The EU AI Act made AI literacy a board question

Article 4 of the EU AI Act turned AI literacy from a training budget line into an obligation on the organisation. Providers and deployers must take measures to ensure sufficient literacy among staff dealing with AI systems on their behalf. Organisational obligations belong to the board, so directors must ask who needs literacy and how anyone knows they have it.

Why does an obligation on the organisation land with the board?

Most training decisions sit comfortably with HR or learning and development. They choose courses, track completions and report attendance once a year. Boards rarely look closely, because training is a means to an end that the board oversees through other measures.

Article 4 changes that because it is not a recommendation about good practice. The EU AI Act, which entered into force on 1 August 2024, places the literacy duty on providers and deployers as legal entities. The measures must take account of people's technical knowledge, experience, education and training, and the context in which the AI systems are used. That is a judgement about risk and proportionality, and judgements about how the organisation meets its legal obligations are what boards are for.

There is a practical reason too. When a regulator or a claimant asks whether the organisation met the duty, the answer will be given by the organisation, not by the L&D team. Directors who never asked the question will struggle to show they discharged their oversight.

What should a board actually ask?

Not "have we done AI training?" That question invites a completion percentage and nothing else. Better questions:

1. Who deals with AI systems on our behalf, and in what capacity? A person who reads an agent's summaries is in a very different position from one who approves the payments it prepares. The piece on who needs AI literacy under the EU AI Act works through the categories.
2. What level does each group need, and why? The answer should be proportionate to the decisions people make, not uniform.
3. How do we know they have it? Attendance is not evidence of literacy. A test set in the person's own industry and role, drawn from a maintained question bank, is much better; observed work is better still for people who approve.
4. Is it current? Agents change, depth changes, the product changes. Literacy measured at launch may not hold.
5. What happens when it lapses? If someone's standing lapses, do their approval rights pause, or does nothing change?

These are not technical questions. A board can ask them without understanding how a model works, and the answers will tell it whether the duty is being met in substance.

Does the board itself need literacy?

Yes, and that is the uncomfortable part. A board cannot oversee an organisation's AI literacy if its members cannot follow the answers. Directors do not need to review held actions, but they should understand what an agent is allowed to do, how its authority is earned and limited, what the record shows and what would count as a serious failure. Without that, board discussion of AI drifts between enthusiasm and anxiety with nothing in between.

How does this play out in different sectors?

The duty is the same everywhere; what it means in practice is not. In banking, staff who oversee agents dealing with credit, payments or fraud need deep, role-specific competence, and creditworthiness assessment of individuals is a high-risk use under Annex III, which adds human oversight duties. The piece on AI literacy for agents in banking covers that. In e-commerce, the focus is often on customer-facing agents handling refunds, returns and complaints, with transparency to customers under Article 50; see AI literacy for agents in e-commerce.

A board should expect its management to explain how the general duty has been translated into the organisation's own sector and roles. A generic course bought off the shelf is a sign that translation has not happened.

What is the trade-off?

Pulling literacy up to board level risks two kinds of distortion. One is micromanagement: directors debating course content they are not equipped to judge. The other is theatre: a polished dashboard of completion rates that satisfies the board while saying nothing about competence.

There is also a cost. Proper measurement, with role-specific tests and observed work for approvers, takes more time and money than a single awareness course.

The answer is for the board to own the questions and the evidence standard, and leave the delivery to management. Directors should insist on evidence that would survive scrutiny: scores by concept and role, not just completion; current certificates for approvers, checkable at source; and a clear rule for what happens on lapse. If management cannot produce that, the board has learned something important.

For a fuller treatment of what the Act itself requires, see whether the EU AI Act requires AI literacy training.

What should a board do differently?

Put AI literacy on the risk committee's agenda at least annually, with a named executive responsible. Ask for a map of roles to literacy levels, with the reasoning. Ask for evidence of competence, not attendance, and for approvers, current certificates. Ask what happens when standing lapses. And make sure the directors themselves have had a grounding good enough to understand the answers. The guide to AI literacy and certification for people who work with agents gives a structure management can report against.

Where the Academy fits

Pryme Intelligence Academy offers a free readiness assessment for teams of up to 25 people: the team takes the Foundations test set in its industry, and the report shows scores by concept, the gaps and the first agent to start with. That is the kind of evidence a board can read. Foundations itself, about four hours, suits executives and directors who need a grounding.