Copy the ten clauses below and adapt the bracketed parts. An AI literacy policy should do three things: set literacy tiers tied to what each role does with agents, say how each tier is delivered and assessed, and require records that prove who reached which tier and when. The worked example shows one lender's version of the hardest clause.
Why a separate literacy policy?
Your AI policy says what the organisation will and will not do with AI. Your AI agent policy sets how agents are approved, bounded and monitored. Neither usually says who must know what before they touch an agent's work. That gap is where most problems start: a reviewer approves a held payment without knowing that an emailed invoice is external provenance and cannot authorise it.
A literacy policy closes that gap. It turns "staff should understand AI" into tiers, routes and records an auditor can test. For the underlying idea, see what AI literacy means.
How do you adapt it?
- Tiers. Define them by contact with agents, not seniority. A director who never approves a held action may need less than a team lead who does it fifty times a day.
- Delivery. Name the route per tier: reading, scenario tests, supervised live work, a certificate.
- Records. Name the system of record and the fields. The AI literacy training record template gives the fields.
- Consequences. State what happens when someone falls below their tier. Without this clause, the policy describes good intentions. The argument for it is in why your AI policy needs a training clause with teeth.
The policy template
- Purpose. This policy sets the AI literacy each role at [organisation] must hold before it reads, reviews, approves, builds or answers for the work of AI agents, and how that literacy is delivered, assessed and recorded.
- Scope. All employees, contractors and temporary staff whose work involves AI agents deployed by [organisation], and directors who oversee them.
- Owner. [Role] owns this policy. [Role] keeps the training records. [Role] reviews compliance quarterly.
- Tiers. - Tier 1, aware: anyone who reads agent outputs. Knows what depth, verdicts and provenance mean. - Tier 2, practising: anyone who edits or sends an agent's drafts (depth 2). Has passed a scenario test set in their role. - Tier 3, certified approver: anyone who releases held actions at depth 3 or 4. Holds a current professional certificate that includes supervised live practice. - Tier 4, builder: anyone who writes briefs, connects sources or submits agents for certification. - Tier 5, accountable lead: anyone who answers for a regulated or multi-agent deployment.
- Delivery. Each tier is reached by the route in Schedule A. Training time is paid working time.
- Assessment. A tier is reached only on a passed assessment, not on attendance.
- Records. For each person: tier, route, assessment result, date, credential number where one exists, expiry date, and the date it was last checked at source.
- Renewal. Tiers 3 to 5 lapse with the credential behind them. Tiers 1 and 2 are refreshed when an agent's depth or scope changes.
- Consequences. Approval rights at depth 3 and above are granted only to people holding a current Tier 3 credential or higher. When it lapses, the right is suspended the same day and held actions route to another approver.
- Review. This policy is reviewed every [12] months and whenever a new agent is deployed or an agent's depth is raised.
Schedule A lists, per tier: the route, the assessment, the pass standard, the credential issued and its validity.
A worked example: clause 9 at a lender
Take a sample consumer lender with an agent that drafts arrears payment plans at depth 2 and a second agent that releases small refunds at depth 4 within limits. Values are illustrative.
| Right | Tier required | Value limit | When the credential lapses |
|---|---|---|---|
| Send a drafted payment plan | Tier 2 | Not applicable | Drafts route to a Tier 2 colleague |
| Release held refunds | Tier 3 | Up to 1,000 | Suspended same day; team lead approves |
| Release held refunds above limit | Tier 3, team lead | Up to 10,000 | Suspended; head of operations approves |
| Change the refund agent's limits | Tier 4 and Tier 5 sign-off | Not applicable | No change until both are current |
The lender's Schedule A names a professional certificate as the Tier 3 route; Pryme Intelligence Academy's Certified Pryme Operator, which requires a written exam and a two-week practicum on real review decisions, is one that fits. People's certificates last 12 or 24 months depending on the credential, so clause 8 ties renewal to each certificate's own expiry rather than a fixed calendar date. More context is in the guide to AI literacy and certification for people who work with agents.
Questions people ask
Does every employee need Tier 1?
Only those whose work involves agents. Scope the policy to roles with real contact, and add people as agents reach their work.
Can a manager waive a tier for an urgent cover?
The policy should allow a named, time-limited exception for Tier 1 and 2 only, recorded with a reason. Never waive Tier 3 for approvals; route the held action to a certified approver instead.
Who should sign the policy off?
The executive who answers for the AI deployment, with risk and HR agreeing the consequences clause. If approval rights change, people need to know who decided.