Answer in brief
AI literacy is the skill, knowledge and understanding needed to use AI systems with informed judgment: how a model produces answers, why it confabulates, how to direct and check it, which data stays out and who answers for the result. Under Article 4 of the EU AI Act, providers and deployers, including firms outside the EU whose AI output is used there, must take measures to build it in their staff; national enforcement starts on 2 August 2026.
AI literacy as the law and the frameworks define it
AI literacy is the working competence to use AI systems with judgment: knowing how they produce answers, where they fail, what must not go in and who answers for the result. The EU AI Act puts it in Article 3(56) as the skills, knowledge and understanding needed to deploy AI systems in an informed way and to be aware of their opportunities, risks and possible harm. Nothing in that definition asks for maths, coding or a degree.
The US Department of Labor reached a similar place from the job market. Its framework, issued on 13 February 2026 as Training and Employment Notice 07-25, calls the competence a foundational set of skills to use and evaluate AI responsibly, focused on generative AI. It names five content areas: understand AI principles, explore AI uses, direct AI effectively, evaluate AI outputs and use AI responsibly.
For schools, UNESCO published competency frameworks for students and teachers in September 2024; the student one rests on a human-centred mindset, the ethics of AI, AI techniques and applications, and AI system design. The European Commission and the OECD finalised their AILit Framework on 18 June 2026, with four domains: engage with, create with, manage and shape AI. Its view of AI literacy for students includes deciding when not to use AI.
Article 4 of the EU AI Act: the duty placed on employers
Article 4 turned a skill into an obligation. In the Official Journal text on EUR-Lex, providers and deployers had to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and others operating AI on their behalf. It sits in Chapter I, which applies from 2 February 2025 under Article 113. A deployer, in Article 3(4), is anyone using an AI system under its authority outside purely personal, non-professional use.
The wording has since softened. The European Commission's Questions and Answers on Article 4 say the Digital Omnibus on AI entered into force in mid-July 2026: the obligation stays, but no specific or sufficient level is mandated, and nobody must guarantee a level for any individual. National market surveillance authorities supervise and enforce it from 2 August 2026, with penalties set in national law. A case becomes more likely, the Commission notes, when an incident shows staff lacked training.
The same page clears up common assumptions. No certificate is required; organisations can keep an internal record of trainings and guidance. No AI officer is mandated and nobody's knowledge has to be measured. Contractors, service providers and even clients working under the organisation's remit can be covered. A firm whose employees write adverts or translate with a general chatbot is in scope, and staff should hear about risks such as hallucination.
Small companies outside the EU that serve EU customers
Article 2(1) reaches providers placing AI systems on the EU market wherever they are based, and providers and deployers in a third country whose AI output is used in the Union. The Commission's Q&A confirms this reach applies to Article 4 too. Picture a studio in Dubai or Austin drafting product texts with a chatbot for a shop in Germany: the text is used in the Union.
The answer depends on facts no article can see. The narrow reading of the sources is that the duty is to take measures, not to reach a score, and that effort should grow with risk. In the United States the Labor Department framework is a resource for designing training; the UK, the Gulf states and others have their own rules, not covered here. Check your case with a lawyer who knows both systems.
How a language model writes an answer and why it confabulates
NIST, the US standards institute, explains the mechanism in its Generative AI Profile of July 2024, NIST AI 600-1. A generative model approximates the statistical distribution of its training data; a large language model predicts the next token or word. The same statistics can give a fluent, wrong answer, which NIST calls confabulation, colloquially hallucination. The risk grows with open-ended prompts for long answers and in fields that need deep expertise.
Ask a chatbot for three studies that support a claim, with references. It often returns three items in a perfect format: the format is easy to predict, the facts are not. Some may exist, some may carry the wrong year, some may be invented. Fluency is not evidence, so any name, number, quote or reference that will leave your desk is looked up in the original first.
Prompting and checking claims as two halves of one skill
The Labor Department treats directing AI as a skill that needs a mental model, not coding: give context, audience, tone and goal, ask for steps and a format, supply the material instead of hoping the model knows it, and iterate. A weak request says: write a post about our service. A workable one names the reader, the offer, the length and the facts, and ends with a test: no figures except those in the attached price sheet.
Evaluation is the other half: cross-check factual claims against trusted sources, look for missing steps and faulty logic, judge fitness for purpose, and remember that the worker stays responsible. NIST adds a warning about automation bias and over-reliance on a confident machine. In practice: mark each claim, find its source, delete what fails, note what you checked. The stakes set the depth: an internal email needs a read, a contract clause or a client figure needs a source you opened yourself.
Data privacy, bias and copyright before you paste anything
What not to paste is the cheapest lesson. NIST notes that models can leak, generate or infer sensitive information about individuals; the Labor Department asks workers to know which data should never be entered. A workable default: no client personal data, health or financial details, passwords, keys or unpublished contracts in a public chatbot unless a tool is approved for them in writing. Data protection law differs by country, so name the rules that apply to your clients.
Bias is quieter. NIST lists harmful bias among the main risks of generative AI, including performance gaps between groups or languages, possibly caused by unrepresentative training data. In a small team it looks like job adverts in a gendered voice or a complaint in Arabic handled less well than one in English. Test the same task in every language you serve.
Copyright differs by country. The US Copyright Office concluded in Part 2 of its AI report, released on 29 January 2025, that outputs can be protected only where a human author has determined sufficient expressive elements; prompts alone are not enough, while creative arrangement or modification by a person can qualify. Check local law before promising a client exclusive rights to a generated logo. Sometimes the competent choice is no AI at all: when facts cannot be checked or data may not be shared.
A one-hour self-assessment and a plan for a team of five
You can test yourself in an hour with one chatbot your company allows. For fifteen minutes, write down how it produces an answer and when it is likely to invent one. For fifteen more, run one real task with a vague prompt, then with context, format and constraints. Spend twenty minutes checking every claim in the better answer against original sources and count what survived. In the last ten, review what data you pasted and whether you should have.
In a team of five, give each person a role rather than the same video course. The owner writes a one-page AI use policy: approved tools, forbidden data, tasks that need a human check, who signs off client text, where the training record lives. Two people who write for clients practise prompting and verification on real briefs. The person on finance learns the data rules. The fifth keeps a shared library of prompts that worked and answers that failed.
The policy page needs examples, not adjectives. Allowed: drafting a newsletter, then checking every fact. Allowed with care: translating a client message, then having a fluent speaker read it. Not allowed: pasting a passport scan or a customer list into a public chatbot, or publishing a statistic the tool supplied without a source. Date the page, record who read it, and review it every quarter. That is the kind of internal record the Commission mentions.
What to practise alone and what a structured AI course adds
Most of this can be practised alone: run the one-hour test, write your list of forbidden data, log every claim you check for five working days, and turn your three most frequent prompts into templates with acceptance criteria. The Labor Department puts hands-on learning first among its seven delivery principles. The Commission's living repository of more than 40 examples from companies and the public sector is free.
A structured course adds sequence, feedback and artefacts you keep. The Artificial Intelligence course of VITON13 SCHOOL has seven modules: working with AI deliberately, prompting as engineering, research and verification, automating processes, AI agents, your own systems, and safety and responsibility with data, confidentiality, copyright and honest limits. Learners build a prompt library, a process map with automation points, a working agent and a verification protocol used before publishing. The course page carries the current terms.
Practical checklist
- Write down every AI tool your team uses and whether you provide it, deploy it, or both.
- Publish a one-page AI use policy with allowed, careful and forbidden examples, dated and signed off.
- List the data that never goes into a public chatbot: client records, health, finance, keys, contracts.
- Adopt a verification rule: every name, figure, quote and reference is checked in the original source.
- Keep a simple record of who practised what and when, and review the policy every quarter.
Questions and answers
Do employees need an AI literacy certificate under the EU AI Act?
No. The European Commission's Q&A on Article 4 says there is no need for a certificate. An organisation can keep its own record of trainings and other guidance it gave staff, which is a simple way to show a national authority what measures were taken.
Does the EU duty apply if staff only use a general chatbot for ads or translation?
According to the Commission, yes. Its Q&A answers that a company whose employees use such a tool to write advertising text or translate must comply, and that staff should be informed about specific risks, hallucination being the example it gives.
From when can national authorities enforce Article 4 of the AI Act?
The obligation itself has applied since 2 February 2025. Supervision and enforcement by national market surveillance authorities apply from 2 August 2026, with penalties based on national laws. The Commission says sanctions must be proportionate to the individual case, its gravity and whether it was intentional or negligent.
How can a US employer use the Labor Department's AI literacy framework?
As a map for internal training. The Department issued it as a resource for programme design and suggests employers review workflows where AI is emerging, decide what level each role needs, encourage hands-on practice on common tasks and give staff clear internal guidance on appropriate use.
What belongs on a small company's AI use policy page?
The approved tools, the data that must never be entered, the tasks that always need a human check, who signs off client-facing text, and concrete allowed and forbidden examples. Add the date, who read it and when the team last practised, then review it every few months as tools change.