What AI Literacy Means in Law, Not in Marketing
The phrase “AI literacy” is used loosely in the commercial market, where it often means a short awareness video and a set of prompting tips. The Act gives it a defined meaning, and the defined meaning is the one an authority will read. Article 3(56) defines AI literacy as the skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of the Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause.
That definition decomposes into parts that can each be designed for and tested. Skills are things a person can do, such as checking a generated claim against a source document or recognising that a request contains personal data that should not be pasted into a public tool. Knowledge is what a person holds, such as knowing which tools are approved, what the organisation’s disclosure rule is, and who to tell when something goes wrong. Understanding is the deepest of the three and the hardest to fake, because it means a person can reason about a situation the training did not cover. Someone who understands why a language model fabricates citations will behave correctly when asked to check a document type nobody anticipated. Someone who only memorised a rule will not.
The definition also names three populations, providers, deployers and affected persons, and ties literacy to their respective rights and obligations. This is why a generic course cannot be sufficient on its own. A recruiter’s obligations are not a developer’s obligations, and the literacy each needs is the literacy that lets them meet their own. The reference to affected persons connects to rights elsewhere in the Act, including the right under Article 86 for a person affected by certain decisions to obtain an explanation of the role of the AI system in the decision. Your customer-facing staff cannot honour a right they have never heard of, so awareness of affected persons’ rights is part of literacy for those roles.
The phrase “informed deployment” is the operative test. It means the person can make a defensible decision about whether, when and how to use a system for a given task, and that they can say why. An informed deployment decision includes the decision not to deploy, which is the part most commercial training omits. Knowing that a task involving a vulnerable client’s medical history should not be routed through a general-purpose assistant is a literacy outcome of exactly the same status as knowing how to write a good prompt.
The definition requires awareness of opportunities as well as risks, which is often missed by compliance teams building a purely defensive programme. A course that only tells people what they must not do produces staff who avoid the technology, use it secretly, or use it badly. The Act asks for balanced awareness, and a programme that never explains where these tools genuinely help is as poorly matched to the definition as one that never explains where they harm.
“Possible harm it can cause” is broader than harm to the organisation. It includes harm to individuals, to fundamental rights, to health and safety, and to groups affected by the system’s outputs. Training that frames every risk as a commercial or reputational risk to the employer misses the direction the Act is looking in. When staff learn about bias, the point is not only that a discrimination claim would be expensive, but that a person may be wrongly excluded.
Recital 20 of the Act supports this reading by describing the aim of AI literacy as equipping the relevant actors with the notions needed to make informed decisions, and by noting that such notions may vary with context and can include understanding the correct application of technical elements, the measures to be applied during use, and the way to interpret AI system output. Reading the definition and that recital together gives a design brief in plain terms. People must know what the system is for, what it does badly, what they must do while using it, how to interpret what comes out, and what rights the people on the receiving end have.
A useful test for any proposed training is to take the definition apart and ask, for each population, whether the material delivers each element. Does it build a skill, or only describe one? Does it convey knowledge specific to the tools this population actually touches? Does it produce understanding that will survive a novel situation? Does it name the rights and obligations of that role? Does it cover opportunities as well as risks, and harm to people as well as harm to the organisation? Material that fails several of those questions is unlikely to amount to a sufficient level, no matter how professionally it is produced or how many staff have clicked through it.