What Is AI Literacy? A Guide for Companies, Including EU AI Act Article 4 (2026)

When I walk into a corporate training session, my first question is: "How many people in this room use AI in their work?" Most hands go up. Then I ask the second one: "When and how do you notice that the answer your tool gave you is wrong?" Most hands come down. The gap between those two questions is what this article is about: AI literacy. Opening a tool is easy; using it deliberately and safely, and checking what it produces, is a different skill. Here I explain what AI literacy means, what the EU AI Act expects on the topic, and how I build an AI literacy program inside a company.

What is AI literacy?

AI literacy is the ability to understand what AI tools can and cannot do, to use them appropriately in your own work, to verify what they produce and to recognize the risks that come with using them (data privacy, fabricated information, copyright and bias). It does not require coding or knowing how models are built. Like reading and writing, it is a baseline competence everyone needs in their own role.

The EU AI Act frames the concept in a similar way: the skills, knowledge and understanding needed to use AI systems in an informed way and to be aware of their opportunities, their risks and the harm they can cause.

AI literacy is not the same as prompting skill

The most common misconception I see in companies is equating AI literacy with writing good prompts. Prompt engineering is a valuable skill, but it is only one part of literacy. An employee who writes excellent prompts but pastes customer data into a public tool is not AI literate. Neither is a team that produces a polished report draft and misses the made-up figure inside it. Literacy combines the ability to use the tool with the habits of verification and responsibility.

The four components of AI literacy

When I design training programs, I break AI literacy into four components. Knowing which component an employee lacks tells you where the training should go.

In practice, the weakest component is usually verification. People learn to use the tools quickly, but learning when not to trust the output takes structured practice.

What does the EU AI Act say about AI literacy?

Article 4 of the EU AI Act requires organizations that develop AI systems (providers) and organizations that use them (deployers) to take AI literacy measures for their staff and for other people operating those systems on their behalf. The article has applied since 2 February 2025. The simplification package (the Digital Omnibus) that entered into force in July 2026 did not remove it but softened it: companies are no longer expected to guarantee a specific level of AI literacy for each person, but to take measures that support it. Three points are worth noting:

• No specific format is required: The article does not prescribe a single training course, exam or certificate. Measures are expected to be proportionate to people's technical knowledge, experience and education, and to the context in which the systems are used.
• Keep your own evidence: Supervision sits with national authorities. Keeping a written record of who received which training and which tools are used under which rules is your strongest footing if questions are ever asked.
• It can reach companies outside the EU: The Act can apply to companies that offer products or services on the EU market or provide AI systems to users in the EU.

This section is not legal advice. Check the exact post-simplification wording in the EU Official Journal, and ask your legal counsel whether your company is in scope. My job is to make sure the team is genuinely competent, whatever the precise wording of the rule.

Should every employee get the same training? Role-based AI literacy

Giving the whole company the same training wastes time and has little effect. I layer the program across four role groups:

For the manager level, my AI guide for managers is a good starting point, and HR teams can start with AI for HR teams, which also covers writing an internal policy.

How to build an AI literacy program in 5 steps

1. Map current usage. Which team uses which tool, for which task? Include the accounts people opened on their own, not only official licenses. Without this inventory, both risk and training needs remain guesswork.
2. Match roles to levels. Adapt the four groups above to your organization and write one sentence per role: "this person should be able to do X."
3. Put the rules in writing. Approved tools, data types that must never be shared, outputs that require human review. Training is how you teach the policy, so the policy has to exist first.
4. Train on real work. Generic presentations are forgotten. When each team works on its own files, reports and customer messages, the using and verifying components improve together. That is why my AI literacy training is built on the team's own workflows.
5. Record and refresh. Keep one place that shows who took which training and when, which tools were introduced and when the rules were last updated. Tools change within months, so AI literacy is not a one-off course but a competence you refresh regularly.

What are the most common mistakes in AI literacy programs?

• A one-off awareness talk: A one-hour general session does not change how anyone works, and it is weak as a training record.
• Tool training only: Training that walks through menus and features leaves verification and responsibility untouched.
• Managing by ban: Banning tools outright does not stop usage; it moves it to accounts nobody can see. Offering an approved path is safer.
• Skipping managers: When a team is trained but its manager does not know how to evaluate the output, new habits fade quickly.

Where to start

My advice is to start small: first the inventory, then hands-on training for the team that uses AI most, then a company-wide rollout built on that experience. If you would like to map your team's current level and priorities together, we can build this plan around your organization through my consulting work.