Map everyone who supervises, approves or answers for an agent, including contractors. Write down what "sufficient" understanding means for each role and each agent they work with, train against it with real cases, assess it, and refresh it when an agent's depth or scope changes. Records per person are your evidence that the EU AI Act's literacy duty is met.
What does the AI literacy duty require?
Article 4 of the EU AI Act asks providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other people dealing with the operation and use of AI systems on their behalf. What counts as sufficient depends on those people's technical knowledge, experience, education and training, and on the context in which the systems are used and the people they affect.
It is a principle, not a syllabus. The Act does not prescribe a course or an exam. It asks you to make a reasoned judgement about what each group needs and to act on it. The concept is explained in what AI literacy is, and the legal provision in EU AI Act Article 4 AI literacy for teams that supervise agents.
Whether it applies to your supervisors is covered in does EU AI Act AI literacy apply to staff who supervise agents?. For most deployers using agents in operations, the practical answer is that staff who approve, review or oversee agents are among the people the duty is aimed at.
Who needs what?
Different roles need different understanding. A sensible split:
- Approvers of held items need to read a proposal critically, understand what the agent's verdicts and provenance labels mean, and know they may and should reject.
- Quality reviewers need to know the agent's typical errors and how to classify them.
- Agent owners need to understand depth, certification, bounds and what their own decisions change.
- Agent operations staff need the operational detail: runbooks, logs, depth changes, rollback.
- Risk and compliance need enough to challenge: how classification, certification and monitoring work.
- Senior managers accountable for areas using agents need to understand what they are answerable for.
- Contractors and outsourced staff who do any of the above need the same as the role they fill.
The specific needs of people who approve agent actions are covered in Article 4 AI literacy for staff who approve agent actions.
What are the steps, and what evidence does each leave?
- Compliance and HR: build the role map: every person who supervises, approves, reviews, owns or operates an agent, by role and by agent. Evidence: the role map.
- Agent owners: define "sufficient" per role and agent. A short statement of what each role must understand about the specific agent, given its depth and the people it affects. Evidence: the literacy standard.
- Agent, depth 1: assembles case material from its own records: held items, rejections, errors found in sampling, refusals.
- Team leaders and learning staff: build and deliver training against the standard, using the real cases. Evidence: content and attendance.
- Team leaders: assess each person before they take on the role. Evidence: assessment results.
- HR or learning: record completion per person, role and agent. Evidence: the literacy register.
- Agent operations: triggers refreshers when an agent's depth, scope or sources change materially, and at a set interval. Evidence: refresh dates against change dates.
- Compliance: reviews the programme yearly and reports to the accountable executive. Evidence: the review.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Role map | Lists approvers and reviewers from its roster | 1 | Completing the map |
| Standard | Nothing | none | Agent owners |
| Case material | Assembles from records | 1 | Choosing cases |
| Training | Nothing | none | Delivering |
| Assessment | Nothing | none | Team leaders |
| Register | Nothing | none | HR or learning |
| Refresh triggers | Flags depth and scope changes | 1 | Scheduling |
| Review | Nothing | none | Compliance |
Why tie literacy to a specific agent?
Because general AI awareness does not help an approver decide whether to release a held refund. What helps is knowing that this agent tends to misread one kind of document, that facts labelled "external" have not been verified, and that the bound that held this item was the customer's value limit. Generic training satisfies a checkbox; agent-specific training makes oversight real.
That is also why literacy must be refreshed when depth changes. An approver trained when the agent held every refund needs different understanding when it releases small ones itself and holds only the larger.
How does this fit with your other deployer duties?
AI literacy is one of several duties a deployer carries. For high-risk uses, others include using the system in line with its instructions, assigning human oversight to people with the competence and authority to exercise it, and monitoring operation. Literacy underpins the oversight duty: oversight by someone who does not understand the system is not oversight. The full set is in how to meet deployer obligations for an AI agent, and the wider map in AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What are the signs it is going wrong?
One course for everyone. A general e-learning module is assigned to all staff and recorded as complete. No one learns how to approve a held item.
Contractors are left out. An outsourced team approves held items but sits outside the learning system.
Records show attendance, not understanding. There is no assessment, so there is no evidence of sufficiency.
Training stops after launch. Depth widens, new capabilities arrive, and the people supervising them were trained for an earlier version.
Approvers never reject. The clearest sign that literacy is not translating into oversight.
What does the duty not require?
It does not require staff to understand model internals, write code or become specialists. It does not require a certificate from an external body. It requires a reasonable, documented effort to give each person the understanding their role needs.
Questions people ask
Does the duty apply outside the EU?
Article 4 applies to providers and deployers within the Act's scope. Firms outside the EU whose systems are used in the EU should check with counsel. Elsewhere, similar expectations often arise from general rules on competence and oversight.
How often should literacy be refreshed?
At every material change to the agent, and at a fixed interval. Matching the agent's certificate cycle is a practical rhythm, since each renewal is a natural point to check what the agent now does.
Can the agent train staff itself?
It can supply real cases and answer questions about its own configuration. The training standard and the assessment should be owned by people.