TL;DR
"AI literacy" has become one of those phrases that turns up in board packs and policy drafts without anyone defining it. It gets used to mean at least three different things: knowing what a large language model is, being able to write a decent prompt, and complying with European regulation.
All three are part of it. This piece is my attempt to pin the term down for a working organisation, explain where the regulation fits, and set out how I'd build it across a team without turning it into another training day nobody remembers.
The OECD and European Commission's AI literacy framework, written for schools, describes it as a set of knowledge, skills, and attitudes that let people understand how AI systems work, evaluate what those systems produce, and use them ethically and creatively. That's a good definition, and it travels well into the workplace.
For a business, I'd put it more plainly. An AI-literate person knows roughly what's happening when they type into ChatGPT or Copilot. They can get useful output for their own job. They notice when that output is wrong or made up, which large language models (the systems behind these chat tools) do with complete confidence. And they know which information shouldn't go into a tool at all.
None of that requires technical knowledge. It requires familiarity, some practice, and a clear sense of the risks.
Stanford's Teaching Commons publishes an AI literacy framework with four domains: functional, ethical, rhetorical, and pedagogical. It was built for educators, but the structure maps neatly onto work. Here's my adaptation, and it's mine rather than Stanford's.
Understanding the tools. Stanford's functional literacy. How these tools generate text, why they tend to produce an average of what they've seen, what they're good at, and where they fall over. The aim is a working mental model, and nobody needs an engineering course for that.
Judging risk. The ethical domain, translated into business terms. Data privacy, confidential client information, bias in outputs, copyright, and the reputational cost of publishing something an AI invented.
Working with the output. Stanford calls this rhetorical literacy: using language to get what you need from the tool, then critiquing what comes back. In practice, this is prompting, editing, and fact-checking.
Redesigning the work. Stanford's fourth domain is about teaching. The workplace equivalent is asking how AI changes the way a job gets done, which steps disappear, which need a human check, and which become possible for the first time. It's the domain literacy programmes most easily skip, and it's the one that connects literacy to results.
Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures to support AI literacy among their staff and others who use AI systems on their behalf. A deployer, in the Act's language, is an organisation using an AI system in its work, which covers a company whose staff use ChatGPT.
The European Commission's AI literacy questions and answers clarify a lot. Following the Digital Omnibus amendments, AI literacy remains an obligation, but no specific or "sufficient" level is mandated. There's no obligation to measure employees' AI knowledge, and no mandatory training format. The Commission says that relying only on a tool's instructions for use is likely to be ineffective, and that different levels of training for different groups can be appropriate.
Two answers in that Q&A stood out to me. A company whose staff use ChatGPT to write advertising copy or translate text does fall under the requirement, and those staff should be told about specific risks like hallucination, the term for confident but invented output. And the obligation reaches beyond employees to contractors and service providers working on the organisation's behalf.
For South African organisations, whether the Act applies depends on your footprint in the EU, so check that with your legal advisers rather than with me. I'd treat the Commission's guidance as a sensible minimum either way, because it describes good practice regardless of where you're based.
This is the point I most want leaders to hold on to. McKinsey's view on AI upskilling is that companies spend disproportionately on literacy because it's visible and easy to measure, while adoption, which is messier, gets less attention.
A literate team knows how to use the tools. An adopting team has changed how it works because of them. You need the first to get the second, but the first rarely produces the second on its own. I've written more about that gap in our piece on AI training for employees, and about what moves it in our guide to AI adoption.
So treat a literacy programme as the foundation and plan the next layer before you start: which workflows will change, who'll model the new way of working, and what you'll measure.
Start with an inventory. List the AI tools people use, including the ones they use without permission. The Commission's guidance suggests organisations begin by asking what AI is in use, whether they build it or only use it, and what risks those tools carry. That's a useful first hour for any leadership team.
Tier the training by role. Someone drafting marketing copy needs different literacy from someone using AI to screen job applications. A light baseline for everyone, then deeper, role-specific sessions for people whose AI use carries more risk, matches both good practice and the Commission's view that different levels can be appropriate.
Teach on real work. People learn faster when they bring their own tasks. A finance analyst summarising their own month-end commentary learns more in 20 minutes than in an hour of generic examples.
Make the risks concrete. Show a hallucinated citation. Show what happens to data pasted into a consumer tool under its standard terms. Abstract warnings fade, while a vivid example stays with people.
Give people rules they can follow. Literacy without a clear policy leaves people guessing about what's allowed. Our AI policy template covers how to write one short enough to be read.
Plan to refresh it. The tools change every few months. The World Economic Forum's Future of Jobs Report 2025 expects workers to see 39% of their existing skill sets transformed or outdated between 2025 and 2030. A one-off course won't keep pace with that, so build in short, regular updates instead.
Quiz scores and attendance tell you people showed up. They don't tell you whether anything changed. I'd look for behaviour instead.
Are people checking AI output before using it, or pasting it straight into client documents? Do they know which tools are approved, and why? Are they bringing new uses to their managers? Can a team lead explain which parts of their team's work AI now handles and which still need a person?
The Commission doesn't require you to measure literacy, and I wouldn't build an elaborate testing regime. A short conversation with a manager every quarter, around those questions, tells you more than any certificate.
A few examples, because definitions only go so far. A sales lead asks an AI tool to summarise a prospect's annual report, then checks three of the figures against the source before using them in a meeting. An HR coordinator drafts a job advert with AI, then removes language that could put off certain applicants. An operations manager notices that a chatbot gave a confident answer about a regulation, and goes to the regulation itself before acting on it.
In each case, the person uses the tool, gets value from it, and applies judgement before the output reaches anyone else. That combination is what I mean by literacy.
AI literacy is the knowledge, skills, and attitudes that let people understand how AI systems work, evaluate their output critically, and use them responsibly. At work, it means using AI tools productively while knowing their limits and risks.
Stanford's framework names four domains: functional, ethical, rhetorical, and pedagogical. For workplaces, I translate them as understanding the tools, judging risk, working with the output, and redesigning the work.
Under the EU AI Act, organisations that provide or use AI systems must take measures to support AI literacy. The European Commission says there's no mandatory training format and no specific level required, but relying only on a tool's instructions is unlikely to be enough.
It depends on your presence and activity in the EU. Check with your legal advisers. The Commission's guidance is a sensible benchmark for any organisation, wherever it's based.
A useful baseline can come from a single well-run session on real work. Keeping it current takes short, regular refreshers, because the tools change faster than any annual course can.
If you want a picture of where your organisation stands before planning a literacy programme, our free AI Readiness Diagnostic scores you across five dimensions, including people, and gives you a report to take to your leadership team.
Ready to move from reading about AI to getting your organisation ready for it? Start with the diagnostic.
Take the AI Readiness Diagnostic