AI literacy under the EU AI Act: what your organisation needs to show
If your people use Copilot, Claude, Gemini, or AI built into the software you already run, the Act’s AI literacy duty applies to you. Marie Toft explains what it asks, and the record that proves you met it.
- Recorded
- 11 August 2026
- Length
- 49 minutes
- Presented by
- Marie Toft, ThoughtFox
- For
- Leaders, HR, risk and compliance
Length 49:23Watch the recordingPlays on YouTube. Use the running order to jump to the part you need.Most organisations using AI are already covered by the EU AI Act, whether or not they bought an “AI product”. This session sets out what the law expects in plain English, without the legal deep-dive.
Three questions to answer first
Marie opens with three questions every organisation using AI should be able to answer today.
- Can you list the AI running in your organisation right now? Not what you bought, what’s actually running.
- Do your people know when they’re using AI, including features that arrived quietly in a software update?
- If an AI-assisted decision were challenged tomorrow, who is accountable?
What counts, and what doesn’t
The law asks for “appropriate measures” to support AI literacy. Many organisations are doing things that won’t hold up.
Unlikely to count
- Staff confirming they’ve read the AI policy
- One training session with no record of who attended
- General awareness training, not linked to the tools people use
- A certificate issued once and never revisited
What counts
- Knowing what AI you have, and who uses it
- Training that differs by role
- Delivery you can evidence
- Refreshed as tools change and people join
Training differs by role
One course for everyone won’t meet the duty. The session sets out four levels.
- Everyone All staff
What AI is, what it isn’t, and how to use it securely.
- Regular users Licence holders
Using AI tools well, and checking what they produce.
- Builders Development and data teams
Limits, testing, deployment and governance.
- Leaders Senior teams and boards
Strategic risk, regulatory exposure and accountability.
The record to keep, if a regulator asks
- A register of the AI you use, including features hidden in existing software, with its risk level and the reason for it.
- Training matched to those tools and to the roles that use them.
- Records of who completed what, and when.
- Evidence it’s current, not a one-off from 18 months ago.
- A named person responsible for keeping all of this up to date.
Who is accountable when AI gets it wrong
Not the vendor, and not the tool. The Act expects human oversight from named people with the training to do it. Every AI system on your register needs a business owner and a named reviewer.
If you can’t name that person today, that’s the finding, and it’s fixable.
Presented by
Marie Toft
Co-founder, AI Governance & Literacy Lead, ThoughtFox
Marie leads how ThoughtFox keeps clients’ use of AI safe and within the rules: AI literacy training, governance and compliance standards, and working out where the EU AI Act applies and what it requires. She lectures in AI Governance & Compliance and in Responsible AI and Ethics at Trinity College Dublin, and has taken organisations such as Workday and Fidelity Investments through AI executive leadership training. In September 2021, over a year before ChatGPT’s release, she founded Emotionise AI, one of the first Irish start-ups to work with OpenAI.