AI literacy is the skills, knowledge and understanding needed to use an AI system safely and to judge what it gets wrong. Under Article 4 of the EU AI Act it stopped being a soft skill and became a legal term with a staff training obligation attached.
AI literacy training is what an organisation runs to meet that obligation: training that is proportionate to the risk of the AI systems people actually use, not a generic course, and evidenced with more than a sign-in sheet. It binds any UK company whose AI system's output is used by people in the EU, not only companies with an EU office - so the honest first question is not what the law says, but whether it applies to you at all.
The article itself does not say what "sufficient" means, and nobody has litigated it yet. That leaves compliance leads, heads of L&D and COOs guessing at a bar nobody has actually set - which is a more useful problem to solve than reciting the legal text, because the text alone will not tell you what to put in front of a regulator.
What does the AI literacy obligation actually say?
Article 4 of Regulation (EU) 2024/1689, the EU AI Act, requires providers and deployers of AI systems to take measures to ensure "a sufficient level of AI literacy" among their staff and other people dealing with the operation and use of AI systems on their behalf, taking into account those people's technical knowledge, experience, education and training, and the context the system is used in. It has applied since 2 February 2025.
"Other persons... on their behalf" is doing real work in that sentence. The European Commission's guidance on AI literacy reads this broadly: contractors, outsourced teams and service providers acting for an organisation are in scope alongside direct employees. A UK company that outsources its data entry or its customer service to a third party using AI tools does not get to treat that as someone else's compliance problem.
Does the obligation apply if you have no EU office?
Yes, if the trigger is met, and the trigger is not where you are based. Article 2 of the Regulation extends the Act to providers and deployers in a third country where the output an AI system produces is used in the EU - the same "where does the output land" test GDPR already uses, rather than a test based on your registered address.
In practice that means a UK company with EU customers receiving an AI-drafted contract, an EU candidate assessed by an AI screening tool, or an EU-based subsidiary using a shared AI system is very likely caught, even with zero EU staff and zero EU premises. A large number of UK companies assume this obligation cannot reach them because the UK did not adopt the EU AI Act. Some of those companies are wrong, because the reach follows the market rather than the office address.
What does "sufficient" and "proportionate to role" mean in practice?
It means there is no fixed curriculum, no minimum hours, and no certificate that satisfies the obligation on its own - the Act deliberately sets a principles-based standard rather than a checklist, because "sufficient" for a board member signing off an AI procurement decision is not sufficient for the person actually running the tool day to day.
A marketing executive drafting copy in Copilot needs to know what the tool gets wrong and when to check it. An HR lead using an AI screening tool to shortlist candidates needs to understand what the tool optimises for and where that could produce an unlawful outcome. An operations lead deploying an agentic workflow that acts without a human in the loop needs a materially deeper grasp of failure modes than either of the first two, because the system is making decisions rather than drafting suggestions. Three roles, three AI systems, three defensible answers to "how much training is enough" - and none of them is "everyone does the same 40-minute module".
What would satisfy a regulator, and why a sign-in sheet would not?
An attendance register proves people were in a room. It does not prove they understood anything, and "sufficient level of AI literacy" is a claim about understanding, not attendance. What a regulator can actually assess is a record that ties, per role: which AI systems that person uses, what risks are relevant to that use, what training they completed and when, and some way the organisation checked the training landed - a short assessment, a manager sign-off, anything beyond a name on a list. That record usually lives inside a wider AI policy rather than as a standalone log - see the training and AI literacy section of ivee's free AI policy template for how the two fit together.
Most organisations are starting from a weaker position than they think. 75% of AI decision makers say either they have no idea, or that fewer than 1% of their workforce knows how to build and deploy an AI automation, and fewer than 10% say that 50% or more of their organisation knows how to build an AI automation, according to ivee's research with 500 UK AI decision makers, surveyed in August 2026. That is the group the obligation is aimed at, and a large share of them cannot currently describe their own starting point, let alone evidence movement from it.
How is AI literacy training different from AI fluency training?
Literacy is the floor: enough understanding to use a system safely and recognise when it is wrong. Fluency is what happens above that floor, once people are actually good with the tools rather than merely cleared to touch them - a distinction covered in full in ivee's piece on AI training vs AI fluency. Meeting Article 4 gets a workforce to a legally defensible minimum. It does not make anyone faster, better, or more likely to use the tools well - that is a separate, harder problem, and one that a compliance-driven training programme, run only to clear the legal bar, tends not to solve.
Does the UK have anything like this, and why is ivee flagging it?
No. The UK has not adopted an equivalent statutory duty, and a UK-only company with no EU exposure is making a commercial choice to run AI literacy training, not meeting a legal one. That does not mean UK domestic pressure is absent, only that it is arriving through different doors.
In Ayinde v London Borough of Haringey, the President of the King's Bench Division warned the legal profession over fabricated case citations produced by generative AI, and said "practical and effective measures" must now be taken by firms' leadership and by regulators - not a literacy statute, but a court telling an entire profession that not training people to check AI output has consequences. In financial services, the FCA has confirmed that the existing Senior Managers and Certification Regime already holds named individuals accountable for the systems in their area, AI included, whether or not a literacy-specific rule ever gets written.
ivee sells AI training, which gives it an obvious interest in this obligation being read broadly, and that is worth saying plainly rather than leaving the reader to work out for themselves. Enforcement and case law have not arrived yet, so anyone who states the exact bar with confidence is guessing, and that includes any provider - ivee included - selling a course against it. What can be stated with any confidence is narrower: a single recorded webinar with a sign-in sheet is what most companies will actually do, and it is probably not sufficient evidence for anyone in a higher-risk role.
Frequently asked questions
Does the EU AI Act apply to UK companies?
It can. The test is whether the output of an AI system you provide or deploy is used in the EU, not whether your company has an EU office - so EU customers, EU staff or an EU subsidiary sharing a system can be enough to bring a UK company into scope.
Is AI literacy training legally required in the UK?
Not under UK statute. The UK has no equivalent to Article 4. A UK company is bound only if it is caught by the EU AI Act's own reach - through EU customers, staff or systems - in which case the obligation applies regardless of where the company is registered.
What counts as sufficient AI literacy?
There is no fixed answer. The Act asks for a level proportionate to the person's role, technical background and the risk of the AI system they use, so a board member, an HR lead and an operations lead deploying an autonomous agent are held to different, unwritten standards.
What key AI skills does the C-suite need?
Enough to judge the risk of what they are approving, not to build it themselves - an AI decision maker in ivee's August 2026 research put the question directly: "What key AI skills do you reckon the C-suite team needs?" The honest answer is judgement over the risk and cost trade-offs of a system, since that is what they are accountable for signing off.
Whether Article 4 actually reaches your organisation, and what proportionate looks like role by role, is not something a checklist can settle on its own. Get in touch and ivee will work through your exposure with you, and what evidence would actually hold up.
