AI literacy

This definition closely follows the legal definition in the EU AI Act, which for the first time anchors AI literacy as a binding requirement across Europe.

For companies, AI literacy is therefore no longer a “nice to have” of further training, but a basic organisational prerequisite: anyone who develops, buys or uses AI systems in their day-to-day work must take measures so that the people involved know what they are dealing with. It is precisely this combination of individual ability and organisational obligation that makes the term so relevant.

The term has gained considerable weight in a short time because generative AI, i.e. language models, image generators and assistant systems, has gone from a specialist tool to an everyday instrument in almost every department within a few years. With this spread, responsibility grows: a tool that delivers convincingly worded but potentially incorrect results is only as good as the judgement of the person using it. AI literacy is exactly this judgement, built up systematically instead of being left to chance.

Legal anchor: Article 4 of the EU AI Act

The central legal reference point is Article 4 of the AI Act (Regulation (EU) 2024/1689, the EU AI Act for short). This provision obliges both providers and deployers of AI systems. In the version applicable since 27 July 2026, paragraph 1 reads: “Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”

This version comes from the Digital Omnibus on AI, Regulation (EU) 2026/1744. It was published in the Official Journal of the EU on 24 July 2026 and has been in force since 27 July 2026, so it is applicable law and no longer a proposal. Previously, Article 4 required providers and deployers to take measures to ensure, “to their best extent”, a “sufficient level” of AI literacy of their staff. Today, it is about supporting the development of AI literacy. Companies do not have to guarantee a specific level. Two paragraphs are also new: the Commission and the Member States support providers and deployers, in particular SMEs, in fulfilling the obligation, and the Commission publishes practical examples on a central information platform for this purpose. The AI Board adopts recommendations to promote AI literacy. The obligation itself remains in place.

A few key points you should know about Article 4:

• Applicable since 2 February 2025. The AI literacy obligation is one of the first provisions of the EU AI Act to become applicable, well before most of the Regulation’s other obligations. Since 27 July 2026, it has applied in the amended version quoted above.
• Independent of the risk class. The requirement applies to every AI system that a company provides or deploys, not only to high-risk systems. Even if you “only” use a standard chatbot in customer service, you fall under Article 4.
• No mandatory training format. According to the European Commission’s questions and answers on AI literacy, there is no one-size-fits-all approach, no strict requirements and no mandatory training; a certificate is not needed. Companies choose the appropriate measures themselves, from internal workshops and e-learning to onboarding based on a specific use case, and can document them internally.
• No fine tier in the Regulation itself. The ranges of fines in Article 99 of the AI Act do not list Article 4. However, Member States must lay down penalties and other enforcement measures for any infringement of the Regulation, which may also include administrative fines (Article 99(1)). According to the Commission’s questions and answers, national market surveillance authorities could sanction infringements of Article 4 on the basis of national law. There is also an indirect risk: if demonstrable AI literacy is lacking, this can have an aggravating effect in other infringements, in liability issues or in official inspections.
• Documentation recommended. Even though no particular format is prescribed, it is advisable to document the measures taken in a traceable way: who was trained on which content and when.

You can find the wording of the amended version at the European Commission’s AI Act Service Desk and in edited form at artificialintelligenceact.eu/article/4; the legally binding text is that of Regulation (EU) 2024/1689 in EUR-Lex in conjunction with the amending Regulation (EU) 2026/1744.

The three levels of AI literacy

AI literacy is not a single field of knowledge but is made up of several levels that build on one another. In practice, a division into three areas has proven useful, which together result in a sound understanding.

1. Basic technical understanding

This level is about the question: how does an AI system work at its core, and what can it realistically do? This includes a basic understanding that a large language model does not “understand” texts but generates statistically probable sequences of words. This leads directly to the most important phenomenon that every user should know: hallucinations, i.e. answers that sound plausible but are factually wrong or made up. Anyone who does not know this adopts AI outputs without checking them and produces errors.

Basic technical understanding also includes prompting: the ability to give a system clear, context-rich instructions and to steer the quality of the answer by asking better questions. It also includes a sense of what a particular model is suitable for and what it is not: an image generator is not a fact-finding tool, and a chatbot is not reliable legal advice.

2. Legal and organisational framework

The second level concerns the rules within which AI may be used in the company. These include above all:

• Data protection: Which data may be entered into which system? Personal data, trade secrets or customer data do not belong in a public AI tool without being checked.
• Approvals and responsibility: Who decides whether an AI-assisted output is used? Responsibility for a result remains with the human, not with the model.
• Compliance and documentation: Which internal guidelines apply, and how is use made traceable?

This level translates abstract requirements, for example from the GDPR and the EU AI Act, into concrete guard rails for everyday work. It ensures that technical possibilities do not lead into legal or ethical traps.

3. Depth of application in the specific use case

The third level is the most specific: knowing how to use AI sensibly and responsibly in your own area of work. A person in customer service needs a different competence profile from someone in software development or marketing. Here, basic technical understanding and the legal framework combine with the specialist knowledge of the respective role, for example the question of when an AI-generated customer reply must be checked before it is sent or how an AI suggestion should be handled in a code review.

Only the interplay of all three levels results in the AI literacy that Article 4 of the EU AI Act has in mind. A purely technical understanding without a legal framework is just as incomplete as pure policy training without practical application knowledge.

How it differs from related terms

AI literacy is often confused with neighbouring concepts. The following overview classifies the most important terms.

In short: digital literacy is the framework, data literacy an important building block, and AI literacy the specialised ability that has gained independent significance through the rise of generative AI and through the EU AI Act.

How companies build AI literacy

Building AI literacy is less a one-off training event than an ongoing process. In practice, a four-step approach has proven effective:

1. Inventory. First, you clarify where AI is already being used in the company (often more than expected, including “shadow AI” used on people’s own initiative), which roles come into contact with it and what prior knowledge exists. This results in the actual competence requirement per role.
2. Training based on the use case. Instead of generic AI slides, role-specific, practical formats are more effective: what does responsible use of AI mean in concrete terms for sales, for development, for marketing? Real examples and your own tools beat abstract theory.
3. Measure. Competence that is not checked remains an assumption. Short knowledge checks, case examples or observation in everyday work show whether the measures are working and where they need to be sharpened.
4. Document. Record who was trained on which content and when. This is not only sensible governance, but also the pragmatic way to fulfil the requirements of Article 4 of the EU AI Act in a demonstrable way.

Many SMEs get support for this: as an AI agency, we provide support from the inventory and training through to the AI policy.

Because AI systems evolve quickly, AI literacy is not a state that you achieve once and then tick off. A recurring rhythm makes sense: regular refreshers, updates when new tools arrive and a clear point of contact for questions from the team. This is exactly the path we support in our AI consulting, from process analysis and training to the implementation of the first use cases.

Real-world example and practical relevance

A concrete reference point from practice: since Article 4 of the EU AI Act became applicable in February 2025, industry associations and studies have shown a significantly increased need for AI training. The German digital association Bitkom, for example, regularly points out in its surveys on AI use in German companies that the spread of generative AI in everyday work is growing faster than the development of structured competence for it, a gap that Article 4 now addresses. A typical use case: a medium-sized company introduces an AI-supported chatbot in customer service. As a deployer within the meaning of the EU AI Act, it must take measures so that the service staff understand how the chatbot generates answers, when they need to intervene and which data they must not entrust to it. That is exactly AI literacy in action.

This example also illustrates why AI literacy must be thought of in a role-specific way: the manager who decides on the introduction of the chatbot above all needs an understanding of liability, data protection and the selection of a suitable provider. The employees in day-to-day operations, on the other hand, need practical knowledge about borderline cases and escalation paths. Both groups have AI literacy, but different forms of it. A well-thought-out competence concept reflects these differences instead of sending all employees through the same generic training.

Frequently asked questions about AI literacy

What does AI literacy mean in simple terms?

AI literacy is the ability to use AI systems in an informed way: to understand how they work, what they can do and where their limits lie, and to realistically assess the opportunities and risks of using them. It combines technical, legal and application-related knowledge.

Is AI literacy mandatory for companies?

Yes. Since 2 February 2025, Article 4 of the EU AI Act (Regulation (EU) 2024/1689) has obliged providers and deployers of AI systems to take measures on the AI literacy of their staff. Since the Digital Omnibus on AI, in force since 27 July 2026, the obligation has been to support the development of AI literacy; companies do not have to guarantee a specific level of literacy. The obligation applies regardless of the system’s risk class.

Which training format does the EU AI Act prescribe?

None. According to the European Commission’s questions and answers on AI literacy, there is no one-size-fits-all approach and no mandatory training, and a certificate is not needed. Companies choose suitable measures themselves and can keep an internal record of their training and other measures.

Are there fines if AI literacy is lacking?

The AI Act does not itself set a range of fines for Article 4; the fine tiers in Article 99 do not list it. However, Member States must lay down penalties for any infringement of the Regulation, which may also include administrative fines (Article 99(1)). According to the European Commission, national market surveillance authorities could sanction infringements of Article 4 on the basis of national law. In addition, a lack of AI literacy can have an aggravating effect in other infringements, in liability issues or in official inspections.

How does AI literacy differ from digital literacy?

Digital literacy is the broader umbrella term for confident handling of digital tools in general. AI literacy is a specialised subset that focuses specifically on understanding and using AI systems responsibly.