploy AI tools in their work.
• "Sufficient" depends on people's roles, their technical background and the context in which AI is used.
• There is no single mandated course or certificate; what matters is proportionate, documented measures.
• Good AI-literacy training also improves productivity — compliance and capability point the same way.

Who is in scope?

Organisations that provide AI systems, and organisations that deploy them under their authority, where those systems are placed on the market or used in the EU. In practice, many businesses outside the EU that serve EU customers or have EU operations also pay attention to it.

What "AI literacy" means in practice

The Act describes AI literacy as the skills, knowledge and understanding that allow people to make informed use of AI systems and be aware of their opportunities, risks and possible harms. A useful breakdown for training:

1. Concepts: what AI and generative AI are, in plain terms.
2. Capabilities and limits: strengths, hallucinations, bias, outdated knowledge.
3. Your tools: the specific systems your organisation uses and their intended purpose.
4. Data and privacy: what can and cannot be entered.
5. Human oversight: when and how to review, override or escalate.
6. Role-specific risks: e.g. HR decisions, customer communications, health or financial contexts.

The checklist

• ☐ Inventory AI systems in use, including AI features inside existing software.
• ☐ Map which roles use which systems, and for what.
• ☐ Define proportionate literacy levels per role (e.g. all staff / regular users / high-impact users / technical owners).
• ☐ Deliver foundation training for all staff who use AI.
• ☐ Deliver role-specific training for higher-impact uses.
• ☐ Publish an AI use policy and make it easy to find.
• ☐ Record who completed which training and when.
• ☐ Provide a channel for questions and incident reports.
• ☐ Refresh training when tools, uses or rules change, and at least annually.
• ☐ Review the programme with legal or compliance advisers.

Documentation tips

Keep a simple register: system, owner, user roles, training provided, completion dates, and review date. If asked how your organisation meets its AI-literacy duty, that register — plus training materials and the policy — is your evidence.

Proportionality

A ten-person marketing agency using a general-purpose assistant does not need the same programme as a hospital deploying AI in triage. Scale effort to risk and role.

How we can help

Our team training includes a foundation module mapped to the topics above, role-specific workshops, and completion records you can keep for your register. You can also check your starting point with the free team AI readiness check.