What AI literacy actually means for HR?

AI literacy is becoming a familiar phrase in HR. But it is also easy to misunderstand. It can sound like another name for learning how to use ChatGPT, writing better prompts or attending an introductory AI course. Those skills can certainly be useful, but AI literacy in an organisational context goes much further. It is about people understanding the AI they work with well enough to use it effectively, recognise its limitations and risks, and make informed decisions about when — and when not — to rely on it. And for organisations operating in the European Union, there is another important reason HR should understand the topic: AI literacy is now part of the EU AI Act, and the requirement is already in force.

AI literacy under the EU AI Act: the essentials

Article 4 of the EU AI Act applies to organisations that provide AI systems (providers) or use AI systems in their work (deployers). For most employers, it is the second category that matters. Your organisation does not need to develop its own AI for the requirement to apply. If it uses AI systems provided by another company in its work, it may be considered a deployer under the AI Act.

Article 4 requires these organisations to take measures to support AI literacy among employees and others who use AI systems on their behalf. What people need to know should reflect their existing knowledge and experience, how AI is being used and who could be affected by that use. EU AI Act — Article 4

The requirement is not limited to high-risk AI systems. It is a broader AI literacy requirement. And importantly, it has applied since 2 February 2025. European Commission — AI literacy guidance So this isn't something to put on a future AI roadmap. If your organisation is already using AI, AI literacy is something to address now.

It is already relevant today.

The 2026 amendment did, however, make an important change. The original provision required organisations, to their best extent, to ensure a sufficient level of AI literacy. The current Article 4 instead requires them to take measures to support its development and explicitly says that they do not have to guarantee a specific level of AI literacy for every individual. Eur-Lex That gives organisations more flexibility. But it does not remove the requirement.

What does AI literacy actually mean?

The EU AI Act itself gives us a useful definition. It describes AI literacy as the skills, knowledge and understanding that enable providers, deployers and affected people to make informed use of AI systems while being aware of AI's opportunities, risks and potential harm. Eur-Lex

That is much broader than knowing how to operate a particular tool. For an employee, meaningful AI literacy might include understanding what AI can and cannot reliably do, recognising that confident-looking outputs can still be inaccurate, knowing how to critically evaluate results and understanding when human review is necessary.

It also means understanding the organisation's rules. Which AI tools are approved? What information can be entered into them? What data should not be uploaded? When does an output need to be checked? What uses are restricted or prohibited? What should an employee do when they are unsure?

Then the knowledge needs to become more specific according to the person's role and how AI is actually being used.

Someone occasionally using generative AI to brainstorm ideas for a presentation does not necessarily need the same depth of knowledge as an HR professional working with an AI-enabled recruitment system. Both may be using AI, but the potential consequences of using it incorrectly are very different.

One AI course for everyone is probably not enough

An introductory AI course can be an excellent starting point. It creates common language and gives employees a basic understanding of the technology. But treating one general course as the entire AI literacy programme misses an important part of Article 4. The requirement is deliberately contextual.

An organisation should consider people's existing knowledge and experience and the circumstances in which AI is being used. Eur-Lex The goal isn't necessarily to provide more training. It is to provide the right learning to the right people.

But is this actually HR's responsibility?

Not alone, depending on the organisation, Legal, Compliance or Risk may lead the interpretation of regulatory requirements. IT, Data, Information Security and Data Protection may be responsible for understanding systems, access, privacy and technical risks. Business managers understand how AI is actually being used within their teams. But none of those functions can build organisational AI literacy alone. AI literacy is also a people capability issue.

Someone needs to understand what different employee groups need to learn, how capability differs by role, how managers should be prepared, how jobs and skills are changing, how learning will be delivered and how new expectations become part of everyday work. That is where HR and Learning & Development have a significant role.

The Chartered Institute of Personnel and Development (CIPD) — the professional body for HR and people development — goes further in its 2026 guidance, arguing that people professionals should be involved in AI governance wherever AI deployment affects people, not simply when AI is embedded in an HR system. CIPD

So the practical model is a shared one: Legal / Compliance / Risk interpret requirements and regulatory risk; IT / Data / Security understand technology, systems and data; HR / L&D translate this into people capability, learning and workforce practices; Managers ensure expectations are understood and applied in everyday work. HR doesn't need to become the organisation's AI lawyer, but HR does need enough understanding to be an informed partner.

What are other organisations doing?

There is no need to invent an AI literacy approach completely from scratch. The European Commission maintains a repository of AI literacy practices containing more than 40 initiatives from companies and public-sector organisations. The examples include e-learning, face-to-face training, bootcamps and collaboration between organisations and academia. Digital Strategy

The Commission is careful about how these examples should be interpreted: copying a practice from the repository does not automatically demonstrate compliance with Article 4. They are examples intended to support learning and exchange. Digital Strategy

But they do demonstrate something useful. AI literacy does not need to mean one standard classroom course.Organisations are experimenting with different formats, audiences and levels of learning — which makes sense when AI use itself differs so significantly between roles.

The same broader approach appears in work from the Organisation for Economic Co-operation and Development (OECD), an international organisation that produces research, analysis and policy guidance on areas including employment, skills, education and technology.

Its July 2026 report Skills in the AI Age argues that most workers will not require advanced AI expertise, but they do need sufficient literacy to interact effectively with AI. It describes AI literacy as including the ability to critically evaluate AI technologies, communicate and collaborate with AI and understand issues such as ethics, risks and potential harm. OECD

This is an important distinction for HR. We don't need to turn the workforce into AI specialists. We need to build enough capability for people to use AI competently and responsibly within their work.

Training without governance isn't enough

There is another piece HR should not overlook. Imagine an employee has completed excellent AI training. They understand prompting, know that AI can generate inaccurate information and understand the importance of checking outputs. But they don't know whether they are allowed to upload employee information into the tool they are using. The organisation still has a problem.

AI literacy therefore works best alongside clear AI governance: approved tools, acceptable-use rules, data boundaries, prohibited or restricted uses, human-oversight expectations and clear escalation routes. This matters particularly in HR because AI may be used around decisions affecting real people — recruitment, employment, performance, task allocation, development or other aspects of working life.

Under the AI Act, certain AI systems intended for employment and worker-management purposes can fall within the high-risk AI framework. This includes certain systems used for recruitment or selection and some systems used to make decisions affecting employment relationships, allocate tasks based on individual behaviour or characteristics, or monitor and evaluate workers. The exact classification depends on the system and its intended purpose, so not every AI tool used somewhere in HR is automatically high-risk. Eur-Lex That is why AI literacy and AI governance should not be treated as two unrelated projects. People need to understand both how to work with AI and the boundaries within which it should be used.

What should HR do now?

For HR teams, I would make the starting point very practical.

Find out where AI is already being used.
Don't start with a training catalogue. Start with reality. Identify AI systems supplied by the organisation, AI functionality embedded in existing software and, as far as reasonably possible, general-purpose AI tools employees are already using for work.
Understand how people are using it.
Using AI to improve wording is very different from using AI to analyse employees or influence employment decisions. Look at the purpose, data involved, potential impact and people affected.
Agree ownership.
Clarify who owns AI governance and Article 4 implementation. HR may be a major contributor, but Legal, Compliance, Risk, IT, Data Protection, Information Security and business leadership may all need to be involved.
Group people according to what they actually need to know.
A basic foundation may be appropriate for everyone. Then identify managers, frequent AI users, HR teams, system owners and people working with higher-impact AI who need deeper capability.
Connect learning to real organisational rules.
Employees should leave training knowing more than what AI is. They should know which tools they can use, what data they can enter, what needs human review, what they should not do and where to ask for help.
Keep evidence.
Document the measures taken: training, guidance, communications, policies and role-specific interventions. The Commission's current guidance does not prescribe a specific AI literacy certificate, so organisations have flexibility in how they demonstrate the measures they have taken. Digital Strategy
Review it.
AI literacy is unlikely to be a one-time compliance exercise. Tools change, employees discover new uses, roles evolve and regulation develops. Capability should evolve with them. This does not need to become another huge HR programme. It needs to become a deliberate one.

The bigger opportunity

It would be easy to approach Article 4 as another regulatory requirement: create a course, record attendance and consider the job finished. But that would miss much of its value. Employees are already experimenting with AI. Managers are beginning to work out what it means for their teams. Organisations are introducing AI functionality into existing systems, sometimes without employees even thinking of those systems as “AI”. The real opportunity is to build a workforce that understands enough to make better decisions about the technology.

People who know where AI can help.People who recognise when an output should be questioned. Managers who understand that using AI does not remove their accountability. HR professionals who can recognise when AI moves from a productivity tool into something that may affect employees' rights, opportunities or working lives. And organisations that have clear enough governance that people know where the boundaries are.

That is what meaningful AI literacy looks like: not knowing everything about AI, but knowing enough to use it effectively, question it critically and understand when human judgement needs to take over.

Want to go deeper?

AI literacy is only one part of becoming AI-ready. In my book, AI-Ready HR: A Practical Guide to Implementing Artificial Intelligence Across the HR Function, I explore the wider journey — from understanding AI fundamentals and preparing an organisation for adoption to practical applications across HR, building HR AI assistants and implementing AI responsibly.

If you're trying to understand not only what HR needs to know about AI, but how AI literacy, adoption, governance and practical HR application fit together, the book takes these topics further. Explore AI-Ready HR