AI Literacy for Businesses: Stay Ahead and Take Action

AI literacy is the knowledge and skills people need to use AI effectively and to recognise its risks. For businesses in the EU it is also a legal duty. Article 4 of the EU AI Act requires every organisation that provides or uses AI systems to take measures that support the AI literacy of its staff.

That duty has applied since 2 February 2025, and the Digital Omnibus on AI rewrote it on 27 July 2026. This guide explains what the rule asks as of October 2026 and how to meet it in practice, role by role.

In short

• Article 4 requires measures, not a guaranteed level of knowledge. Training and guidance must fit each group’s role, tools and risks.
• Start with a shared baseline on hallucinations, bias and data privacy, then add depth for roles such as HR, customer service and developers.
• Map your AI use, set goals per role, train, record what you did and measure the results. That record is your evidence.

What is AI literacy?

AI literacy is the ability to understand, use and critically evaluate AI in your work. The EU AI Act defines it in Article 3(56) as the skills, knowledge and understanding to deploy AI in an informed way, including awareness of its opportunities, risks and possible harm.

In practice it comes down to four skills:

• Understanding: knowing that a language model predicts plausible text rather than looking up facts.
• Using: choosing the right tool for a task, giving it the right context and keeping sensitive data out.
• Evaluating: checking output for errors, invented sources and one-sided assumptions.
• Acting: knowing which rules apply, when to stop and whom to ask.

Nobody has to become an AI expert. AI literacy for organisations is the sum of these skills across every role that uses AI.

What does the EU AI Act require for AI literacy?

Article 4 requires providers and deployers of AI systems to take measures to support the AI literacy of their staff and others who use AI on their behalf, such as contractors. A deployer is any organisation using an AI system under its own authority, so almost every business whose employees use AI is covered. That includes companies outside the EU whose AI systems are used in the Union.

The Digital Omnibus changed the wording. The original text asked organisations to ensure, “to their best extent, a sufficient level of AI literacy”. The new text asks for measures that support its development and states that no specific level has to be guaranteed for any individual. The obligation itself is still binding.

What does Article 4 ask, and what not?

Most confusion sits between what the law requires and what organisations assume it requires. This overview follows Article 4 and the European Commission’s guidance:

Question	What Article 4 and the Commission say
Who must act?	Providers and deployers of AI systems
For whom?	Staff and other people who use AI on the organisation’s behalf, such as contractors
What must they do?	Take measures that support the development of AI literacy
Must every employee reach a set level?	No. The text says no specific level has to be guaranteed for any individual
Is there a required format?	No. Measures must fit people’s knowledge, the context and the people affected
Must you test employees?	No. The Commission says there is no obligation to measure knowledge
Do you need an AI officer?	No specific governance structure is required
Should you keep evidence?	Not prescribed, but the Commission suggests an internal record of training and guidance

How can you meet the AI literacy requirement?

The European Commission’s AI literacy Q&A names four questions every programme should start from:

1. What is AI, how does it work and which AI does our organisation use?
2. Are we a provider that builds AI, or a deployer that uses AI built by others?
3. Which risks come with the systems we use, and what do employees need to know to avoid them?
4. Which measures fit each group, given their knowledge, the context and the people affected?

The Commission adds that simply asking staff to read a tool’s instructions might be ineffective, and that different levels of training per group are appropriate. Even employees who only use ChatGPT for advertising copy or translations are in scope.

Which other obligations depend on AI literacy?

Article 4 rarely stands alone. Three other obligations only work if people recognise what they are dealing with:

• Prohibited practices (Article 5, since 2 February 2025). AI that infers employees’ emotions at work is banned, except for medical or safety reasons.
• Transparency (Article 50, since 2 August 2026). Chatbots must make clear that people are talking to AI, and deployers must disclose deepfakes.
• Human oversight of high-risk AI (Article 26, from 2 December 2027 for Annex III systems such as recruitment tools). Deployers must assign oversight to people with the necessary competence, training and authority.

The GDPR applies alongside all of this whenever personal data goes into an AI tool, which is why employees must be able to tell an approved business tool from a personal account.

Who enforces Article 4, and what are the penalties?

National market surveillance authorities supervise Article 4. Formally, supervision applies from August 2026, but in practice it depends on each member state designating its regulators. In the Netherlands, for example, the implementing act was in public consultation until 1 June 2026, and until it is adopted no Dutch regulator is formally designated.

The AI Act sets no fixed fine for Article 4. Penalties come from national law and must be proportionate, and according to the Commission a sanction becomes more likely when an incident traces back to poor training. The highest fines, up to €35 million or 7% of worldwide annual turnover, are reserved for prohibited practices. Our EU AI Act guide covers the full penalty structure.

Why should companies care about AI literacy?

AI literacy decides whether your AI investments pay off. In 2025, one in five EU enterprises with ten or more employees used AI, according to Eurostat. Among companies that considered AI but held back, 71% named a lack of relevant expertise, the most common barrier. For those companies, skills are the bottleneck, not software.

Without AI literacy, four things tend to go wrong:

• Legal exposure: a prohibited or high-risk use slips through because nobody recognised it.
• Reputational damage: a chatbot invents a refund policy, or a screening tool rejects candidates unfairly.
• Missed opportunities: teams avoid AI, or use it for tasks it does badly.
• Data incidents: personal or confidential data ends up in tools without a contract.

What AI knowledge do employees need?

Employees need two layers of knowledge: a shared baseline that everyone gets, and extra depth for roles where AI touches customers, candidates, money or code. The baseline is mostly about recognising three risks.

Which AI risks should every employee recognise?

• Hallucinations. Language models produce plausible text, not verified facts. They can invent figures, sources, legal provisions or policies and state them confidently. Microsoft writes that Copilot’s responses “aren’t guaranteed to be 100% factual” and asks users to review output before sending it.
• Bias. Output reflects patterns in the data a model learned from: gendered wording in a job ad, a summary that favours one side of a complaint, a ranking that prefers certain profiles. It matters most when output informs a decision about a person.
• Data privacy and confidentiality. What you type into a tool goes to its provider. OpenAI states that it does not train on ChatGPT Business and Enterprise data by default, while it does use data from services for individuals. In 2024 the Dutch Data Protection Authority reported data breaches caused by employees entering personal data into AI chatbots, including patients’ medical data.

A fourth risk follows from these three: over-reliance. Output that reads well is easy to trust, so treat every AI answer as a draft you check.

Example: answering a customer complaint with ChatGPT or Copilot

Take a common situation. A customer service employee receives an angry email about a late delivery and wants AI to draft a reply that offers compensation.

Without AI literacy, the employee pastes the full email thread into a personal chatbot account, including the customer’s name, address and order history. The prompt asks for “a friendly reply offering what our policy allows”. The tool does not know the policy, so it invents a 20% refund. The reply reads well and goes out unchanged. The result is a possible data breach and a promise nobody meant to make.

With AI literacy, the same task looks like this:

1. Use the approved tool: a business account or Microsoft 365 Copilot covered by a data processing agreement, not a personal account.
2. Share only what the task needs. The order number and the problem are enough; leave out addresses and payment details.
3. Give the source. Paste the actual compensation policy, or point Copilot to the policy document, and ask the tool to quote the clause it relies on.
4. Check every promise and fact against that source: amounts, dates and conditions.
5. Read for tone and assumptions the email does not support.
6. Send it yourself. The employee, not the tool, is responsible for what goes out.

With Copilot, watch one more thing. According to the same Microsoft documentation, it only surfaces data the user already has at least view access to. Overly broad SharePoint or Teams permissions can therefore pull an internal document, such as a margin calculation, into a draft.

Which mistakes are most common, and how do you prevent them?

The example shows the pattern. Most problems in daily AI use come from five mistakes:

Mistake	What goes wrong	How to prevent it
Personal data in a personal AI account	Data goes to a provider without a contract; a possible data breach	Approved business tool with a data processing agreement; clear rules on what may go in
Asking without giving the source	The tool fills gaps with invented facts or policies	Paste or link the source document and ask the tool to quote it
Trusting citations and links	Sources, studies or case law can be made up	Open every source before using it
Using AI output to judge people	Bias in a ranking or summary affects a real decision	Human review of the criteria; involve HR or legal for high-risk uses
Broad permissions with Copilot	Copilot surfaces files users should not see	Review SharePoint and Teams permissions before rollout

Which extra knowledge does each role need?

On top of the baseline, each group needs knowledge that fits the AI it uses and the people affected. Use this as a starting point:

Role	Extra knowledge	Typical measure
All employees	The three risks, approved tools, data rules, checking output	Baseline session plus one-page rules
Managers and team leads	Spotting unapproved AI use, approving use cases, when to escalate	Short management module
HR	AI for recruitment and selection is high-risk; GDPR limits on automated decisions	Role module before AI is used on candidates
Customer service and marketing	Customer data rules, fact-checking, disclosure under Article 50	Role module with examples from their own tools
Finance and legal	Checking figures and legal references; confidentiality of contracts	Role module plus review rules
Developers and IT	Credentials out of prompts, reviewing generated code, permissions	Technical guidelines and code review rules
Staff overseeing high-risk AI	The specific system, its limits and when to intervene	Training on that system before go-live

How can your business take action?

Turning this into a programme takes five steps, and several can run in parallel.

Step 1: Appoint an owner and determine your role

Make one person or team responsible, usually HR or L&D together with compliance and IT. Then establish your role per AI system. Most businesses are deployers that use AI built by others. A deployer can become a provider, with heavier obligations, for example by repurposing a general tool for a high-risk use such as screening candidates (Article 25).

Step 2: Map AI use, including shadow AI

You cannot train people for tools you do not know about. Combine four sources:

• Ask: a short, blame-free survey per team on which tools people use, for what and with which data.
• Check what you already pay for: admin consoles and release notes of office, CRM and video tools, where AI features arrive through updates.
• Check access: the app list in your identity platform, installed browser extensions and expense claims for AI subscriptions.
• Scan traffic where needed, using cloud app discovery based on metadata. Inform staff and involve employee representatives where national law requires it.

Record each tool with its users, purpose and data in the register. For an outside view, DataNorth’s AI Security & Shadow AI Assessment maps AI traffic and checks each tool it finds against more than 500 AI privacy policies.

Step 3: Classify the risk of each use

Sort every use into one of four groups, because the group decides how much knowledge people need:

• Minimal risk: drafting, summarising and translating. Baseline knowledge is enough.
• Transparency obligations: chatbots that talk to customers, and generated images, audio or video. Users need to know the disclosure rules.
• High-risk: uses listed in Annex III, such as recruitment and credit scoring. Oversight staff need specific training from 2 December 2027.
• Prohibited: for example emotion recognition at work. Stop and check.

The classification depends on the purpose, not the product. The same assistant can be minimal risk in marketing and high-risk in HR. An EU AI Act assessment does this classification with you and ends with a roadmap.

Step 4: Set learning goals per role

Turn the role table into goals you can check, written as behaviour. “HR knows the AI Act” is vague. “HR checks with legal before any AI tool screens or ranks candidates” can be observed. Two or three goals per group are enough to start.

Step 5: Educate your employees

Combine formats, because a single e-learning rarely changes behaviour:

• A baseline session for everyone, live or online, with exercises on the risks above.
• Role modules for the groups in the table, built around their own tasks.
• One-page instructions per approved tool: which data may go in, which settings to use and two good examples.
• A short AI usage policy covering permitted data, prohibited uses, review rules and how to report mistakes.
• Ongoing support: a shared prompt library and a champion per team.

The Commission describes the same mix for its own staff: learning packages for generalists, managers and developers, guidance per AI tool, Q&A sessions and a network of AI champions. A practical starting point is DataNorth’s AI Literacy Workshop of two or four hours, online or on location, tailored to your teams through interviews with participants beforehand. More than 4,900 people from over 110 organisations have joined DataNorth workshops.

Step 6: Record, review and stay updated on AI regulations

Keep a record of who received which training or guidance, when and with which materials. That record is your evidence under Article 4. Review it when a tool, feature, role or rule changes, and at least once a year.

The rules are still moving. The AI Board will adopt recommendations on AI literacy, the Commission will publish compliance examples, and member states are still designating regulators. For the team that owns AI governance, an EU AI Act Compliance Workshop turns the rules into a roadmap for your own AI portfolio.

How do you measure whether AI literacy works?

Article 4 does not require you to measure knowledge, but measuring shows whether your measures work and where to adjust. Pick a few indicators, take a baseline now and measure again after three months:

What you measure	Indicator	Where to find it
Reach	Share of AI users who completed the baseline and their role module	Your register or learning platform
Knowledge	Score on a short scenario check, such as spotting an invented fact or a data rule breach	A five-minute quiz before and after training
Behaviour	Share of AI use that runs through approved tools	Admin consoles and a repeat of your shadow AI scan
Quality	Errors found in spot checks of AI-assisted work	Reviews by team leads
Safety	Reported incidents and near misses, such as data entered by mistake	Your incident or data breach log
Adoption	Active users of approved tools	Usage reports, such as the Copilot reports in the Microsoft 365 admin center

Read the indicators together. More reported near misses after training is often good news: people now recognise risks they used to miss. Falling use of approved tools can mean the rules are too strict and people are moving to shadow AI. Feed the results back into steps 4 and 5.

Frequently asked questions about AI literacy (FAQ)