AI literacy at work: what “good enough” looks like

AI literacy has become one of the most talked-about ideas in AI governance. It’s also one of the most misunderstood. It doesn’t mean everyone needs to understand how a language model works. It means people can use AI safely, sensibly and well in their job.

Why it matters

Most AI risk at work comes from everyday use, not exotic technology. Someone pastes the wrong document into the wrong tool. Someone trusts a confident but incorrect answer. Someone doesn’t realise a feature is sending data outside the business.

Literate staff avoid these mistakes. They also get more out of AI, because they know what it’s good at and where it falls short.

Where the rules stand

The EU AI Act includes an AI literacy duty in Article 4. In July 2026 the AI Omnibus softened it: organisations must now take measures to support AI literacy among their staff, rather than ensure a set level for each person.

In the UK there’s no equivalent statutory duty. But clients, insurers and auditors increasingly ask what training your people have had. Literacy has become part of being ready for scrutiny.

What "good enough" looks like

For most staff, AI literacy comes down to five things:

1. What AI is good at, and what it isn’t. Drafting, summarising and brainstorming, yes. Facts, figures and final judgements, check carefully.
2. What never goes in. Client data, personal information and confidential material, unless the tool is approved for it.
3. Which tools are approved. And how to ask for a new one.
4. How to check output. Verify facts, sources and numbers before anything leaves the business.
5. When to say so. Being open about where AI has been used, internally and with clients where appropriate.

Tailor it by role

One course for everyone rarely works. A simple three-tier approach is usually enough:

• Everyone: the five essentials above. Short, practical, with real examples from your business.
• Regular users: better prompting, spotting errors, handling sensitive work, and using approved tools well.
• Leaders and owners: accountability, risk assessment, oversight and how to answer external questions.

Make it stick

• Keep it short and frequent. Short refreshers beat a long annual course.
• Use your own examples. Real tasks from your teams land better than generic scenarios.
• Link it to your policy. Training should explain the rules people are asked to follow.
• Refresh when things change. New tools, new features and new rules are all prompts to update.

How to show it’s working

Record who has completed training, when, and at what level. Track a few simple signals: fewer policy questions, more requests to approve tools rather than workarounds, and more confident use.

That record is what lets you answer, calmly, when someone asks how your people are trained.

How TURMA helps

TURMA Passport provides role-based AI training and certification for your people, with a badge your business can show clients, insurers and regulators. It sits alongside Snapshot and Assured, so training reflects the tools and rules your business actually uses.