What is AI literacy, and what does "sufficient" mean?

A plain definition

AI literacy is the practical understanding a person needs to use AI tools sensibly: knowing what the tool does, how it can fail, what it should and should not be trusted with, and what your own responsibility is when you use it. It is not about being able to build a model or read code. It is about judgement.

The EU AI Act gives the term a legal definition. Article 3(56) describes AI literacy as the skills, knowledge, and understanding that allow providers, deployers, and affected people to make informed use of AI systems and to become aware of the opportunities and risks of AI and the harm it can cause.

Why a definition matters

Without a shared definition, "AI training" can mean anything from a one-line policy email to a full course. The Article 3(56) definition sets a floor: a person should come away understanding the technology, its risks, and their responsibilities. That is the standard an organisation is working towards, whoever the person is and whatever their role.

What "sufficient" looks like

The Act does not prescribe a single curriculum, and what counts as sufficient is proportionate to the role and the context. A useful way to read it is in three layers.

A shared baseline. Everyone who uses AI at work should understand what AI tools are, that they can be confidently wrong, that sensitive data does not belong in unapproved tools, and that a person stays responsible for the output.

Role-appropriate depth. People who configure, monitor, or oversee AI systems, or who work with sensitive use cases, need more than the baseline. Their literacy has to match what they actually do.

Awareness of context-specific risk. The risks that matter depend on the work. A team handling personal data has different concerns from a team drafting marketing copy. Sufficient literacy means people understand the risks that apply to them.

How you know someone has it

Attendance is not the same as understanding. The clearest signal that a person has reached a sufficient level is a scored assessment with a defined pass threshold, kept as a record that links the person to a dated result. That turns "we ran training" into "here is who understood it, and when."