Six steps to AI Literacy (whether legally required to or not)

27 February 2025. Published by Paul Joukador, Partner and Praveeta Thayalan, Knowledge Lawyer

At the beginning of February 2025, the AI literacy requirement under the EU AI Act came into force. The effect of this is that certain businesses must take measures to ensure a sufficient level of AI literacy in their staff.

Does this apply to you?

The EU AI Act applies to: (i) businesses established in the EU; and (ii) businesses not established in the EU but whose AI system is placed in the EU market (including for its own use) or where the AI system's output is used in the EU.

The AI literacy obligation itself is broad ranging – it applies to all businesses in scope of the EU AI Act (whether developing or using AI systems) and irrespective of the level of risk of the AI system itself.

In the UK, the government has not yet made AI literacy a requirement. However, it is clear from its recent AI Opportunities Action Plan that it is prioritising upskilling the UK workforce in AI.

Although the EU AI Act can create legal obligations on you to implement AI literacy, the idea of training your staff and managers on responsible AI usage and deployment does, in any case, make good business sense. The nature of AI, and what it can potentially do, can mean that mistakes involving AI can be costly and lead to financial loss, reputational damage, and regulatory fines.

In practice, AI literacy can simply form part of your regular staff training and the benefits of having AI power users and a workforce that can use AI to its full potential (while understanding the risks) can outweigh any compliance cost!

What training must you do?

Fortunately (or unfortunately), the EU AI Act is not prescriptive on how businesses should train their staff. Instead the requirement is intended to apply proportionately, for example, it will depend on the number of staff and the context in which AI is used. When looking at the type and depth of training to provide, you should bear in mind that the purpose behind the requirement for training is to enable businesses to make informed decisions about AI deployment and use.

The EU AI Office has also started a living repository to provide businesses with good examples of AI literacy practices.

How do you achieve AI literacy?

While there is no 'one size fits all' approach to AI literacy, these practical steps will assist you to produce and deliver an AI literacy programme that is appropriate to your business.

Step 1: Understand your AI usage	The type and extent of training you should provide will depend on the risk and impact of AI in your organisation so you must first understand how your business uses (and intends to use) AI. Also consider where people might want to experiment with AI especially new or easily available products. Lastly, identify any teams that may need more specific training due to the use of AI in their role or exposure to high-risk AI systems.
Step 2: Set the right tone	Your AI policy should set out your business' approach and risk appetite to AI use. Any training should align with your policy so that staff receive a cohesive message. A blanket 'no' to AI is unlikely to work (and may leave you at a competitive disadvantage). Instead, consider how you can empower your staff and what are sensible guardrails for the use of AI that balances benefits against risk.
Step 3: Start with the broad...	Ideally, everyone in your business involved in or who may use AI would receive foundational AI compliance training and it would make sense to make this mandatory. This type of training does not need to be technical but should include the basics of how AI works and the key risks in using AI (e.g. hallucinations, IP, privacy) to give everyone a good grounding in what is AI and so they can spot concerns and escalate appropriately.
Step 4: …and then be specific	An individual's role in the business and their interaction with AI may mean it would be sensible for them to have supplemental and more in-depth or targeted training. For example: to steer their decision making, leadership teams could receive training on the overall opportunities and risks of AI as well as internal governance processes. teams that interact with high-risk AI systems or must interpret their output may benefit from specialised training about how best to use AI. HR and compliance teams would ideally have training on AI ethics, bias and privacy issues. IT teams are likely to need to be upskilled to understand the technical aspects of their AI systems even where procured from third parties especially information security.
Step 5: Monitor engagement	As with any core training, good practice is to record attendance and engagement on the training provided, no matter the training format. Records are helpful to demonstrate compliance should you come within scope of the EU AI Act. Surveys and KPIs can be used to assess the impact and success of the training programme and areas for improvement.
Step 6: Update regularly	AI, and its use, is evolving and developing and often very quickly. Keep your training under review and be ready to update and refresh the content in line with your changing business requirements and to address tech developments. Ideally staff would have refresher sessions at least annually. You might also consider whether there are new or more effective ways to deliver AI training e.g. gamification or interactive learning environments.

At RPC, we help our clients meet their AI literacy objectives. We can assist with business-wide, compliance training and specific training to business teams. Speak to us to learn more about how we can help you.

Stay connected and subscribe to our latest insights and views

Subscribe Here