Guidelines for implementing AI-Literacy in companies

1. What does “ a sufficient level of AI literacy” mean?

With Art. 4 of the AI Act, the EU legislator has created a central “cross-cutting obligation” for all providers and deployers of AI systems. AI literacy is intended to promote skills, knowledge, and understanding for the competent use of AI and risk awareness. Sufficient AI literacy should enable companies and employees to make informed decisions about the deployment and use of AI systems. Legislators hope that sufficient AI literacy will enable companies to generate the most benefit possible from AI while at the same time protecting the (fundamental) rights of affected individuals.

2. Who is affected?

The AI literacy obligation under Art. 4 AI Act applies to all providers and deployers of AI systems, regardless of the risk category of the system used or the industry and size of the company. According to the legal definition in Article 3(3) of the AI Act, the term “provider” includes actors who develop or have developed an AI system and place it on the market or put it into service. In contrast, according to the legal definition in Art. 3 No. 4 AI Act, deployers of AI systems are actors who use an AI system on their own authority, provided that this use does not take place in the context of a personal and non-professional activity.

3. What does Art. 4 AI Act require from providers and deployers?

The term “ a sufficient level of AI literacy” is not defined by law. However, the competent (German) supervisory authority has formulated a number of measures that are important for successfully establishing a sufficient level of AI literacy. These are:

• Needs assessment
• Action planning
• Continuous implementation
• Documentation

4. Practical implementation of the requirements under Art. 4 AI Act

Providers and deployers have considerable discretion in selecting and implementing measures to ensure a sufficient level of AI literacy. Providers and deployers have the option of choosing self-learning programs, workshops, training courses, or other continuing education programs tailored to their own business needs. Standardized training measures, external certification of the measures implemented, the introduction of an AI officer, or regular preliminary reviews by the supervisory authorities are neither mandatory nor necessary.

Based on the above criteria, companies should ask themselves the following questions when defining a strategy for expanding their own AI literacy:

• Determining individual needs: Who in the company comes into contact with AI systems and in which ways? Which AI systems are being developed or used, and for what purposes are they being used? What risks are associated with these AI systems?
• Planning measures: What is the status quo in the company with regard to AI literacy (e.g., training, experience, and knowledge level of employees)? In what context should AI be used, and what risks arise from this? What position does the company occupy in the AI value chain and what consequences does this have for the measures to be taken?

Following the needs analysis, the results must be put into practice:

• Implementation of measures: Integration of dynamic, continuous, and gradual skill development, according to the motto: “Everyone in the company should be able to develop AI skills, regardless of their current level of knowledge.”
• Documentation: Ongoing documentation of all measures implemented in terms of their type, content, duration, and the people involved.

5. What should companies do now?

Take stock now: Conduct a structured analysis of all AI systems and the personnel involved (internal and external). Identify skill requirements and assess risks.

Continuity instead of one-off: Establish sustainable learning structures. Ensure regular refresher courses and adjustments to technological and legal developments.

Documentation: Keep records of all AI literacy measures to demonstrate compliance, minimize liability, and improve AI literacy within the company.