The question we get more than any other, from the people who actually have to run the literacy programme: what does “sufficient” mean when my team is in HR, or operations, or finance, or customer support - not engineering?
Article 4 of the EU AI Act does not define the word. The guidance coming out of national competent authorities is helpful but still thin. So here is the working definition we use with clients, adapted from how regulators are starting to talk and from what has actually held up in the cohorts we have taught.
Literacy is behavioural, not topical
The first thing to unlearn: literacy is not a topic list. It is not “AI ethics plus prompt engineering plus a chapter on the Act.” A team can pass a quiz on those topics and still fail the Article 4 standard, because the standard is about what people do at their desks on Tuesday, not what they can recite.
Literacy is a set of behaviours. Four of them.
The four competencies
1. Can describe what the AI system is doing, in plain language
Can someone in HR say, in their own words, what a candidate-screening tool is doing when it ranks CVs? Not the vendor pitch - the actual mechanism, at the level of detail someone in the role needs. If the answer is “the tool just picks the best ones,” the team is not literate in this tool yet.
The bar: a team member can explain the tool’s job to a colleague who has never seen it, including what input it takes and what output it produces.
2. Can name the common failure modes
For each tool the team uses, can they name the three or four most common ways it fails? Hallucinations. Bias against groups underrepresented in the training data. Outdated knowledge. Privacy leaks when sensitive data is pasted in. Drift from the task as the conversation gets longer.
The bar: before a team member uses the tool on a task, they can anticipate which failure mode is most likely to show up for that task.
3. Knows when to treat output as a draft, and when as finished work
This is the behaviour that prevents most of the real damage. A literate team treats AI output as a starting point that a human reviews. An illiterate team treats it as finished.
In non-technical work, the line is usually easy to draw once it is taught. Anything that will be sent to a customer, stored in an HR record, used in a hiring decision, filed with a regulator, or relied on in a legal document is reviewed. Anything internal, low-stakes, and reversible can move faster.
The bar: for every AI-touched work product, someone can say - without hesitation - whether it needs a human review before it leaves.
4. Can document the decision after the fact
If an revisor, a regulator, or a client asks six months from now “how did you reach this decision?” - can the team produce a record? Not the full chat log necessarily, but a short note: what the question was, what AI was used, what it suggested, what the human decided and why.
This is the competency most teams skip, and it is the one that makes a literacy programme defensible under Article 4. Documentation is cheap at the time and expensive retroactively.
The bar: for the last five AI-assisted decisions of any consequence, someone can produce a one-paragraph record.
What literacy is not
A few things that do not count, and that we regularly have to argue against inside organisations.
- Completion records. A wallet full of online-course completion records is not evidence that anything the person does on Tuesday has changed. Regulators are starting to say this out loud.
- Prompt-engineering tricks. These help, but they are not literacy. A team that can prompt well but cannot catch a hallucination is worse off than a team that can do both.
- Awareness training. A 30-minute “what is AI” video for the whole company is better than nothing. It is not sufficient under Article 4.
- Vendor training as the whole programme. Useful, but it trains on one tool. Literacy has to generalise.
How to measure it
We do not use quizzes. We use a work-product review.
Pick five real pieces of AI-touched work from the last month. Review them against the four competencies above. Note where each one succeeded and where each one fell short. Repeat quarterly.
That review - dated, with examples, stored somewhere your compliance lead can find - is the assessment artefact Article 4 is asking for.
Where to go next
If you want to see how your team scores on these four competencies, take our Article 4 AI Literacy Readiness Scorecard. 10 questions, 4 minutes. If you want a curriculum template scoped to a non-technical role, the HR curriculum template is the starting point we give clients. If you want 20 minutes with a teacher, book a discovery call.