The term has gained importance through the EU AI Act. The regulation describes AI literacy as skills, knowledge and understanding that allow a competent use of AI systems and create awareness of opportunities, risks and possible harm. Regardless of the legal situation, AI literacy is a practical prerequisite: only those who understand how AI arrives at its results can use it sensibly and recognize errors.
Art. 4 of the AI Act has applied since February 2, 2025. In its original version, it obliged providers and deployers of AI systems to take measures to ensure, to their best extent, that their staff have a sufficient level of AI literacy. The Digital Omnibus Regulation on AI, Regulation (EU) 2026/1744, rewrote the article. It entered into force on July 27, 2026.
What Art. 4 requires today
As of October 25, 2026, under Art. 4 as amended by Regulation (EU) 2026/1744:
- Providers and deployers of AI systems take measures to support the development of AI literacy among their staff. This also applies to other persons who operate and use AI systems on their behalf.
- Technical knowledge, experience, education and training, the context of use and the persons on whom the AI systems are used must be taken into account.
- It is explicitly not required to guarantee a specific level of AI literacy for any individual.
- The Commission and the member states support providers and deployers, in particular SMEs. The Commission publishes practical examples for this on its central information platform.
The obligation therefore remains, but it is worded as an obligation to take measures and not as an obligation to achieve a specific result. The regulation still does not prescribe a specific format or certificate.
What AI literacy includes
- Basic understanding: how generative AI produces text and why answers can sound convincing but be wrong (hallucination).
- Handling data: which information may be entered into which tools and what data protection requires.
- Security risks: for example manipulated content and prompt injection.
- Critical review: checking results, verifying sources and not handing responsibility over to the machine.
- Internal rules: approved tools, policies and contact persons.
According to the regulation, which measures fit depends on prior knowledge, experience, training and the context of use, among other things. Management needs different knowledge than a team that uses AI in customer service, and IT in turn needs different knowledge than accounting.
Typical examples
- Basic training for all employees who use chat assistants or Microsoft Copilot, supplemented by a short guide.
- In-depth workshops for higher-risk areas, such as HR or customer communication.
- Digital learning paths that are refreshed when new tools or features arrive.
What companies should keep in mind
- Determine needs per role instead of giving everyone the same training.
- Document measures in a traceable way, for example content, participation and date.
- Update content regularly, because AI tools change quickly.
- Link AI literacy with AI governance and internal policies.
- Follow legal developments, as details of the AI Act are adjusted at EU level, most recently by the 2026 Digital Omnibus.
How it differs
Security awareness aims to recognize attacks such as phishing. AI literacy concerns the competent use of AI. The two topics overlap and can easily be trained together.
How TOMORIS relates
TOMORIS UNIVERSITY offers training, awareness formats and learning paths, including on the topic of AI.
This entry is a general overview and does not replace legal advice.