Sector Considerations for AI Literacy in Regulated Work
Article 4 is sector-neutral in its wording and anything but sector-neutral in its application, because the calibration factors point straight at what a sector does and to whom. This lesson works through the sectors where the required level rises, and explains why.
Healthcare raises the level sharply, because clinical decisions affect health and safety directly and health data is among the most sensitive categories in data protection law. Clinical staff need to understand that a summarisation tool applied to a patient record can omit a negation and reverse a clinical meaning, that transcription tools mishear drug names and dosages, and that a confident answer about an interaction is not a clinical source. Where AI is embedded in a medical device, the product itself sits in the Annex I category whose obligations run to 2 August 2028, and the device regulator’s requirements apply alongside the AI Act rather than instead of it. Administrative uses in a hospital, such as triaging correspondence or drafting letters, are lower risk but still touch patient data, so the baseline for everyone needs to be higher than in a firm that sells software.
Financial services already operate inside a supervisory culture, which helps, but the specific literacy content is distinctive. Credit scoring and creditworthiness assessment for natural persons is an Annex III area, and pricing and risk assessment in life and health insurance is treated as high-risk too, with those specific obligations now falling due on 2 December 2027. Staff need to understand model risk in the sense their regulators already use, the difference between a model that supports a decision and one that makes it, the record-keeping expected when an adverse decision is communicated, and the consumer duty implications of an AI-drafted communication that overstates a benefit. Financial regulators expect firms to be able to explain outcomes to customers, and an unexplainable output used in a customer decision is a supervisory problem regardless of the AI Act.
Education is sensitive because the persons on whom systems are used include children, and because Annex III covers uses in education and vocational training such as determining access, evaluating learning outcomes and monitoring prohibited behaviour during tests. Emotion inference in educational settings is restricted under Article 5 rather than merely regulated. Teaching staff also need clarity about the use of AI to assess pupils’ work, the fairness of detection tools used to accuse pupils of cheating, and the data protection position when pupil work is submitted to a commercial tool.
Public sector bodies carry the weight of Annex III categories covering access to essential public services and benefits, and they act on people who cannot take their business elsewhere. Officials need to understand the duty to give reasons, the way an AI-drafted decision letter can create a legitimate expectation, and the position of a claimant who asks how a decision was reached. Transparency about AI use in public administration is usually a political requirement before it is a legal one, and staff should assume that any AI use will eventually be disclosed.
Legal practice, accountancy and other professions add a duty layer of their own. Professional obligations of competence and supervision apply to work produced with AI assistance, and a professional who files a document containing fabricated references has a professional problem as well as a client problem. The literacy content here is mostly about verification discipline and about client confidentiality, since much of the material such professionals handle is covered by duties that pre-date the Act.
Manufacturing, transport and energy meet the Act mainly through Annex I, meaning AI embedded in products already governed by EU product safety legislation, with obligations running to 2 August 2028. The workforce implication is that operators, maintenance staff and safety personnel are the people who must recognise when an AI-driven system is behaving abnormally, which makes literacy a safety competence rather than an office matter.
Retail, marketing and media feel Article 50 most sharply, because they generate and publish synthetic content at volume. The disclosure duties applying since 2 August 2026, the marking requirement for pre-existing generative systems by 2 December 2026, and the deep fake disclosure rule shape day-to-day practice for content teams. Marketing staff also need to understand likeness and consent, since an AI-generated voice resembling a real person creates exposure well beyond the Act.
Charities and small organisations are not exempt and are usually the least resourced. The proportionality in the phrase “to their best extent” genuinely helps here, and a small organisation with a short written rule set, a named owner, one baseline session with an assessment and a dated record is in a defensible position. What is not defensible anywhere, at any size, is having no idea which tools are in use.
The common thread across sectors is the third calibration factor in Article 4, which is the persons on whom the systems are used. Where those persons are patients, pupils, claimants, borrowers or job applicants, the level required goes up, and your training should say so explicitly rather than leaving staff to infer it.