AI literacy is no longer a good intention, it's an obligation.

The AI Act describes it as skills, knowledge and understanding. Note what it doesn't say: no hour count, no mandatory curriculum, no certificate. It's about what people can do, not what they attended. That distinction looks formal but decides in practice whether your reasoning holds up.

In practice it comes down to three things someone has to grasp. That a model writes convincingly regardless of whether it's right. That it adopts your assumption rather than challenging it. And that what you enter ends up somewhere, and that where matters. Anyone who grasps those three uses any AI system more responsibly than someone who has memorised fifty prompts.

It's deliberately broader than one product. The obligation attaches to the use of AI systems, not to the vendor, so Copilot, ChatGPT, Gemini and the AI feature in your HR suite all fall under it. Which is why the knowledge base should be vendor-neutral: it doesn't change with the next product update.

The problem isn't the quality of such a course, we sell one ourselves. The problem is that an organisation starts at step three with it. Without an inventory you don't know which systems to cover, without a level assessment you don't know who needs more, and without a follow-up measurement you're left with an attendance list.

A uniform programme is demonstrably easy, but not demonstrably appropriate. Article 4 asks for literacy fitting the role, context and risk, and that difference is exactly what a regulator looks at. The good news: step two takes five minutes per employee and immediately produces the rationale for why one group needed more than another.

There's a second reason to look beyond one session, and it has nothing to do with the law. What people learn in ninety minutes fades if nothing follows. That was true before the AI Act. So reinforcement isn't an add-on to compliance; it's the part that makes the compliance mean something.

The first is visibility. A council question, a freedom-of-information request or an audit office review arrives sooner than an inspector, and at those moments 'we ran a training' is a weaker answer than a measurement with a date on it. The national audit office and the data protection authority also publish on this themselves, so the question arrives with a frame of reference.

The second is that the risk profile varies sharply per task. A communications adviser having a press release sharpened is somewhere else entirely than someone summarising an objection or preparing a decision affecting a citizen. That's exactly where the level assessment per role stops being a formality and becomes the core of your case.