The AI literacy duty, in plain English.

The Article is one sentence long. Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. It asks them to take into account those people’s technical knowledge, experience, education and training, the context the AI systems are used in, and the people the systems are used on.

Three words carry the weight. Deployer means any organisation using an AI system under its own authority, which includes a firm whose staff use a general purpose assistant for work. Sufficient is relative to the role and the risk, so a partner drafting advice and a receptionist summarising a call are not held to the same bar. Measures means something you did, on purpose, that you can show.

The Act applies to deployers established in the EU, and to providers and deployers outside the EU where the output of the AI system is used in the EU. A UK firm with EU clients, EU offices, or staff based in an EU member state is likely to be within scope for the work that touches them.

Where it does not bite directly, it arrives another way. EU clients and EU-headquartered groups are starting to ask their suppliers for evidence of AI literacy measures in the same questionnaires that already ask about Cyber Essentials and data protection training. The duty on them becomes a question to you.

The Act does not prescribe a course, an hour count or a certificate. The European Commission’s guidance describes a proportionate approach: a general understanding for everyone who uses AI at work, more for people whose role or sector carries more risk, adjusted for the tools actually in use, and a record kept of what was done.

• A baseline for all staff: what the tools do with what they are given, what may and may not go in, and how to check what comes out.
• Role-specific depth where the risk is higher: finance, HR, legal, anyone handling personal or client data.
• Content matched to the actual tools, refreshed when those tools or their terms change.
• A record of who was trained, on what, and when.

The duty has applied since 2 February 2025, ahead of most of the Act. Supervision of it by national market surveillance authorities begins on 2 August 2026, and penalties for breaches of Article 4 are set by each member state rather than by the Act itself. In practice the earliest consequence for most firms is contractual: a client who asks for evidence and does not get it.

An auditor, a client’s procurement team or a regulator will ask for the same four things.

• A written AI use policy that names the approved tools and the rules for data.
• A training register: each person, the content they completed, the date and the result.
• Proof the content fits the tools and roles in the firm, not a generic slide deck.
• A refresh cadence, so the record is current rather than a one-off from the year the duty began.