EU AI Act: Are you AI literate enough?

The first rules under the EU’s Artificial Intelligence Act (AI Act) started to apply on Sunday 2 February. This includes the AI system definition, AI literacy, as well as a very limited number of prohibited AI use cases that are deemed to pose unacceptable risks in the EU.

What is AI literacy?

AI literacy is defined as the “skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause”. 

In other words, AI literacy is an ability to correctly use, understand and evaluate AI systems, as well as being able to assess the associated risks that come with it.

AI literacy is an ability to correctly use, understand and evaluate AI systems

The Act provisions include a duty on companies to introduce AI literacy into their organisations, through appropriate training and awareness programmes.

Does the AI literacy article apply to me?

The AI literacy obligation applies to the providers and deployers of any AI system. This means that even if a company does not develop its own AI systems but only uses applications such as Chat GPT or AI programmes for admin purposes, it still must comply with the AI literacy obligation. Employees, or anyone else working with that organisation, who are using AI systems must be properly trained for the specific use in the company context and be able to comply with all requirements set out in the Act.

Does the size of an organisation matter?

Article 4 of the AI Act requires organisations to, “ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”. That means the likely the size and resources of the organisation will be considered when determining what is a compliant level of AI literacy under the AI Act. 

While the AI Act’s obligations on AI literacy take effect on 2 February 2025, its provisions on penalties for non-compliance will only apply six months later, on 2 August 2025. Before then, the main form of enforcement is likely to be private litigation, until EU Member states impose own enforcement measures and sanctions. That provides a bit of a cushion, time that could be used to prepare.

What should I do now?

• Consider the compliance approach and whether all actors within the organisation and its value chain are appropriately covered; make sure your internal communications on the topic are easy to understand and actionable
• Communicate to employees what is expected of them and provide necessary awareness courses and trainings
• Communicate externally to third party vendors and contractors to ensure compliance with the AI literacy requirements of the Act
• Tailor AI literacy measures to internal company functions
• Monitor the development of the EU’s proposed AI Liability Directive, which will establish separate rules of liability with regards to AI systems
• Observe further guidance on AI literacy that is expected to come both from the EU level and, in time, from national authorities and implement it within your operations and in all your communications.

Every organisation has a duty to ensure it can use AI programmes safely. And since this is a legal obligation, it is also important to be seen to be complying, both internally and externally. We can all recognise that AI is now a central feature of all out lives: let’s be clear and transparent about it.

If you have any questions on how to use AI effectively in your communications or public affairs activities, contact us using the form below.