"AI literacy" sounds like a course in how large language models work, and many courses under that name teach exactly that. For a business whose people use AI tools rather than build them, it means something narrower and more useful. It means that everyone who uses AI at work knows what it is good for, where it goes wrong, what they may put into it and when a person has to check the result.
Why it has a name now
The European Union's AI Act made it an obligation. Since 2 February 2025, businesses that use AI systems in the EU have had to take measures for the AI literacy of their people and of others, such as contractors, who use AI on their behalf.
In 2026 the Act was amended so that the duty is to support that literacy rather than to guarantee a set level, and national authorities began supervising it in August 2026. The European Commission sets out the current position on its AI literacy page.
Whether the duty applies to your business, for example if you operate in the EU or your AI use reaches people there, is a question for your advisers. The Commission's guidance has been clear on two practical points: no external certificate is needed, and the measures should be recorded.
Outside the EU there is no equivalent duty in law yet, and the reasons to do it anyway are the same everywhere. People who understand where AI goes wrong make fewer of the mistakes that become incidents, and a client's security questionnaire increasingly asks how your people are trained.
What literacy means at four levels
The measures are meant to fit the person and the use, so a sensible plan is short for most people and deeper for a few.
Everyone who uses AI at work
Four things, which fit in an hour and a one-page acceptable use policy:
- What the approved tools are for, and which accounts to use them on.
- What never goes in.
- That AI produces fluent text whether it is right or wrong, and invents facts, figures and sources with the same confidence as it states real ones.
- What to report, and to whom, including a tool showing them something they should not be able to see.
People using AI on client work
Everything above, plus how to check output properly: going back to the original source, checking every figure and name, and knowing which work always needs a person's review before it leaves. For most people this is best learned on their own tasks, which is how the first month with Copilot is built.
Managers and reviewers
They decide which work AI may touch in their team, and they are often the person checking the output. They need to know what good review looks like, how to tell when someone is relying on a tool more than they should and how to respond when something goes wrong without making people hide it next time.
The people who own and run the tools
Whoever approves tools, administers accounts and owns the policy needs the deepest understanding: how the vendors' terms differ between tiers, what a connected tool can reach, how use is logged and what changes when a vendor updates the model underneath. This is a handful of people, and for many businesses part of it sits with an outside partner.
What literacy is not
A certificate, a vendor's product course or a single annual video will not give your people literacy on its own. A product course teaches the features of the tool, so it cannot teach your rules, and an annual video falls behind tools that change every few months. The training that sticks is short, tied to people's own work and refreshed when the tools or the rules change.
The record that shows it
If you hold ISO 27001, this is the same evidence its awareness control already asks for, as set out in what ISO 27001 expects once AI is in use. It is also the answer to the training question in a client's security questionnaire.
Where this fits
The rules people are trained on come from Govern, and the training itself happens in Adopt, on your first team's own work. Keeping it current as tools change is part of what Trackside does month to month.