AI literacy training teaches staff what the AI tools they use can and cannot do, how to use them safely with company and customer data, and how to check what comes back. UK law has no specific duty to provide it. However, UK GDPR still applies to personal data typed into AI tools, and the EU AI Act’s AI literacy rule reaches UK organisations with an EU connection. Since 27 July 2026 that rule requires organisations to take measures to support AI literacy, rather than to guarantee a particular level.
This guide covers why AI literacy matters now, what the rules say in the UK and the EU, what training should cover and how to roll it out. To see whether the EU rule is likely to apply to you, use our free AI literacy checker.
Why AI literacy matters now
Staff are using AI at work whether or not their employer has planned for it. The Office for National Statistics reported in July 2026 that AI use among UK businesses with 10 or more employees had risen from around 12% to around 35% since late 2023. Only 11% of those businesses said more than half their workforce had received AI-related training.
Unapproved use is common too. In a survey of 2,003 UK employees commissioned by Microsoft and published in October 2025, 71% said they had used unapproved consumer AI tools at work. The National Cyber Security Centre has since written about the risks of this “shadow AI”.
The risks are practical ones:
- confidential or personal data pasted into public tools
- confident but wrong answers (hallucinations) passed on as fact
- people trusting output without checking it, known as automation bias
- decisions made with AI that nobody can explain afterwards
Training is the most direct way to reduce all four.
What the UK rules say
There is no UK equivalent of an AI literacy duty. The King’s Speech in May 2026 did not include an AI bill. Existing law still applies, though:
- Data protection. If staff put personal data into an AI tool, UK GDPR applies. The ICO, now formally the Information Commission, has warned that information given to chatbots can be accessed and used by the organisation that developed them, and it expects organisations to run needs-based data protection training. An AI policy is not a legal requirement, but the ICO says one helps you show compliance.
- Security. The NCSC’s advice is not to include sensitive information in queries to public LLMs, because the provider can see and store queries. Its guidance also says managers should know enough about AI risks to discuss them with key staff.
- Public sector. The government’s AI Playbook sets as its first principle that you know what AI is and what its limitations are.
Does the EU AI Act apply to UK organisations?
It can. Under Article 2, the AI Act applies to:
- providers placing AI systems on the EU market, wherever they are based
- deployers established in the EU, which includes a UK group’s EU subsidiaries and branches
- providers and deployers outside the EU where the output of the AI system is used in the EU
The European Commission has confirmed this scope applies to the AI literacy rule in Article 4. Whether a UK-only business is caught because its staff use AI on work later sent to EU clients is a matter of legal interpretation, so take advice if that describes you. Our free AI literacy checker gives a quick first view.
What Article 4 says after the July 2026 changes
Article 4 originally applied from 2 February 2025 and required providers and deployers to “take measures to ensure, to their best extent, a sufficient level of AI literacy” among staff. The EU’s Digital Omnibus changed that. Regulation (EU) 2026/1744 came into force on 27 July 2026 and rewrote Article 4 so that providers and deployers must “take measures to support the development of AI literacy” of their staff and others using AI on their behalf.
According to the Commission’s AI literacy questions and answers, the amended rule “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” Measures should still take account of people’s knowledge and experience, the context in which AI is used and the people affected.
On enforcement, national authorities supervise the rules from 2 August 2026. The AI Act sets no specific fine for Article 4, and penalties are left to member states. The Commission notes that sanctions “might, however, be more likely if there is proof of an incident due to lack of appropriate training.”
So the duty is lighter than it was, but it has not gone away. For UK organisations with EU operations or EU customers, a sensible training programme is both the compliant and the practical answer.
What AI literacy training should cover
The Commission suggests four starting points: a general understanding of AI across the organisation, clarity on your role as a provider or deployer, the risk level of the systems you use, and training tailored to staff knowledge and the context of use. In practice, a good programme covers:
- What generative AI is and where it fails. How tools like ChatGPT, Copilot, Claude and Gemini produce answers, and why they can be fluent and wrong.
- Your rules. Which tools are approved, what data can and cannot go into them, and who to ask.
- Data protection and confidentiality. Personal data, client information, commercial secrets and what happens to a prompt once it is sent.
- Checking output. Verifying facts, sources and calculations, and recognising automation bias.
- Using AI well in each role. Practical tasks for HR, finance, sales, operations and customer service, so people see real benefit.
- When not to use AI. Decisions about people, regulated advice and anything you would not want to explain later.
- Reporting problems. What to do when output looks wrong or something sensitive has been shared.
The Commission’s own example is a member of staff using ChatGPT to write adverts or translate text. They “should be informed about the specific risks, for example hallucination.”
Who needs what
A tiered approach works best. Everyone needs the same safe foundation. Managers need enough to set expectations and discuss risks with their teams. Heavy users need role-specific skills. IT and security teams need the technical detail. Leaders need to understand the opportunities and the risks well enough to set policy.
If your organisation deploys a high-risk AI system under the AI Act, such as one used in recruitment, the staff overseeing it will need more specific training on human oversight once those rules apply. The Digital Omnibus pushed most high-risk obligations back to December 2027.
Records: what you need to keep
The Commission says “There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives.” A sensible record shows who completed which training, when, how they performed on any assessment, and that they acknowledged your AI policy. An LMS with role-based reporting makes this straightforward.
How the Capytech AI Academy helps
The Capytech AI Academy gives every employee practical, safe AI skills in lessons of five to ten minutes. Everyone starts with the AI Licence, which covers the essentials of using AI safely at work, then moves on to deeper stages and role-based tracks. The content is tool-agnostic and covers Copilot, ChatGPT, Claude and Gemini. Security runs through every stage, and dashboards show progress for learners, managers and the whole organisation.
The Academy is available in any language, so your whole workforce can learn in the language they work in. If you need lessons built around your own AI policy and approved tools, we can add those too.
Frequently asked questions
Not under UK law. There is no UK AI statute requiring it. UK GDPR still applies when staff put personal data into AI tools, and the Information Commission (still known as the ICO) expects needs-based data protection training. The EU AI Act’s AI literacy rule applies where your organisation has an EU connection.
It can. It applies if you place AI systems on the EU market, operate through an EU subsidiary or branch, or the output of your AI systems is used in the EU. The European Commission has confirmed this includes the AI literacy rule in Article 4.
No. Since 27 July 2026, Article 4 requires providers and deployers to take measures to support the AI literacy of their staff. It no longer requires them to ensure a sufficient level, and it does not require any specific level for any individual.
No. The European Commission says no certificate is needed and that an internal record of training and guidance is enough.
Yes. The Commission’s own example is a member of staff using ChatGPT for writing or translation, who should be told about specific risks such as hallucination. Everyday use is exactly where most risk sits.
At minimum: what AI tools can and cannot do, your approved tools and data rules, data protection, how to check output and avoid automation bias, practical use in each role, and how to report problems.
Train your whole team to use AI safely
The Capytech AI Academy gives every employee practical, safe AI skills in short lessons, available in any language.


