Guide · Governance, policy and return on investment
What is AI literacy? What it looks like at work, and what EU Article 4 asks
AI literacy is the knowledge, skills and judgement to use AI tools well and safely: knowing roughly how they work, what they get wrong, what information is safe to share, and how to check their output in proportion to the stakes. At work, it shows in what people do, not in how much they use AI.
By Andrew Ward, Founder of ScorchsoftChecked 11 minute read
In short
- AI literacy is practical judgement, not technical knowledge: what AI is good and bad at, what to keep out of it, and how hard to check what it produces.
- You can see it in behaviour: people check before they send, keep private data out of unapproved tools and say what AI did in their work.
- Article 4 of the EU AI Act, as amended in July 2026, asks providers and deployers to take measures to support their staff’s AI literacy. It may apply to a UK organisation with EU operations or output.
- No certificate is needed under Article 4, and no specific level is required. A record of what you did is sensible.
- Start small: three safe habits for everyone, then training matched to each role and the tools it uses.
Written for: Managers, HR and learning leads, and owners of UK organisations who want their staff to use AI well, including those with EU staff, customers or output.
What is AI literacy?
AI literacy is enough understanding of AI to use it sensibly in your own work and life: what it can and can’t do, where it goes wrong, what it does with your information, and when a person must stay in charge of the result.
The phrase is used in schools, in public policy and in law, so definitions vary. Most share three parts: knowing roughly how AI tools work, being able to use them for real tasks, and judging their output critically, including its risks to other people. For most workers, the third part matters most. You don’t need to know how a model is trained to notice that a confident answer cites a source that doesn’t exist.
The EU AI Act has a legal definition. Its Article 3(56) says AI literacy “means skills, knowledge and understanding that allow providers, deployers and affected persons… to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause.” A provider makes or supplies an AI system; a deployer is any organisation that uses one at work.
Also called
AI skills, AI fluency, AI competence, AI awareness training, generative AI literacy.
What does AI literacy look like at work?
At work, AI literacy looks like a set of habits: checking work before it goes out, keeping private information out of the wrong tools, briefing AI clearly, and passing on conclusions rather than piles of unread output. You can see each habit, which makes it easier to build and to check.
The AI Stairway™, Scorchsoft’s course on AI at work, is built around a set of shifts in what people do. They are one way to describe AI literacy in behaviour, not a standard. The table shows six of them, with how you might notice each one.
| The habit | What you see | Taught in |
|---|---|---|
| The judgement stays yours | People use AI for the task and keep the outcome. They check in proportion to the stakes and never send what they haven’t read. Fewer “the AI said so” errors. | Module 2 |
| Safe by default | People know the tramlines (what never goes in, what needs care), check which account they are in, and say the same day when something went out wrong. | Module 1 |
| A clear brief and a definition of good | People brief AI like a capable colleague, say what good looks like, and can tell good work from slop. | Module 4 |
| Value, not volume | People pass up the conclusion, not the pile: they don’t forward AI output they haven’t judged. | Module 4 |
| Write it down once | A good chat becomes a shared skill with checks built in, an owner and a review date. | Module 6 |
| Systemise what matters | People know a prompt can ask but only code or a process check can make sure, and they test an idea before anyone scales it. | Modules 9 and 10 |
Two ideas sit under all six. AI’s abilities are uneven: it can be strong at one task and weak at a similar-looking one, which researchers call the jagged frontier, so people check rather than assume. And people stay accountable: AI touches tasks, people carry outcomes.
Darren, a payroll senior at a 40-person accountancy practice, asks an approved AI tool to summarise a client’s pension contribution changes. The summary reads well. Because it is about a client’s money, the top rung of the stakes ladder, he checks every figure against the source and finds one month transposed. He corrects it, tells his manager what AI did and what he checked, and adds a “check each figure against the payslip” step to the team’s shared skill. That is AI literacy: not avoiding the tool, and not trusting it blindly.
What does Article 4 of the EU AI Act say now?
Article 4 has applied since 2 February 2025. The Digital Omnibus on AI, in force since 27 July 2026, replaced its wording: providers and deployers must now take measures to support their staff’s AI literacy, and no specific level of literacy is required of any individual.
The EU AI Act is Regulation (EU) 2024/1689 (opens in a new tab). Its Article 4 originally required organisations to ensure a sufficient level of AI literacy among their staff. Regulation (EU) 2026/1744 (opens in a new tab), known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and came into force on 27 July 2026. It replaced Article 4. Paragraph 1 now reads:
Article 4(1), as replaced by Regulation (EU) 2026/1744 (checked 29 October 2026)
“Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”
- No set level. The next sentence says the duty doesn’t make providers or deployers answerable for any individual reaching a specific level of AI literacy.
- Support for smaller firms. A new Article 4(2) says the Commission and Member States shall support providers and deployers, “in particular SMEs”, and that the Commission will publish practical examples of how to meet the duty.
- Recommendations to come. Article 4(3) asks the European AI Board to adopt recommendations, drawing on European competence frameworks.
Many pages still quote the old “sufficient level” wording. If you read a guide that does, it predates July 2026.
Does Article 4 apply to a UK organisation?
It may. The AI Act reaches deployers established in the EU, and providers and deployers outside it where the output of their AI system is used in the EU. A UK firm with an EU office, EU staff using AI, or AI output used in the EU should check; a UK-only firm is unlikely to be covered.
Article 2(1) of the Act sets its scope. It applies to deployers “that have their place of establishment or are located within the Union”, and to providers and deployers in a third country, such as the UK, “where the output produced by the AI system is used in the Union”. The European Commission’s AI literacy questions and answers (opens in a new tab) (last updated 20 October 2026) reads this broadly, saying the framework applies inside and outside the EU where an AI system is used in the Union “or its use has an impact on people located in the EU”.
- Likely to need a closer look: a UK firm with an EU subsidiary or office; staff based in the EU who use AI for work; AI-drafted reports, translations or decisions delivered to EU clients.
- Less likely: a firm whose staff, customers and output are all in the UK.
- Unclear: occasional EU customers, or AI used only internally on EU-related work. Ask a qualified adviser.
The UK has no AI Act, and we found no UK law that sets an AI literacy duty like Article 4 (checked 29 October 2026). Existing UK law still matters: data protection law applies whenever personal data goes into an AI tool. Our AI governance guide sets out the UK position.
What counts as taking measures under Article 4?
The Commission says there is no one-size-fits-all approach, no certificate is needed, and no particular governance structure is required. Measures should fit each person’s role, the tools they use and the people affected. Keeping an internal record of what you did is sensible.
The Commission’s questions and answers give practical pointers. They are guidance, not law, and can change.
- “There is no need for a certificate.” Organisations can keep an internal record of training and other guidance.
- No specific governance structure, such as an AI officer or board, is required by Article 4.
- Staff using a general chat assistant to write or translate text “should be informed about the specific risks, for example hallucination”.
- Simply relying on a tool’s instructions for use, or asking staff to read them, “might be ineffective”.
- As a minimum, the Commission suggests: build a general understanding of AI in the organisation; work out whether you are a provider or a deployer; consider the risks of the AI systems you use; and tailor measures to people’s knowledge and the context.
- Deployers of high-risk systems will have a separate duty, in Article 26, to give the people overseeing those systems “the necessary competence, training and authority”. As amended, it applies from 2 December 2027 for most high-risk systems (those in Annex III) and from 2 August 2028 for the rest.
Not a reason to panic-buy training
Article 4 doesn’t require any particular course, and no course makes an organisation meet it by itself. Choose training because it changes how people work, and keep a short note of what you did and why.
How do we build AI literacy in a small organisation?
Find out who uses which tools, give everyone three safe habits first, then add training matched to each role. Keep a one-page record and look again in 90 days. A manager can start all of this this week.
Step 1: Map who uses what (owner: the person leading on AI)
Ask anonymously which AI tools people use, for which tasks, on which account. You can’t support literacy for use you don’t know about. Our guide to shadow AI covers how to ask without blame.
Step 2: Three habits for everyone (owner: each manager)
The three-second check before pasting anything in (which account, would it be fine read out in a meeting, can the tool act or only answer); the tramlines; and checking in proportion to the stakes.
Step 3: Match training to roles (owner: HR or learning lead)
Someone using a chat assistant for drafting needs different skills from someone connecting AI to email or records, or reviewing AI-assisted decisions about people. Think about who is affected by each use, as Article 4 itself asks.
Step 4: Keep a short record (owner: HR or learning lead)
Who was trained or briefed, on what, when, and what you plan next. One page is enough to start.
Step 5: Review in 90 days (owner: the person leading on AI)
Look for behaviour, not hours: are people checking before they send, keeping red information out, and saying what AI did? Adjust the plan, and record the review.
Literacy works best inside clear rules. Our AI policy template includes a training section, the AI readiness assessment helps you see where to start, and the AI maturity model guide shows how skills and rules grow together.
How can we tell whether AI literacy is improving?
Watch what people do with AI, not how much they use it. Fewer unchecked errors, fewer near-misses with private data, clearer briefs and more people saying what AI did are better signs than logins, prompts or hours of training completed.
Usage figures are tempting because they are easy to collect, but they measure activity, not judgement. Someone who uses AI twice a week and checks everything may be more literate than someone who uses it all day and forwards the results unread. Don’t rank people by how much AI they use, and don’t use training scores or course data to judge individuals.
Signs to look for after 90 days
- Work that goes out has been read and checked by the person who sends it
- Reports of AI mistakes arrive early and without blame
- Red information stays out of unapproved tools
- Shared prompts and skills have an owner and a review date
- People can say, for their own role, what AI is good at and where it lets them down
Questions people ask
Is AI literacy training a legal requirement in the UK?
We found no general UK law that requires it, as of 29 October 2026. Article 4 of the EU AI Act asks providers and deployers to take measures to support AI literacy, and it may apply to a UK organisation with EU operations, staff or output. Take advice if you are unsure.
Did the Digital Omnibus remove Article 4?
No. Regulation (EU) 2026/1744 replaced its wording. The duty remains, but it is now to take measures to support AI literacy, without a required level for any individual, and with support promised for smaller firms.
Do we need an AI literacy certificate?
No. The European Commission says there is no need for a certificate under Article 4. An internal record of the training and guidance you provided is a sensible way to show what you did.
What is the difference between AI literacy and AI training?
AI literacy is the outcome: people who use AI with sound judgement. Training is one way to get there, alongside clear rules, examples, shared skills and managers who make it safe to say what went wrong.
Who needs AI literacy in an organisation?
Everyone who uses AI tools or relies on their output, with more depth for people who connect AI to systems, approve its use or review decisions it informs. Article 4 also covers other people using AI on the organisation’s behalf; the Commission says this could be, for example, a contractor or service provider.
Training for the whole team
The AI Stairway™ gives everyone the same careful habits, then helps your team agree its rules and test one AI idea properly. Everyone can start with the free introductory module.
AI training for teamsSources
Every figure on this page comes from one of these. Links open in a new tab.
- Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 (Digital Omnibus on AI), Article 1(5) replacing Article 4 (opens in a new tab). Official Journal of the European Union (EUR-Lex), 24 July 2026; in force 27 July 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 2, 3(56) and 113 (opens in a new tab). Official Journal of the European Union (EUR-Lex), 12 July 2024.
- AI literacy: questions and answers (opens in a new tab). European Commission, last updated 20 October 2026.
- A pro-innovation approach to AI regulation: government response (opens in a new tab). Department for Science, Innovation and Technology, GOV.UK, 6 February 2024.
- Navigating the Jagged Technological Frontier: Field Experimental Evidence of the Effects of Artificial Intelligence on Knowledge Worker Productivity and Quality (opens in a new tab). Dell’Acqua, McFowland, Mollick and others, Organization Science 37(2), INFORMS, March 2026 (first circulated as a Harvard Business School working paper, 2023).
Keep going
Related guides
- AI governance for small and mid-sized organisations: a simple framework
- AI policy template: what to include and how to write yours
- AI readiness assessment: a 12-question self-check for your organisation
- AI maturity models: what they are, and how to use one honestly
- Shadow AI: why staff use unapproved AI tools, and what to do about it