AI literacy is not becoming less important: it is becoming more urgent

The European AI rules are changing. With the Digital Omnibus on AI, several obligations are being simplified and some deadlines for high-risk AI are being postponed. This may give the impression that organisations have more time and can slow down their preparations for now.

That would be a dangerous assumption.

The obligation relating to AI literacy is not disappearing. Employers, providers and users of AI systems must continue to take measures to support the AI literacy of employees and other users. At the same time, AI is being used more and more widely, while many organisations still lack sufficient insight into how it is being used, the risks involved and the internal guidelines required.

With the AI Literacy e-learning course, the AI Policy e-learning course and an AI Risk Assessment, organisations can address these three areas in a targeted way.

From a requirement to achieve results to a demonstrable obligation to take action

The original AI Act required organisations to ensure an adequate level of AI literacy. The new wording is less stringent: organisations must take measures that support the development of AI literacy. This means they do not have to guarantee that every employee reaches a predetermined level of knowledge.

This is a relaxation of the requirements, but not an exemption.

When determining appropriate measures, organisations must take into account:

• employees’ technical knowledge and experience
• their education and role
• the context in which AI is used
• the individuals or groups who may be affected by its use

A general warning in the staff handbook will therefore usually not be sufficient. The measures chosen must reflect the actual use of AI and the specific risks within the organisation.

The biggest risks can arise long before AI is classified as high-risk

Much of the current focus is on the delayed requirements for AI systems that are formally classified as high-risk. In practice, however, many organisations are already exposed to risks through the everyday use of AI.

Employees use generative AI for a wide range of tasks, such as summarising texts, answering customer enquiries, analysing documents, assessing candidates, writing code and creating presentations. In the process, confidential information and personal data may be shared with external systems. There is also a risk that employees rely on output that is inaccurate, discriminatory or raises copyright concerns.

An AI system does not first have to be classified as “high risk” for these risks to arise.

Without sufficient knowledge and clear internal rules, employees are left to make their own decisions about which tools they may use, what data they may enter and when human oversight is required. This leads to inconsistent working practices and risks that are difficult to manage.

New prohibitions make awareness even more important

The amended AI Act introduces explicit bans on AI systems used to create realistic sexual or intimate content depicting identifiable individuals without their consent. It also prohibits the generation or manipulation of material involving the sexual abuse of children.

These provisions will apply from 2 December 2026.

These prohibitions are not only relevant to developers. The use of such AI systems may also be prohibited. Therefore, organisations must ensure that employees understand the legal and ethical boundaries, particularly when generative image, video and audio tools are available.

A prohibition is only effective if employees are aware of it, understand it and can recognise when it applies in practice

Three key elements for responsible AI use

An organisation needs more than just training or a policy document. Responsible AI use requires a combination of knowledge, clear working agreements and insight into the actual risks.

1. AI Literacy e-learning

The AI Literacy e-learning course provides employees with the essential knowledge they need to use AI consciously and responsibly. Among other things, they learn:

• what AI can and cannot do
• what risks generative AI can pose
• how to protect personal data and company information
• why human oversight remains essential
• how to recognise errors and potential bias
• where to report questions and incidents

This gives the organisation a practical way to meet its obligation to support the development of AI literacy.

2. AI Policy e-learning

An AI policy is only effective when employees know what it says and understand what the rules mean for their day-to-day work.

The AI Policy e-learning course translates internal agreements into recognisable, real-world situations. Employees learn, for example:

• which AI applications they may and may not use
• which data they must never enter into an AI system
• when permission or prior assessment is required
• how to check AI-generated output
• what responsibilities come with their role
• how to report deviations and incidents

This ensures that the AI policy does not remain a document stored on the intranet, but becomes a practical framework that employees can apply in their day-to-day work.

3. AI-Risk Assessment

Training is most effective when it reflects the actual risks within the organisation. Therefore, an AI Risk Assessment identifies where and how AI is being used, what risks this creates and which measures should be prioritised.

The assessment looks at areas such as:

• AI applications currently in use and those being planned
• the processing of personal data and confidential information
• the impact on customers, employees and other stakeholders
• reliance on external suppliers
• human oversight and decision-making
• potential discrimination or bias
• security, monitoring and incident management
• alignment between policy and day-to-day practice

The result is a clear overview of the key risks and areas for improvement. This enables an organisation to make targeted decisions and avoid spending time and budget on measures that do not reflect the actual situation.

From individual measures to demonstrable control

The three solutions complement each other directly. The AI Literacy e-learning course provides essential knowledge. The AI Policy e-learning course turns internal rules into practical guidance. The AI Risk Assessment identifies the organisation’s main risks and priorities.

Together, they help an organisation demonstrate that it:

• actively supports employees in developing AI literacy
• has implemented clear rules for the use of AI
• has instructed employees on those rules
• understands its key AI applications and associated risks
• has implemented appropriate control measures
• can periodically evaluate and improve its approach

This is relevant not only for compliance with the AI Act. Customers, clients, auditors and business partners are also increasingly asking how organisations manage the responsible use of AI.

Postponing action is not a strategy

Some obligations relating to high-risk AI will take effect at a later date, but the use of AI is not waiting for legislation to catch up. New applications are introduced every month, and employees are becoming increasingly accustomed to using AI independently.

The longer clear guidelines, training and insight into risks are lacking, the greater the chance that unsafe practices become part of everyday work. Correcting these practices afterwards is generally more difficult than encouraging responsible AI use from the outset.

The Digital Omnibus therefore gives organisations no reason to delay action. Instead, the amended rules make it clearer what is expected: actively supporting AI literacy and tailoring measures to the organisation’s own employees, systems and use cases.

Together, the AI Literacy e-learning course, the AI Policy e-learning course and the AI Risk Assessment provide a coherent approach: employees understand what AI is, know which internal rules apply, and the organisation gains insight into its most significant risks.

The best time to start is before an incident, customer request or regulatory intervention makes action urgent.

Ready for responsible and demonstrable AI use?

Do not wait until an incident, customer request or regulator reveals where the risks lie. With our AI Literacy e-learning course, AI Policy e-learning course and AI Risk Assessment, you can build awareness, establish clear working agreements and demonstrate effective control.

Find out which approach best suits your organisation and contact us through the website or email [email protected] for a no-obligation consultation.

Regulation (EU) 2026/1744 of 8 July 2026 amending, among other legislation, the European AI Act.