AI literacy is the working knowledge a person needs to oversee an AI agent safely: what the agent may do, why an action was held or refused, when to say no, and how to read the record. Certification turns that knowledge into evidence: a dated, checkable statement that a named person can do this work today.
What does AI literacy mean for people who work with agents?
Literacy is not knowing how a model works inside. A reviewer on an accounts payable desk does not need to explain attention mechanisms. They need to read a held payment, see which bound held it, check where each fact came from, and decide in a way a colleague could follow a month later.
For people who work beside governed agents, literacy has six practical parts:
- Depth. Knowing that an agent's authority is set per capability, from 1 (read) to 5 (coordinate other agents), and that a capability at depth 2 drafts while a person sends.
- The decision chain. Knowing that every action meets five bounds at once (role scope, certificate, sources, the customer's own limits and the platform guardrails), that the lowest wins, and that the verdict names which bound decided.
- Verdicts. Telling the difference between allowed, held, refused and withheld, and knowing that withheld is a platform decision nobody in the business can switch off.
- Provenance. Weighing a sealed ledger balance differently from an emailed claim, because an external fact cannot authorise a payment.
- Lapse. Knowing that an agent's certificate lapses after 90 days and that a run that clears no depth drops it to depth 1 the same day, so yesterday's routine work may be held today.
- The record. Knowing that every verdict is filed, so every approval a person gives is part of a reconstructable history.
A person who has these six can supervise an agent. A person who lacks them will either approve what they should question or block what they should let through.
What does the EU AI Act require on AI literacy?
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, with obligations phasing in over several years. Article 4 places an AI literacy duty on both providers and deployers. In substance, they must take measures to ensure a sufficient level of AI literacy among their staff and others who operate or use AI systems on their behalf, taking account of those people's knowledge, experience and training, the context of use, and the people the system affects.
Three things follow. The duty sits with the organisation using the agent, not only with whoever built it. "Sufficient" depends on the role and the context, so a single company-wide video rarely meets it. And it sits beside the deployer obligations in Article 26 and human oversight in Article 14: oversight is only real if the people doing it understand what they are overseeing. The argument for treating this as an obligation rather than a benefit is made in why AI literacy is a duty, not a perk.
Outside the EU the wording changes but the expectation does not. The UK takes a principles-based, regulator-led approach, and under the Senior Managers and Certification Regime named individuals answer for what happens in their area. In Australia, APRA CPS 230 asks regulated entities to manage operational risk, including the people who run critical operations; APRA CPS 230 and staff capability for AI agents sets out what that means for teams running agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Does every role need the same literacy?
No. Everyone needs the shared vocabulary, but what each person must be able to do differs by what they approve and what they own.
| Role | Must be able to | Evidence it leaves |
|---|---|---|
| Executive or owner | Explain depth, the decision chain and what the business is accountable for | A recorded test result and signed accountability map |
| Reviewer or approver | Decide held actions correctly, refuse with a written reason, never miss a red line | Review decisions with reasons in the record |
| Team lead | Spot drift in reviewer decisions, run calibration, act when a certificate lapses | Calibration notes and rota changes |
| Builder | Brief an agent, choose its sources and bounds, take it through certification | Agent certificates and change log |
| Risk or compliance owner | Map agents to obligations and test that controls work | Assessment records and audit findings |
A skills matrix for an AI agent team turns this table into a working document: one row per person, one column per skill, with the date each skill was last shown.
Why certify people instead of only training them?
Training proves attendance. Certification proves performance. If an agent drafts a payment, a reviewer approves it and the payment is wrong, the question is not whether the reviewer sat a course. It is whether they were competent to approve that payment on that day.
That question lands on individuals. The piece on whether accounts payable clerks are accountable for an AI agent's mistakes works through it: the person who approves a held action owns the approval, which is only fair if the business made sure they could do it. A certificate that rests on real review decisions, not quiz answers alone, is the fairest proof for both sides.
Certification also gives the business a lever it otherwise lacks. A business can adopt the practice of tying approval rights to a current certificate, depth by depth: only certified reviewers approve depth 4 payments, and when a certificate lapses, so does the right. Agents already work this way. Their authority rests on a certificate that expires, and people who approve their actions can be held to the same standard.
What makes a certificate worth trusting?
A certificate is only as good as the check behind it. Four properties separate a useful one from a decorative one.
- It names what the person did to earn it. An exam alone shows knowledge; an exam plus a practicum of real decisions shows skill.
- It expires. Products change, agents gain depth and policies move. A certificate with no end date says what someone could do once.
- It can be checked at source. Anyone can confirm with the issuer, by number or QR code, that it is genuine and current. What checking a certificate at source means explains why a PDF on a shared drive is not enough.
- Lapse and revocation show. A lapsed or revoked certificate must say so on the same page a valid one would.
Inside the business, keep a register of who holds what and when it expires. The AI agent certificate register template gives fields for both the agent certificates and the people certificates, side by side, so a team lead sees in one view whether the agent and the person approving it are both current.
How do literacy and certification fit into deploying an agent?
They come first, not last. The sequence that works is the one set out in deploying an AI agent: train, shadow, certify, widen. Train the reviewers before the agent drafts anything. Let the agent shadow the work while reviewers practise on real cases. Certify the agent in Attest and certify the reviewers on their decisions. Only then widen the agent's depth.
The order matters because depth outruns people. An agent can be certified to execute routine work at depth 3 well before the people who handle its held cases have seen enough of them to judge well. If the reviewers lag, the business ends up with an agent ready for more depth and a team that cannot safely give it.
Renewal follows the same logic. When the agent's certificate is renewed every 90 days, look at whether the people overseeing it are still current too. A reviewer who has been on leave for three months, or who moved desks, may hold a valid certificate and still be out of practice; a short refresher on what changed is cheaper than a missed red line.
Where the Academy fits
Pryme Intelligence Academy builds literacy in four tracks. Foundations, about four hours and free, gives anyone the vocabulary and earns a badge stamped with the product version. Operator certifies reviewers and team leads through a written exam and a two-week practicum of real review decisions, signed off by a Pryme assessor. Certificates are issued through VerifyDoc.ai, can be checked at source by number or QR code, and show plainly when lapsed or revoked.
Questions people ask
Is a general AI awareness course enough to meet the literacy duty?
Usually not on its own. The duty asks for a sufficient level of literacy for the context of use, and a reviewer approving payments needs more than general awareness. Use broad courses for the shared vocabulary, then role-specific training and assessment for the people who approve, own or build agents.
How often should people be recertified?
Match recertification to how fast the work changes. Agent certificates lapse after 90 days because operations drift; people certificates usually run for a year with a short update when the product or policy changes. Recertify sooner when someone changes role or returns from a long absence.
Who should own AI literacy inside a business?
The owner of the operation the agent works in, supported by learning and development and checked by risk. Learning teams can run the programme, but only the operational owner knows what a good decision on a held case looks like. Make one named person accountable for keeping the register current.