AI literacy readiness. A self-assessment checklist.

We have a complete register of all AI systems in use across the organisation, including third-party tools that use AI features.Critical

This is the foundation. Without knowing what AI is in use, literacy obligations cannot be assessed or assigned.

Each AI system in our register has been classified by risk tier (unacceptable, high-risk, limited, minimal) under the EU AI Act.Critical

High-risk systems trigger specific literacy obligations. Systems in Annex III (e.g. credit scoring, insurance risk, employment tools) are automatically high-risk.

We know which roles and individuals interact with each AI system, directly (as operators or users) or indirectly (as decision-makers relying on AI outputs).Important

Article 4 literacy obligations apply to staff and other persons dealing with AI systems on their behalf, this must be mapped by role.

We have a process to update our AI system register when new tools are adopted (including departmental or individual shadow AI use).

Shadow AI, tools adopted without IT or compliance oversight, is the fastest-growing source of unmanaged AI literacy risk.

We have assessed the current AI literacy levels of staff who interact with AI systems, not assumed them.Critical

Article 4 requires you to take account of technical knowledge, experience, education and training. This means you must know where your people currently are, not just where you'd like them to be.

We have defined what sufficient AI literacy means for each AI-facing role in our organisation, with specific competency expectations.Important

The Act does not define a single literacy standard, it delegates this to the organisation. Without a defined standard, you cannot demonstrate sufficiency.

Our literacy assessment covers: understanding AI concepts, ability to identify AI-generated outputs, capacity to challenge AI vendor claims, and awareness of AI-related risks.

Generic AI awareness training does not meet Article 4's contextual standard. Compliance professionals need specific competencies, not a general introduction.

Our board and senior leadership have completed an AI literacy baseline, separately from operational staff.

Board-level questions on AI are already appearing in audit committees. Leadership literacy is an enabler of governance, not a nice-to-have.

We have an AI literacy training programme in place that is specific to the context and risks of our organisation, not a generic off-the-shelf course.Critical

Article 4 explicitly requires training to be contextual. A compliance organisation's AI literacy needs differ significantly from those of a tech company or hospital.

Our training is differentiated by role: governance/board, operational/compliance, and technical staff receive content calibrated to their AI interactions.Important

A CFO reviewing an AI-assisted risk report needs different literacy than a software developer building the model that generates it.

Our AI literacy training is CPD-accredited or independently validated, allowing staff to demonstrate completion to regulators or auditors.

CPD accreditation provides a recognised, auditable evidence trail. In a regulatory review, we ran some internal sessions is a much weaker position than a CPD-certified programme.

We have a planned schedule for training delivery, with clear completion targets before the August 2026 deadline for high-risk AI systems.Aug 2026

Our training programme includes a refresh or update cadence: AI regulation and AI capabilities evolve, a one-off course from 2024 will not remain sufficient.

The Recitals to the AI Act explicitly note that AI literacy is an evolving obligation. Treating it as a one-time tick-box exercise is a future compliance risk.

There is a named owner for Article 4 compliance in our organisation, a role responsible for maintaining literacy standards and evidence.Critical

If nobody owns it, it doesn't happen. The owner doesn't need to be an AI expert, but they need authority to set standards and require evidence of compliance.

We maintain training records that document who has completed AI literacy training, when, and at what level, ready for regulatory inspection.Important

AI literacy requirements are included in job descriptions, onboarding processes, and performance frameworks for relevant roles.

Embedding literacy expectations in HR processes ensures continuity as staff change. A one-off training event doesn't survive employee turnover.

Our AI literacy programme is documented in a policy or framework that has been approved at board or senior leadership level.

We have a process for assessing AI literacy requirements whenever a new AI system is being evaluated or deployed, before go-live.

Article 4 applies to AI systems as they are adopted, not just those already in use. Procurement is the right point to trigger a literacy assessment.

We have identified any AI systems we use or provide that fall within Annex III of the EU AI Act (automatically classified as high-risk).Critical

Annex III high-risk categories include: biometric ID, critical infrastructure, education, employment decisions, access to essential services (credit, insurance), law enforcement, migration, and administration of justice.

Staff operating high-risk AI systems receive enhanced training, including specific instruction on human oversight, understanding limitations, and escalation procedures.Critical

For high-risk systems, the AI Act requires humans to be capable of meaningful oversight. That requires contextual literacy, not generic awareness.

We have reviewed AI vendor documentation for any high-risk AI systems we deploy to understand the system's purpose, capabilities, limitations, and human oversight requirements.Important

All high-risk AI system literacy requirements are documented and staff completion is verified before go-live.Aug 2026

The August 2026 deadline for high-risk AI systems is the regulatory hard stop. Any high-risk system in use after this date must have verifiable literacy evidence in place.

Our compliance and leadership teams understand the EU AI Act implementation timeline, particularly the August 2026 deadline for high-risk AI system obligations.Aug 2026

Key dates: AI Act entered into force 1 August 2024. Article 4 (AI literacy) and Article 5 (prohibited AI practices) in force from 2 February 2025. General-purpose AI model obligations in force since August 2025. High-risk AI system rules (Chapter III, Annex III) take effect August 2026.

We are monitoring AI regulation guidance from our relevant national competent authority and sector regulators.

Each jurisdiction has its own regulatory oversight structure. Ireland: DPC, Central Bank, HPRA, HIQA. UK: ICO, FCA, MHRA (note the EU AI Act can still apply to UK organisations placing AI systems on the EU market). Other EU member states: your designated national market surveillance authority and sector regulators. In all cases, sector regulator guidance, not just the AI Act itself, will set the operational standard.

We have a documented AI Act compliance roadmap with milestones, including Article 4 literacy, reviewed at least quarterly by senior leadership.

An unreviewed roadmap is a filing exercise, not a compliance programme. Quarterly senior review keeps Article 4 from slipping into we'll get to it.