# AI Literacy Plan: [Organisation name]

> Plan for building and evidencing AI literacy among the staff and other
> people who operate or use AI systems on behalf of [Organisation name].
> Structure follows the AI literacy obligation in Article 4 of Regulation
> (EU) 2024/1689 (the EU AI Act), applicable since 2 February 2025, as
> amended by Regulation (EU) 2026/1744 (the "Digital Omnibus on AI",
> in force since 27 July 2026), which frames the duty as taking measures
> that support AI literacy rather than guaranteeing a level for each
> person. Replace every `[bracketed]` value and every row marked
> *Example*. This is a documentation format, not legal advice.

<!--
Guidance: How to use this template
- Start with the AI systems inventory (section 3): literacy needs follow
  from which systems people use and who is affected by them.
- Define roles by what people do with AI (section 4), not by job title.
- Keep records (section 7) from day one; regulators and auditors ask
  what was done, for whom and when, not what was intended.
- Re-read the current consolidated text of Article 4 and any Commission
  guidance or AI Board recommendations before approving the plan.
-->

| Field | Value |
|---|---|
| Plan ID | [AIL-PLAN-001] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Plan owner | [@ai-governance-lead] |
| Approved by | [Executive sponsor or AI governance committee], YYYY-MM-DD |
| Effective date | YYYY-MM-DD |
| Next review | YYYY-MM-DD |
| Organisation role under the AI Act | [Provider / Deployer / Both] |
| Related documents | [AI acceptable use policy], [AI use case intake register], [AI risk assessment], [Training policy] |

## 1. Purpose and legal basis

<!-- Guidance: State why the plan exists in a few sentences. Cite the legal basis without paraphrasing it into a stricter or weaker duty than the text. Common mistake: promising certification of every individual, which the amended text does not require. -->

This plan sets out the measures [Organisation name] takes to support the
development of AI literacy among the people who operate or use AI systems
on its behalf. It responds to Article 4 of the EU AI Act, which applies
to providers and deployers of AI systems, and to [internal policy
reference]. The measures take into account people's technical knowledge,
experience, education and training, the context in which the AI systems
are used, and the people or groups the systems affect.

AI literacy in this plan means the skills, knowledge and understanding
that allow people to use AI systems in an informed way, to understand
their opportunities and risks, and to recognise possible harm. The plan
does not promise that every individual reaches a specific level; it
commits the organisation to proportionate, documented measures.

## 2. Scope

<!-- Guidance: Name who is in scope. The Article covers staff and other persons dealing with the operation and use of AI systems on the organisation's behalf, so include contractors, temporary staff and service providers where relevant. -->

| Group | In scope | Notes |
|---|---|---|
| Employees using AI tools in daily work | Yes | All business units |
| Employees building, configuring or buying AI systems | Yes | Product, engineering, data, procurement |
| Contractors and temporary staff operating AI on our behalf | Yes | Via contract clause and onboarding |
| Outsourced service providers operating our AI systems | Yes | Contractual evidence of equivalent training |
| Board and executive committee | Yes | Oversight-level module |
| Customers and end users of our AI products | No (separate transparency measures) | Covered by product disclosures |

*Example:* "In scope are all 2,340 employees and 180 contractors with
access to the approved AI tools register, plus the 12-person vendor team
operating the claims triage model."

## 3. AI systems in use

<!-- Guidance: Link to the inventory instead of duplicating it. List the systems that drive the training content and the risk context. -->

The literacy content is tailored to the following systems. The full list
is held in [AI system inventory link].

| System | Type | Our role | Risk context | Users |
|---|---|---|---|---|
| *Example:* Enterprise chat assistant | General-purpose AI tool | Deployer | Confidential data in prompts, hallucinated facts | All staff |
| *Example:* Code assistant | General-purpose AI tool | Deployer | Licensing of suggestions, insecure code | 410 engineers |
| *Example:* CV screening ranker | Annex III area (employment) | Deployer | Possible high-risk use; discrimination risk | 25 recruiters |
| [System] | [Type] | [Provider / Deployer] | [Key risks] | [Group, headcount] |

## 4. Roles and required competence levels

<!-- Guidance: Define three to five roles by what people do with AI. For each, set a target competence level and the outcomes that show it. Common mistake: one generic course for everybody. -->

Competence levels used in this plan:

- **Level 1, Aware**: understands what AI is, where it is used in the
  organisation, the main risks, and the rules that apply to them.
- **Level 2, Practitioner**: uses approved AI tools safely and checks
  outputs critically for their own work.
- **Level 3, Specialist**: designs, configures, evaluates or oversees AI
  systems and can explain their limitations to others.
- **Level 4, Accountable**: makes decisions on AI use, risk acceptance
  and oversight, and understands the organisation's legal obligations.

| Role ID | Role | Description | Target level | Example outcomes |
|---|---|---|---|---|
| R1 | All staff | Uses AI features embedded in standard software | 1 | Can name the approved tools and the data that must never enter a prompt |
| R2 | AI tool users | Uses general-purpose assistants for drafting, analysis or code | 2 | Verifies facts and sources; records AI assistance where policy requires |
| R3 | Human overseers | Reviews or acts on outputs of systems that affect people | 3 | Recognises automation bias; knows when and how to override or escalate |
| R4 | Builders and buyers | Develops, configures, evaluates or procures AI systems | 3 | Runs an intake and risk assessment; reads a model card critically |
| R5 | Leaders | Approves AI use cases and accepts risk | 4 | Explains provider and deployer duties; challenges a risk assessment |

## 5. Training curriculum per role

<!-- Guidance: Map modules to roles. Keep each module short and concrete, with examples from your own systems. Mark mandatory and optional modules and the expected duration. -->

| Module ID | Module | Content | R1 | R2 | R3 | R4 | R5 | Duration |
|---|---|---|---|---|---|---|---|---|
| M01 | AI basics | What AI and generative AI are; how models learn; typical errors | M | M | M | M | M | 30 min |
| M02 | Our rules | Acceptable use policy, approved tools, data classification for prompts | M | M | M | M | M | 20 min |
| M03 | Using assistants well | Prompting, verifying outputs, citing sources, confidentiality | O | M | M | M | O | 45 min |
| M04 | Risks and harms | Bias, privacy, security (prompt injection), intellectual property | O | M | M | M | M | 45 min |
| M05 | Human oversight | Automation bias, override procedures, logging decisions, escalation | - | O | M | M | O | 60 min |
| M06 | Building and buying AI | Intake, risk tiering, evaluation, model cards, vendor questions | - | - | O | M | O | 2 h |
| M07 | The EU AI Act for decision makers | Roles, risk categories, prohibited practices, transparency, incidents | - | - | O | M | M | 60 min |
| M08 | System-specific briefing | Intended purpose, limits and instructions for use of one system | - | - | M | M | - | 30 min per system |

M = mandatory, O = optional, - = not applicable.

## 6. Delivery

<!-- Guidance: Say how, when and by whom training is delivered, including onboarding, accessibility and languages. -->

- **Format**: [e-learning in the learning management system], live
  workshops for R3 to R5, and system briefings recorded with the
  instructions for use.
- **Timing**: new joiners complete mandatory modules within [30] days of
  starting and before receiving access to AI tools; contractors before
  first access.
- **Gating**: access to [approved AI tools] is granted only after M01 and
  M02 are recorded as complete.
- **Languages and accessibility**: delivered in [languages]; materials
  meet [accessibility standard]; reasonable adjustments on request.
- **Trainers**: [internal AI governance team], [external provider] for
  M07, system owners for M08.

## 7. Records and evidence

<!-- Guidance: Decide what evidence you keep, where and for how long. Records are the main way to show that measures were taken. -->

| Record | Content | System | Retention | Owner |
|---|---|---|---|---|
| Completion record | Person, role, module, date, score | [LMS] | [Employment + 3 years] | [@hr-learning] |
| Contractor attestation | Supplier confirms equivalent training | [Vendor portal] | [Contract + 3 years] | [@procurement] |
| Material version | Module version, change log, reviewer | [Document repository] | [5 years] | [@ai-governance-lead] |
| Plan review | Coverage metrics, decisions taken | [Committee minutes] | [5 years] | [@ai-governance-lead] |

## 8. Assessment

<!-- Guidance: Check understanding, not attendance. Use short scenario questions and practical exercises for higher levels. -->

- Levels 1 and 2: scenario quiz of [10] questions, pass mark [80%], two
  attempts before a follow-up conversation with the line manager.
- Level 3: practical exercise, for example reviewing [20] model outputs
  and identifying errors, or completing a sample risk assessment.
- Level 4: facilitated case discussion with a documented decision.

Programme indicators reviewed each quarter:

| Indicator | Target | Current |
|---|---|---|
| Mandatory completion, in-scope staff | ≥ [95%] | [value] |
| Average quiz score | ≥ [85%] | [value] |
| AI-related policy breaches per quarter | Falling trend | [value] |
| Overseers trained before system access | 100% | [value] |

## 9. Refresh cadence

<!-- Guidance: AI tools and rules change quickly; set triggers as well as calendar refreshes. -->

- Annual refresher for all mandatory modules.
- Event triggers: a new AI system in the inventory, a material change to
  an existing system, a new legal requirement or guidance, a significant
  AI incident, or an audit finding.
- Materials are reviewed every [6] months by the module owner.

## 10. Responsibilities

<!-- Guidance: Name accountable people, not departments. -->

| Activity | Accountable | Responsible | Consulted |
|---|---|---|---|
| Plan ownership and annual review | [@ai-governance-lead] | [@ai-governance-team] | [Legal, HR] |
| Module content | [@module-owner] | [Subject matter experts] | [Legal, Security, Privacy] |
| Delivery and records | [@hr-learning] | [Learning team] | [Line managers] |
| Contractor coverage | [@procurement-lead] | [Contract owners] | [Legal] |
| System briefings | [@system-owner] | [Product teams] | [Overseers] |

## 11. Review and approval

<!-- Guidance: Record approvals so the plan's status is clear. -->

| Role | Name | Decision | Date |
|---|---|---|---|
| Plan owner | [@name] | [Approved / Changes requested] | YYYY-MM-DD |
| Executive sponsor | [@name] | [Decision] | YYYY-MM-DD |
| Legal or compliance | [@name] | [Decision] | YYYY-MM-DD |

## Standard and licence note

Based on Article 4 (AI literacy) of Regulation (EU) 2024/1689, the
Artificial Intelligence Act, as amended by Regulation (EU) 2026/1744; EU
legislative texts are free to reuse. The text above is original wording
and does not reproduce the Regulation; consult the consolidated text on
EUR-Lex and current Commission guidance for binding requirements. This is
a documentation format, not legal advice. Template licence: MIT.