Of all the EU AI Act’s obligations, one took effect over a year ago, affects almost everybody, costs very little to meet — and almost nobody has done anything about it.
What the rule says
Since 2 February 2025, alongside the prohibitions on unacceptable practices, the AI literacy obligation applies. In essence: organisations must ensure a sufficient level of AI competence among staff who deal with the operation and use of these systems.
It does not demand an accredited course or a specific certification. It demands that the people operating the system understand what they are operating, in proportion to the context and the risk.
Why almost nobody complies
Because it didn’t arrive with an eye-catching fine attached or a form to fill in. Obligations without a visible procedure tend not to get executed.
And because there is an underlying confusion: many assume “AI literacy” means technical training. It doesn’t. A salesperson doesn’t need to understand transformers. They need to understand why the system sometimes invents things with total confidence, and what to verify before sending the proposal to a client.
What it should actually cover
In the training we deliver, the content that moves the needle is surprisingly short:
- Why the model hallucinates. It is not a bug, it is how it works. People who understand this verify without being asked.
- What never gets pasted in. Personal data, customer information, credentials, proprietary code. With examples from your company, not generic ones.
- Where it is reliable and where it isn’t. The capability profile is jagged: brilliant at some things, poor at others that look easier.
- What always gets checked. Figures, names, dates, legal citations, references. Everything the system can produce in perfect format with invented content.
- When to escalate to a person. And to whom.
- What the rule requires in your specific case. Transparency where there is customer interaction, oversight where the decision affects people.
Two well-designed hours cover this. A six-week programme is not required.
The documentation part
This is where companies fail even when they have trained people. The obligation is evidential, so you need a trail:
- Who received the training and when.
- What content was delivered.
- How it is built into onboarding for new joiners.
- How often it is refreshed.
A spreadsheet and the stored materials are enough. What does not count is “we explained it in a meeting”.
Why it is worth it even if it weren’t mandatory
This is what we genuinely recommend looking at: literacy is the measure that reduces risk most per euro spent.
It reduces shadow AI, because informed people understand why rules exist. It reduces production errors, because someone who knows the system can be wrong will verify. And it improves adoption, because most resistance to these tools comes from not understanding what they do.
It is one of the few regulatory requirements that leaves you better off than it found you.