Set the AI literacy requirement for a role

In plain terms

Decide what a person in this role must understand about AI. Competence, not completion. Article 4 has applied since February 2025 and is independent of the Annex III deferrals, which makes this the nearest live obligation in the framework.

What is being judged

What this specific role has to be able to do, which is not the same as what it should know.

Three role types carry different requirements. People who use AI output need to know the system’s limitations and when to distrust it. People exercising human oversight need to recognize a wrong output in their domain, which Article 26(2) frames as competence, training and authority. People who build or procure need the framework’s own decision vocabulary, because they will be consulted on decisions they cannot otherwise participate in.

Completion is not competence, and the distinction is the whole requirement. A completion rate says a course was finished. Competence means a person exercising oversight over a fraud model can describe the failure mode they are watching for. The second is assessable and the first is not evidence of it.

What this decision does not cover

It does not certify autonomy levels, which is L4-AUT-03, though the two interact: an autonomy position that assumes human oversight assumes a competent human.

When it fires

On event. On assignment of human oversight to a role, per Article 26(2). On introduction of an AI system into a role’s workflow. On a change of autonomy level under L4-AUT-03. On acceptance of an aggregate reallocation position under L6-05, per recommendation R5 below.

On cycle. Annually, and on role change.

What you need before deciding

Which AI systems the role interacts with and in what capacity. Whether the role holds oversight responsibility for any system. The autonomy position of those systems. What the role previously did manually, since reallocation can remove the experience that made oversight possible.

How this goes wrong

Literacy as a completion certificate: high completion rates, no assessment of whether an oversight-assigned person can recognize a wrong output. The Layer 5 anti-pattern, detected by asking such a person to describe the failure mode they watch for. One requirement for everyone: general AI awareness training applied uniformly, which satisfies nobody’s actual need. Competence assumed from tenure: the person has done the job for years, therefore they can oversee a system doing it, which is precisely what reallocation can invalidate.

Related decisions

Upstream L4-AUT-03 autonomy certification, L5-09 capability plan.

Related L6-05 aggregate reallocation, which can remove the practice competence rests on.

Downstream oversight assignment.

Instrument references

EU AI Act Article 4 requires AI literacy of staff and applies now. Article 26(2) requires deployers assign oversight to people with the necessary competence, training and authority. ISO/IEC 42001 clause 7.2 competence. None specifies how competence is assessed, which is recorded as KL-11.