AI literacy duties are easy to treat as a box to tick: buy a course, record completions. For staff who supervise AI agents, that misses the point. The question is whether they understand the system well enough to catch its errors and stop it. That is competence in a role, shown in how people decide, not attendance.
What does the law actually ask for?
The EU AI Act, in Article 4, requires providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and others dealing with the systems on their behalf. It ties what is sufficient to people's technical knowledge, experience, education and training, and to the context in which the systems are used. Our explainer on what AI literacy is covers the concept, and our page on EU AI Act Article 4 for teams that supervise agents goes deeper into the text.
Two other parts of the Act sharpen the point for agents. Article 14 requires high-risk systems to be designed for effective human oversight. Article 26 requires deployers of high-risk systems to assign that oversight to people with the necessary competence, training and authority. Read together, literacy is not general awareness; it is what makes oversight effective.
Outside the EU, there may be no specific literacy duty, but supervisors in most markets expect firms to show that people overseeing automated decisions are competent to do so. The UK's principles-based approach, for example, relies on firms showing how they meet outcomes, which includes having capable people in control.
Why does a general course fall short?
Because supervision is specific. A course on how AI works, what large language models are and what risks they carry gives people useful vocabulary. It does not tell a reviewer how to judge a held refund, a capability owner how to read certification results, or an operations lead when to lower an agent's depth.
A course also produces the wrong evidence. Completion records show that people sat through material. They do not show that anyone can supervise. If a regulator or auditor asks whether the people overseeing an agent could recognise its failures and stop it, a list of completion dates is a weak answer.
What does each supervisory role need to understand?
Literacy should be defined by role, because each role supervises something different.
| Role | What they must understand | How competence is shown |
|---|---|---|
| Named approver | Why items are held, how to read sources and provenance, agent-typical errors, when to refuse | Calibration results on real cases; decision quality on second review |
| Capability owner | What depth means, how evidence is gathered and scored, when to widen or narrow | Recorded widening and narrowing decisions with evidence attached |
| Agent operations lead | Verdict patterns, refusals by bound, certification cycles, incident response | Queue health, timely renewals, incident handling records |
| Risk and compliance | How bounds are enforced, what the record shows, where controls can fail | Testing performed against the record |
| Senior manager accountable | What agents may do in their area, who answers for each, what evidence exists | Ability to explain authority and evidence to a supervisor |
Each row is about understanding this agent in this process, not AI in general. Our guide on meeting AI literacy duties for staff who supervise AI agents sets out how to build the programme.
Does Article 4 apply to people who supervise agents?
The duty covers staff and others dealing with the operation and use of AI systems on the organisation's behalf, which plainly includes people who approve an agent's held actions and people who set its authority. Our page on whether EU AI Act AI literacy applies to staff who supervise agents explores the edges of the scope, and Article 4 for staff who approve agent actions looks at approvers in particular.
The more useful question is not whether the duty applies, but whether your supervisors could do their job if an agent started going wrong tomorrow. That question applies everywhere, whatever the law says.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How should competence be built and evidenced?
On real work. People learn to supervise agents by reviewing the agent's actual output with guidance, comparing decisions with colleagues and seeing what they missed. Calibration sessions on real cases, paired review for new approvers, and walkthroughs of real incidents build competence faster than any general course.
The evidence comes from the same activities. Calibration results show whether approvers catch what they should. Second reviews of a sample of approved items show decision quality over time. Records of widening and narrowing decisions show whether owners use evidence. Incident reviews show whether the operations lead acted in time. Together, these are a far stronger answer to "is your oversight competent?" than completion certificates.
A general course still has a place, as a foundation for everyone who touches AI systems. It is the start of literacy for supervisors, not the end.
What is the trade-off?
Role-based, practice-led literacy costs more than a course licence. It needs real cases, people to run calibration, time away from the queue and a way to record results. It also exposes weaknesses: some supervisors will turn out not to be ready, which is uncomfortable but better found in calibration than in an incident.
A course alone is cheaper and much easier to report. It is also unlikely to satisfy anyone who asks whether oversight works. For each role that supervises your agents, write down what that person must understand, how you will build it on real work and how you will show it. Then retire completion counts as your main evidence. The wider mapping of these duties to controls is in our guide to AI agent regulation, mapped to controls.
Questions people ask
Does everyone in the organisation need the same AI literacy?
No. The Act ties sufficiency to people's roles and the context of use. A general foundation for all staff is sensible, with deeper, role-specific competence for those who supervise, approve or own agents.
How often should supervisory competence be refreshed?
Whenever the agent, its capabilities or its sources change significantly, and on a regular schedule otherwise, such as quarterly calibration for approvers. Competence on yesterday's agent may not transfer to today's.
Can an external certificate demonstrate AI literacy?
It can show general knowledge. It cannot show that someone can supervise your agent on your process. Combine any external learning with evidence from real work.