AI literacy: what the law expects of your staff

Of all the AI Act obligations this is the cheapest to arrange and the easiest to forget: staff who work with AI must have sufficient basic knowledge. That requirement has applied since February 2025, with enforcement from August 2026.

What "sufficient" means

The law prescribes no curriculum. What is expected is that people understand what the system does, what its limitations are and what their own responsibility is. In practice that comes down to four things:

• What AI can and cannot do, and that an answer can be confident and wrong at the same time.
• Which data must stay out: personal data, client files, source code, pricing agreements.
• Why output is always checked before anything goes out.
• What to do in case of doubt, and who to turn to.

Why this makes sense even without the law

Most AI-related incidents we see at customers are not attacks but well-meant mistakes. Someone pastes a client contract into a free tool to have it summarised. Someone sends an AI-written email without checking whether the amount mentioned is right.

You do not prevent those two examples with technology, but with half an hour of explanation and a policy people actually read.

How we set it up

Three parts, together usually arranged within a few weeks:

• A usage policy on one page. Which tools are allowed, which data must stay out, who decides in case of doubt. Short enough to read, concrete enough to follow.
• Training per role. Sales, administration and engineering use AI differently. Examples from their own work make the difference between understanding and applying.
• Key users. Someone in each department who is further along and fields questions. That works better than a ticket for every question.

Recording that you have done it

As with most obligations: what you do not record formally never existed. Keep track of who took which training when, and when the policy was adopted and revised. That is the same administration you already keep for awareness under ISO 27001 and the NIS2 duty of care.