Where does your team actually stand on AI literacy?

Do you know which roles in your team use AI tools in their daily work?

"Use" means more than trying ChatGPT once - actual recurring use, even unofficial.

Have you mapped which AI systems and tools are touching your work - including the ones people brought in themselves?

Shadow AI counts. The revisor's question is "what AI is in use," not "what AI did you approve."

Have you classified the AI uses in your team as high-risk, limited-risk, or minimal-risk under the AI Act?

Hiring, performance review, customer-facing decisions, legal drafting - those are the ones to look at first.

Could the people doing the work explain, in their own words, what their AI tool can and cannot do?

Not "did they take a course" - can they articulate the limits of the tool to a colleague today?

Do you have shared, written prompts or playbooks for the AI tasks people do most often?

A shared doc with 5 good prompts beats 50 people inventing their own each morning.

Is there a review step before AI output reaches a customer, a contract, or a compliance-relevant decision?

Human-in-the-loop is not a slogan - it is a documented step in the workflow.

Has your team been through structured AI literacy training in the last 12 months - beyond a vendor demo?

A 30-minute lunch-and-learn does not count. Article 4 expects "sufficient" - that means scoped, role-relevant, and assessable.

If your compliance lead, regulator, or customer asked tomorrow, could you produce written evidence of who learned what, when?

Names, dates, scope, assessment results. Not "we sent everyone a video link."

Is there a named person on your team who owns AI literacy and answers for it?

Doesn't need to be senior. Does need to be answerable when the question gets asked.

When an AI tool produces a bad output that reaches a colleague or customer, do you have a habit of capturing it and fixing the practice?

Postmortems for AI errors - even small ones - are the difference between a one-off and a maturing practice.