AI literacy and ISO 42001: the forgotten obligation

Since 2 February 2025, the AI literacy requirement in the EU AI Act has applied. Many organisations are focused on the later deadlines for high-risk AI. But this obligation applies now, and it affects every organisation that uses AI. For ISO 42001, it aligns with the requirements on competence and awareness. The official standard is available from ISO .

AI literacy in brief

Topic	What you need to know
Legal basis	Article 4 of the EU AI Act
In force since	2 February 2025, not postponed
Who it applies to	Providers and deployers of AI systems
What it requires	Sufficient knowledge for each role to use AI responsibly
Enforcement	National supervisory authorities, with formal powers from August 2026
Enforcement in the Netherlands	The supervisory structure is being designated, check with the Dutch Data Protection Authority (AP)
Link with ISO 42001	Aligns with the competence and awareness requirements (clauses 7.2 and 7.3)

The Digital Omnibus package is expected to soften the wording of Article 4 (from “ensuring” to “supporting” literacy), but it does not remove the obligation. Until that change is adopted, the existing requirement applies in full.

What is AI literacy?

The EU AI Act defines AI literacy (Article 4) as: the skills, knowledge and understanding that allow providers and deployers of AI systems to make informed decisions about the use of AI.

In practice: people who work with AI must understand enough to use it responsibly.

This does not mean that everyone must take a machine learning course. It means having the knowledge that fits the role a person has.

Why is AI literacy important for ISO 42001?

AI systems are not plug-and-play tools. They have limitations, can make mistakes, and require human judgement to use well.

An employee who uses an AI tool without understanding what it can and cannot do may make wrong decisions. A manager who steers AI projects without basic understanding may set the wrong priorities.

The problems we see:

Over-reliance on AI outputs
Misuse of tools (in a context other than intended)
Not recognising when AI makes mistakes
No understanding of privacy and ethical implications

AI literacy is the foundation for everything else. You can have excellent governance structures, but if people do not understand why they are needed, it will not work.

The AI literacy requirement has applied since 2 February 2025. This is not a future obligation but a current one. Supervisors can enforce it.

Who needs to be AI literate?

The law says: “providers and deployers of AI systems”. In practice, this means several groups in your organisation.

Directors and management

Board members do not need to become data scientists. But they must understand:

What AI is and what it can do
Which risks AI brings
Why governance is needed
Their responsibilities under the AI Act

This matters a great deal, because the law can hold them personally accountable.

AI developers and data scientists

For technical teams, it goes further. They must understand:

Ethical principles and how to apply them
Bias detection and mitigation
Explainability of models
Privacy by design
The legal context (AI Act, GDPR)

Users of AI systems

Employees who use AI in their daily work. Think of:

Recruiters who use AI screening tools
Customer service staff who work with chatbots
Marketers who use AI for personalisation
Managers who interpret AI reports

They must understand:

What the tool does and does not do
When they need to step in
How to flag problems
The limitations of the AI

HR and compliance

They are often responsible for the training. They must understand the subject well enough to develop effective programmes.

What does someone need to know?

This depends on the role. A framework:

Basic level (for everyone)

What is AI, broadly speaking?
How are AI decisions made?
What are the limitations?
When should you be careful?
Who can you turn to with concerns?

User level (for people who work with AI)

Everything from the basic level, plus:

How does the specific tool you use work?
What can the tool do and not do?
When is the output wrong?
How do you interpret the results?
When do you step in?

Specialist level (for developers)

Everything from the user level, plus:

How do different AI techniques work?
How do you detect and correct bias?
What are the ethical principles?
How do you document models?
What does the law require?

Governance level (for management)

Everything from the basic level, plus:

What are the organisational risks?
What governance is needed?
What are the legal obligations?
How do you organise oversight?
Which decisions must the board take?

How do you approach this?

Step 1: Inventory

Map out:

Which AI systems are used?
Who uses them?
What is the current level of knowledge?
Which risks does their use bring?

Step 2: Determine the need

For each role and each AI system:

What level of knowledge is needed?
Where are the gaps?
What is the priority?

Step 3: Develop or buy training

You have options:

In-house development
External training from specialist providers such as Projectimpact.nl
E-learning platforms
A combination

Consider:

Does it fit your culture?
Is it practical enough?
Can you keep it up to date?

Step 4: Implement

Make clear who must take which training
Plan the rollout
Make time and space for it
Make it part of onboarding for new employees

Step 5: Maintain

AI evolves. Your training must keep pace.

Update annually or after major changes
Provide refresher training
Keep track of new developments

AI literacy is not a one-off training but an ongoing competence. Plan for regular updates.

The link with ISO 42001

ISO 42001 explicitly asks for competence and awareness (clauses 7.2 and 7.3). The AI literacy requirement in the AI Act fits seamlessly with this.

Competence (7.2):

Determine which competences are needed
Make sure employees have them
Keep evidence

Awareness (7.3):

Employees are aware of the AI policy
They know their contribution to the AIMS
They understand the consequences of non-compliance

Your AI literacy programme documents, for both the AI Act and ISO 42001, that you meet these requirements.

What often goes wrong with AI literacy?

Pitfall	What goes wrong
Too technical	Algorithms and formulas for people who do not need them. A recruiter does not need to understand regression analysis to use a screening tool well
Too abstract	”AI ethics” without examples from your own practice. People lose interest
One-off	Training at the start and never again. AI, tools and legislation change
Not tested	You do not check whether people understood it. Then it is a tick box, not a competence
No time	”We are too busy.” It gets postponed until something goes wrong

Practical tips

A few things make the difference. Make it concrete with examples from your own organisation (“our chatbot works like this, these are its limitations”). Make it short: four short modules stick better than one long day. Make it interactive with cases and quizzes, and relevant to each role, because a developer has different needs from a manager. And make it mandatory: this is not a nice-to-have, but a legal requirement.

Documentation

For both the AI Act and ISO 42001, you must be able to demonstrate that you meet the requirements.

Document:

Your literacy programme (who gets which training)
Training materials
Attendance records
Any test results
Updates and refreshers

This is evidence during an audit or a supervisor’s inspection.

What does AI literacy cost?

Costs vary widely depending on the format. These are indications.

Format	Indicative cost
External standard training	€200-500 per person per day (for example through Projectimpact.nl )
Extensive external programme	€500-1,500 per person
E-learning platform	€20-100 per person per year
In-house development	Time of internal experts, plus maintenance

The investment pays off: fewer mistakes caused by inexperienced use, faster adoption of tools and less compliance risk. See also costs and timeline for the full picture of certification.

The deadline was 2 February 2025. Do not have a programme yet? Start today with the five steps under How do you approach this? and record everything for your documentation.