Every control in this course is operated by people. The EU made that a legal duty: since 2 February 2025, Article 4 of the AI Act requires providers and deployers to take measures to support AI literacy among staff and others who operate AI on their behalf, taking into account their role, technical knowledge and the context of use. The Digital Omnibus softened the wording in 2026 (organisations must "support the development" of literacy rather than guarantee a level) and national authorities began supervising it from 2 August 2026. It applies to every AI system, not just high-risk ones.
Elsewhere the duty is implied rather than stated. The FTC faulted Rite Aid for not training staff on the limits of its facial-recognition system. Texas TRAIGA's affirmative defence assumes a risk programme people know how to run. Canada's Guide on the use of generative AI lists "Educated" among its FASTER principles: learn the strengths, limits and appropriate uses of the tools before relying on them.
Who needs what
One course for everyone does not work. Three tiers:
- Everyone (30 to 45 minutes, annually): what AI is and is not good at; the organisation's approved tools and rules; what may not be pasted in; how to spot and report a problem; when to disclose AI to customers.
- People who operate or oversee a consequential system (2 to 3 hours plus on-the-job): how the specific system works, its known error patterns, how to read its output, when and how to override, and how to log it. This is what the EU AI Act's Article 26 competence requirement for oversight staff means in practice.
- Builders and decision-makers (half a day or more): risk classification, fairness testing, security threats, documentation, and the legal map for your markets. Include leadership; they sign the risk acceptances.
Make it real
- Use your own tools and your own incidents as examples.
- Include a hands-on exercise: find the error in an AI output, or spot the prompt injection in a document.
- Test understanding with a short quiz and keep the scores.
- Repeat after major model changes and at least annually.
Evidence
Keep a register: who was trained, on what, when, and the result. Regulators do not ask "did you train people"; they ask "show me". The Academy's lesson progress and quiz scores can serve as one line in that register.
Literacy for customers
Some laws extend the idea outward: NYC's candidate notice, Utah's disclosure, Colorado's post-decision explanation all assume the public can understand what you tell them. Plain-language notices are part of your literacy programme too.
A minimum that fits a small company
A one-hour session for all staff, a written rule sheet, a two-hour walkthrough for the two people who oversee your riskiest tool, and a spreadsheet recording attendance. That satisfies the spirit of Article 4 and gives you evidence for everything else.