New AI literacy requirement redefines professional skills and corporate responsibilities

The European AI Act requires organizations that provide or use artificial intelligence systems to ensure that those operating these tools on their behalf are AI literate. The law mandates that companies take steps to develop employees’ knowledge, taking into account their experience, training, and the context in which the tools are used.

For those working with technology or using AI daily, this change introduces a practical requirement: knowing how to operate a tool may not be enough. It is essential to understand in which situations the generated results can be applied, what risks are involved, and when a decision should be reviewed by a human.

What does AI literacy mean?

AI literacy does not require professionals to learn programming or develop models. The concept involves understanding the basic functioning of tools, their capabilities and limitations, as well as the risks associated with their use.

In practice, an employee using a generative tool to produce a report, for example, needs to know that an apparently correct answer may contain invented information, outdated data, or incorrect interpretations.

The European AI Act requires providers and companies implementing AI systems to take steps to develop this knowledge among employees and others working with these systems. The European Commission also clarifies that the law does not establish a single level of knowledge that every individual must achieve.

What changes for professionals?

One of the main changes is the need to understand the context in which AI is used. A tool may be suitable for summarizing documents but may require additional controls when used to support decisions that affect people.

This also involves recognizing situations where human review is necessary. The US standards institute NIST includes in its AI risk management framework processes for human supervision and for assessing professionals’ ability to operate systems properly.

Another aspect is information protection. An employee using an external tool needs to understand what data can be entered, what information is confidential, and what policies exist within the organization.

Knowing the tool’s limitations also becomes part of professional use. This includes identifying incorrect answers, biases, privacy issues, and results that cannot be used without verification.

Regulation may increase the importance of training

This movement is not limited to the European Union. In the United States, NIST maintains a framework for artificial intelligence risk management and published a specific version for generative AI in 2024. The document recommends practices for identifying, assessing, and managing risks throughout the use of these technologies.

In Brazil, the regulatory framework is still under discussion. Bill 2,338/2023, approved by the Senate in 2024, is being considered in the Chamber of Deputies, where a special committee has been established to analyze the proposal.

While Brazilian regulations remain under debate, companies can already establish internal policies for AI use. This may include training, defining authorized tools, rules for confidential data, and review procedures.

For professionals, the result is a change in the skills required to work with the technology. Using AI now also involves responsibility, verification, and understanding of risks.

AI knowledge may become part of a professional’s profile

The regulatory trend helps explain why basic knowledge about artificial intelligence may gain importance in various roles, even outside the technology sector.

A marketing professional may need to evaluate content produced by AI. A financial analyst may use models to organize information. A human resources professional may work with screening systems. In all these cases, understanding the technology’s limitations helps identify situations that require human analysis.

The regulation does not turn all these professionals into technical experts. However, it emphasizes the need for conscious use of artificial intelligence, especially when its results influence decisions, personal information, or higher-risk activities.

Training, therefore, is likely to evolve from being solely a means to increase productivity to becoming an integral part of governance and security practices in technology use. For those working with AI, understanding how to use the tool is only part of the required knowledge.