AI literacy at work: what it means and how to build it

AI literacy has moved from a nice idea to a workplace expectation. In the EU it is now a legal duty for organizations that build or use AI systems, and everywhere it is the base layer of digital collar work: you cannot direct, check or answer for an AI system you do not understand. This page explains what AI literacy means, what the EU AI Act asks for, and how to build it in a team. It is a plain-language overview, not legal advice.

The short answer: AI literacy is the skills, knowledge and understanding people need to use AI systems in an informed way and to be aware of their opportunities, risks and possible harms. Since 2 February 2025, the EU AI Act has required providers and deployers of AI systems to take measures on AI literacy for their staff and others who operate or use AI on their behalf. Until 26 July 2026 the duty was to take measures to ensure, to their best extent, a sufficient level of AI literacy; since 27 July 2026 it is to take measures to support its development. The right level depends on the person's role and the system they use.

What the law says

From 2 February 2025 to 26 July 2026, Article 4 of the EU AI Act said that providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. As amended from 27 July 2026, it states that providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used (EU AI Act, Article 4).

The Act defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause (Article 3(56)).

A deployer is any person or organization using an AI system under its authority, other than for personal, non-professional activity (Article 3(4)). In practice, that covers most companies that let staff use AI tools for work.

The recitals add the purpose: AI literacy should equip providers, deployers and affected persons with the necessary notions to make informed decisions regarding AI systems (EU AI Act, Recital 20).

What the duty does and does not say

• It applies broadly. Article 4 is not limited to high-risk systems; it covers providers and deployers of AI systems in general.
• It is proportionate. The text ties the measures to people's existing knowledge and to the context of use, so a developer and an occasional user of a writing assistant need different things.
• It does not prescribe a format. The article itself names no specific course, exam or certificate. Organizations decide the measures.
• It includes people working on the organization's behalf, not only employees.
• It does not guarantee a level. Since the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force from 27 July 2026, Article 4 states that the obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual, and that the Commission and Member States must support these efforts, in particular for small and medium enterprises.

For high-risk systems there is a further, stricter rule: the people assigned to oversee them must have the necessary competence, training and authority (Article 26(2)), which applies to high-risk uses such as employment from 2 December 2027. Guidance and enforcement details continue to develop, so check current official sources before relying on any specific interpretation.

Why it matters beyond compliance

The US NIST AI Risk Management Framework, which is voluntary, also calls for processes for operator and practitioner proficiency with AI system performance and trustworthiness to be defined, assessed and documented (NIST AI RMF 1.0, MAP 3.4).

Employers feel the gap. In the OECD's 2022 surveys of employers and workers in finance and manufacturing in seven countries, two in five employers said a lack of adequate AI-related skills was a barrier to using AI at work (OECD Employment Outlook 2023). In the WEF's 2025 survey, AI and big data top the list of fastest-growing skills (WEF Future of Jobs Report 2025).

What AI literacy covers in practice

• How it works, roughly: that generative AI predicts likely output rather than looking up facts, which is why it can be fluent and wrong.
• What it is good and bad at, in your own field.
• How to check output, and when checking is required. See checking AI output.
• Data handling: what may and may not be put into an AI tool. See AI agents and personal data.
• Security basics: why untrusted content can steer an agent. See AI agent security.
• Rules and responsibility: company policy, who owns which system, and how to report a problem.
• Effects on others: how a system's output can affect customers, applicants or colleagues.

A practical plan for a team

1. List the AI systems in use, including tools staff adopted on their own.
2. Group people by role: everyday users, people who set up or run agents, people who oversee higher-risk uses, and managers who decide on adoption.
3. Set a baseline for everyone: a short session on how generative AI works, its typical errors, data rules and how to report problems.
4. Add role-specific training: deeper skills in briefing, checking and logging for those who run agents; system-specific training and authority for those who oversee high-risk uses.
5. Train on real work. Exercises using the team's own tasks stick better than generic slides.
6. Train in working time: in the EU, training an employer must provide by law or collective agreement is free for the worker and counts as working time; see who pays for AI training.
7. Keep a record of who received what and when. The article does not say how to document this, but a record helps you show what measures you took.
8. Refresh when tools, uses or rules change.