Since 2 February 2026, the EU AI Act requires all organisations that deploy AI systems to ensure their staff are AI-literate. We build custom programmes for management, tech, operational teams and compliance: technology-first, with practical case studies drawn from our own AI build projects.
AI literacy is, under the EU AI Act, the set of skills, knowledge and understanding that enables providers, deployers and affected persons to deploy AI systems in an informed way and to weigh up their risks, opportunities and potential harm. The Act has applied in phases since August 2024, and from 2 February 2026 Article 4 applies to everyone: as soon as your organisation uses AI, from a shared ChatGPT licence to a bespoke RAG application, you are obliged to prepare your people for it. This is not a recommendation but an enforceable obligation.
What this means for you depends largely on where AI sits in your organisation. A marketing agency using ChatGPT and Copilot has different AI literacy needs from an insurer deploying an AI model for claims classification, or a hospital using clinical decision support. We always build the programme around your actual use and, where relevant, link it to a broader enterprise AI implementation programme or our AI strategy consultancy. A paper e-learning that everyone clicks through is not literacy.
What sets us apart from conventional training providers: Appfront is a software development company that builds AI systems itself. We work with RAG architectures, agent frameworks and custom LLM integrations every day, and we know where the real risks lie: hallucinations in production, prompt injection in a chatbot, data leaks through an unmonitored API call, bias in a recruitment model. Our trainers are the same engineers and strategists who are involved in AI agent build projects and generative AI solutions. As a result, your people get no abstract talk about what a language model is, but concrete explanations of how it works, where it goes wrong and how to recognise that in their own work.
As soon as employees use ChatGPT, Claude, Microsoft Copilot or Gemini for work tasks, your organisation falls under the AI literacy obligation. It makes no difference whether this is a paid enterprise licence or a personal account. If the work comes out of it, the rules apply. A literacy programme ensures your people know which data may and may not go into a prompt, how to check output and when it is better to ask a colleague.
If you build your own models, RAG systems or agents, you are, in legal terms, both a provider and a deployer. The literacy requirements are higher and reach wider groups: not only the development team, but also product, management and the board that commissions the work. We work on this together with the teams that also deliver AI agents and broader AI agent implementations.
The AI Act defines a separate category of high-risk AI systems: credit assessment, claims handling, clinical decision support, applicant assessment, fraud detection and public service delivery. If your organisation works in these areas, literacy, documentation and governance must be at a higher level than for a marketing team using AI to draft copy. We translate Article 9 (risk management) and Article 4 into one coherent programme.
CV screening, automated matching, interview analysis and assessment tools that use AI fall under high-risk AI. Your HR team needs to know which bias risks are attached, how to inform candidates transparently, and what documentation you must keep about the model. We train recruitment and HR business partners alongside IT and legal, so that the division of roles is agreed from the outset.
Once AI and personal data come together, the GDPR applies alongside the EU AI Act. A chatbot drawing on a CRM, a recommendation model learning from purchasing behaviour, a service portal giving LLM answers to customer questions: all applications where AI literacy at first and second line is crucial. We link the programme to the governance approach for generative AI solutions that you commission or build.
Marketing teams and agencies often adopt AI earliest and most widely. The risk profile differs from that of an insurer, as there are no automated decisions about individuals, but the literacy obligation applies in full. We train on copyright and brand risks, on recognising hallucinations in factual and numerical material, and on working with enterprise versions that do not receive training rights over your data.
You maintain a documented, verifiable implementation of Article 4: who is trained when, on which programme, and at what level. During an inspection or audit, you can show that you meet the AI literacy obligation, and more importantly, that the training is substantively relevant to the AI use within your organisation. Not a tick-box exercise, but a defensible file that aligns with your AI strategy.
Your people know what they may and may not do with the AI tools your organisation uses, and above all, what they must never do with them. Which data does not belong in a prompt, how to spot a hallucination in an answer that seems convincing, and when an LLM is a risky tool for a decision. That kind of competence prevents incidents that no audit would ever have caught.
You receive a workable set of guidelines, role descriptions and escalation paths: who may use which AI tool, with which data, for which purpose, and who oversees it. We develop this as a draft document that your legal, security and HR colleagues can supplement and formalise. This means you not only meet the AI literacy obligation but also lay the foundation for broader AI governance.
We compile the curriculum for each organisation based on your AI use, sector and team mix. Below are the building blocks we choose from.
The mandatory foundation: scope, definitions, Article 4 and the phased entry into force. What you must do now and what comes later. Concludes with a scan of your own AI applications.
Prohibited, high-risk, limited or minimal. How you categorise your own AI systems and those of your suppliers, and which obligations belong to which category. Including the ROLE distinction between provider and deployer.
Using ChatGPT, Claude and Copilot responsibly: which data may or may not go into a prompt, how you check output, when to choose enterprise versions, and when an API integration is better than a chat interface.
Not as a trick, but as a skill: building good prompts, asking follow-up questions, structuring output, and evaluating whether an answer holds up. With practice material drawn from your own work.
How hallucinations arise in an LLM, how to recognise them, and the best-known forms of bias in AI output. Including mode collapse, repetition errors in generation, and assessing alleged figures and citations.
For tech teams: how a RAG system is built, which components can fail, and how you evaluate performance and safety in production. Technically deep where needed, using our own project experience as material.
Healthcare, finance, HR, retail, government — every sector has its own rules, its own data and its own customer expectations. Modules tailored to the domains your people work in, with case studies they will recognise.
What you need to record, who keeps track of it, and how you align with the GDPR, ISO 27001 and sector-specific frameworks. Intended for legal, compliance and information security teams, linked to the practical training for operational teams.
An AI literacy programme only works if it fits your people and their schedules. We combine formats so that management, tech and operational staff each receive their own level, without losing coherence across the whole.
A focused session for the executive team and supervisory board. We bring together the legal obligations, strategic choices and risks for your sector in a discussion where you can make the key decisions for the coming financial year: budget, suppliers, in-house development, risk tolerance. Aligned with our broader AI strategy support.
For engineers, data scientists and architects: RAG, agent architectures, LLM evaluation, hallucination mitigation, prompt injection defence, cost and latency control. We draw on material from live AI agent projects, so the content matches the architectures your teams are building or buying.
For sales, marketing, finance, support and HR: several working sessions in which teams work with their own tools and their own real-world cases. Each participant leaves with practical prompts, a personal do's and don'ts list, and a shared team agreement on responsible use. Practical, not a theoretical course.
For data protection officers, compliance officers and in-house counsel: the AI Act in detail, its overlap with the GDPR and sector-specific frameworks, documentation obligations, and the governance choices your policies and contracts need to cover. The outcome is a draft policy framework and a division of responsibilities with IT and the business.
For HR business partners, recruiters and hiring managers: bias in CV screening and assessment tools, transparency obligations towards candidates, collaboration with IT on data sources, and the high-risk status of recruitment AI under the AI Act. Often combined with the compliance track.
AI literacy is not a one-off action. We offer follow-up moments: short deepening sessions, an update round at new EU AI Act milestones, and the option to link the training to an enterprise AI implementation. That way you not only comply today, but stay on track as the law and your own AI portfolio evolve.
A thirty-minute introductory call in which we discuss which AI your people use, which roles and levels you want to cover, and what a programme could look like that meets the requirements of Article 4 and delivers practical value.
Appfront uses cookies and similar technologies to keep the website working properly, for analytics and for marketing. You choose what you allow. Read more in our privacy policy.
