A school introduces an AI writing tool. One teacher asks students to document when they used it; another worries that the tool will replace the work of learning to explain. The procurement team has checked price and security, but no one has decided what students should know about the system, when they should question it, or how teachers will evaluate work. An AI-literacy policy must make those decisions visible.
AI literacy is more than the ability to write a prompt. It includes understanding where AI appears, what a system can and cannot establish, how to check an output, and how its use affects other people. A policy sets responsibilities for learning, access and oversight. The exact legal duties depend on jurisdiction and current law; this article maps research and policy sources as of 18 October 2026, rather than providing legal advice.
Start with a purpose, not a tool list
An institution should state why it uses an AI system and which human work the system is meant to support. “Improve productivity” is too broad to guide a lesson or evaluation. “Help teachers prepare differentiated examples while they retain responsibility for accuracy and student assessment” is more testable. The purpose should also identify tasks that remain human-led.
The OECD and European Commission’s 2026 AI-literacy framework for primary and secondary education treats literacy as knowledge, skills and attitudes for understanding, evaluating, using and shaping AI responsibly. It is a curriculum framework, not evidence that every school implementing it improves learning. Its categories can help a policy ask which outcomes should be taught and assessed at each age.
A policy should distinguish learning about AI from learning with AI. A student can use a model fluently without understanding its training, limitations or social effects. Another can discuss risks but lack the practical skill to check an output in a real task. Both kinds of learning need an appropriate place.
What current European law says
The consolidated EU Artificial Intelligence Act text available in October 2026 defines AI literacy in relation to informed deployment and awareness of opportunities, risks and possible harm. Its amended Article 4 requires providers and deployers of AI systems to take measures supporting the development of AI literacy among relevant staff and others operating or using systems on their behalf. The measures are to take account of knowledge, experience, training, context and the groups affected by the systems.
The amendment expressly says that this duty does not require a provider or deployer to guarantee a specific level of literacy for each individual. That is an important correction to older summaries that described an obligation to ensure a “sufficient” level. The European Commission’s AI-literacy questions and answers describe the amendment and application dates. Anyone applying the law to a specific organization should check the current official text and competent guidance.
Legal compliance is a floor for some institutional decisions, not a complete educational philosophy. A short staff briefing might address one duty but still leave students, patients or citizens unable to understand how AI affects them. A policy can set broader learning goals while keeping legal requirements and voluntary commitments separate.
Frameworks are maps, not interchangeable certificates
UNESCO’s 2024 student framework outlines competencies across human-centred thinking, ethics, AI techniques and AI system design. It also describes progression from understanding to applying and creating. UNESCO’s teacher framework includes a human-centred mindset, AI ethics, foundations, pedagogy and professional learning. These are reference frameworks to adapt, not ready-made proof that a particular lesson works.
The European Commission’s DigComp 3.0 integrates AI competence across a broader digital-competence framework. It treats AI as one technology among others. That matters because evaluating a source, protecting data and solving a digital problem do not begin or end with generative AI. A policy can use DigComp to avoid placing AI in a separate silo from digital literacy.
The frameworks differ in audience and purpose. A school-student progression should not be pasted unchanged into a hospital training plan. A workplace policy must consider the specific system, people affected and consequences of error. Referencing a respected framework is the beginning of adaptation, not the end of design.
Teach recognition before operation
People need to know when an AI system is involved. A recommendation, translated message or generated summary may appear as ordinary interface content. If users cannot identify where AI has shaped an output, they cannot decide when extra checking is warranted. Recognition includes understanding what the system does in that context, not simply seeing an “AI-powered” badge.
A literacy lesson might ask participants to trace a decision: which input was provided, which output appeared, who checked it, and what happened afterward. The exercise should include uncertainty and possible errors. It should also show that a non-AI method may sometimes be better. Teaching use without the ability to decline use would be an incomplete form of literacy.
Not every participant needs to understand model architecture at the same depth. A procurement officer, teacher, student and system operator have different responsibilities. Policy should specify which knowledge each role needs to exercise its authority and protect the people affected by its decisions.
Verification is a practiced skill
An AI output can be fluent and wrong. A policy should define when claims need an independent source, how to inspect citations and what to do when evidence is unavailable. “Always double-check” is too vague if no time, source access or method is provided. Training can use examples where the model is correct, partly correct and confidently wrong.
The relevant standard depends on stakes. A harmless brainstorming suggestion needs a different check from a medical explanation or legal decision. A school assignment can teach students to separate model wording from the evidence they have actually examined. An organization can require human review at consequential points and document who is accountable for the final action.
Verification should include recognizing one’s own uncertainty. Someone may accept an output because they do not know enough to spot a problem. A better workflow gives them a way to escalate or ask a domain expert. This is a design and training proposal, not evidence that a disclaimer alone prevents error.
Agency and the right to question
UNESCO’s frameworks emphasize human agency and ethical use. A meaningful AI-literacy policy should therefore teach people to ask whether a system should be used for a task at all. That question belongs before optimization. It includes who benefits, who bears risk, and whether affected people can challenge a decision.
A classroom rule might permit AI for generating examples but require students to produce their own argument. Another course might explicitly teach collaborative drafting with transparent attribution. The difference should follow the learning goal, not a blanket preference for or against the tool. Students need to know what they may do and why.
Workers also need a safe route to report a model’s failure. A policy that celebrates “human oversight” but penalizes delays caused by checking is internally inconsistent. The Institute’s synthesis is that literacy requires authority and time to act on what one knows. Training without that authority can turn awareness into frustration.
Teachers need conditions to teach
UNESCO’s teacher framework treats professional learning and AI pedagogy as distinct from basic familiarity. A teacher may need to understand the system, redesign an assignment, explain disclosure rules and judge student work. Those demands require planning time and support. Simply giving teachers accounts and a slide deck does not establish readiness.
Schools should test whether a new practice helps or undermines learning. An assignment that produces polished essays may hide less practice in planning, reasoning or revision. Another assignment may use AI as a comparison partner and strengthen the student’s ability to critique an explanation. The evidence must examine the learning process and later independent performance, not only the finished document.
Teacher and student voice matter in setting policy. Rules designed without the people who apply them may be difficult to enforce or unfair to those with different access. Participation does not mean every classroom has identical rules; it means expectations are explained and revision is possible.
Access, inclusion and privacy
A policy can widen inequality if some learners have paid tools and others have limited access. It can also impose a mandatory service that requires data a person should not have to provide. The institution should consider device access, accessibility, language, age and the handling of personal or sensitive information before making an AI workflow standard.
AI literacy includes knowing what not to enter into a system. A person may need to avoid sharing patient records, private student work or confidential plans with an unapproved tool. Yet the responsibility cannot rest solely on individual caution. Clear procurement, technical controls and safe alternatives are institutional tasks.
An affected person may not be a user of the AI system. A student graded with AI assistance or a citizen whose application is processed through an AI workflow still has an interest in understanding and contesting the process. The Act’s definition of literacy mentions affected persons; a strong policy considers their perspective even where the institution’s training duty is addressed to its own operators.
Make policy operational
A useful policy names approved systems, purposes, prohibited or restricted uses, review steps, data-handling rules and routes for incident reporting. It identifies who can change the policy when a tool or law changes. It should avoid freezing an exhaustive vendor list into prose that becomes obsolete quickly; a maintained register may work better.
Training then needs role-specific scenarios. A teacher can practice evaluating a generated source list. A manager can examine an automated recommendation and document the evidence for a final decision. A student can compare their own explanation with a model’s and identify what neither can establish without outside sources. The exercise should measure skill, not just attendance.
Documentation should record the policy version and review date. This is especially important when legal text changes, as Article 4 did in 2026. A historical description of the rule may remain useful for understanding the policy’s evolution, but it should not be presented as today’s obligation.
What to measure
A multiple-choice quiz about terminology can reveal some knowledge but little about judgment. A more informative assessment asks a person to identify AI involvement, choose a verification method, explain why an output is or is not fit for a task and describe what to do after an error. The criteria should match the person’s role.
Evaluation can also look at the system around the learner. Did staff have time to check? Were sources available? Did people report problems without retaliation? Were affected users able to obtain an explanation? If a policy increases awareness but leaves no route to respond, the learning outcome may not become safer practice.
Longer-term measures are needed for claims of durable capability. A workshop result can fade, and a new model can change the task. The policy should set a review cadence and ask whether learning transfers to unfamiliar cases. It should also report who was excluded from training or assessment.
Implementation needs a role-specific record. An employer could name which staff operate a system, what decisions they make, which affected groups are involved, and what instruction or supervised practice each role receives. It could test whether people can identify a plausible error, ask for a source and route a concern to someone with authority. A school would ask different questions about learners, educators and age-appropriate use. These are examples of how an institution might document measures under the amended Article 4; they are not a legal checklist supplied by the regulation, nor proof that a course makes a system safe. The consolidated provision asks providers and deployers to support literacy in context and expressly does not require a guaranteed individual level. A policy should therefore avoid a single certificate as a substitute for continuing support and governance. It should also be updated when the relevant system, role or law changes.
What the evidence does not show
The cited frameworks do not prove that a particular curriculum works in every school or workplace. The EU Act’s literacy provision does not prescribe one universal course or require a guaranteed proficiency level for each individual in its October 2026 consolidated form. A certificate of attendance does not prove that a person can evaluate a consequential output.
Nor does AI literacy alone remove model error, privacy risk or unequal access. Those require technical, organizational and governance measures. A policy is credible when it connects learning to real authority, resources and oversight, and when it distinguishes legal duties from educational ambitions.
Back in the school
The teachers agree to define the learning goal before choosing the AI tool. They plan one lesson on how the system produces plausible errors, one assignment where students disclose and evaluate its help, and a later task that tests independent explanation. The school also names who handles private data and who can revise the rules after classroom experience.
That is a beginning, not a completed proof of impact. AI-literacy policy becomes useful when people can recognize, question, use and refuse a system with reasons they understand. Its quality will be shown in what learners and institutions can do when the model’s easy answer is not enough.
Research and policy references
- European Union. (2026 consolidated text). Regulation (EU) 2024/1689, Artificial Intelligence Act, definition of AI literacy and Article 4. View source
- European Commission. (2026). AI literacy: Questions and answers, updated for the amended Article 4. View source
- OECD & European Commission. (2026). Empowering Learners for the Age of AI: An AI Literacy Framework for Primary and Secondary Education. OECD Publishing. View source
- UNESCO. (2024). AI Competency Framework for Students. View source
- UNESCO. (2024). AI Competency Framework for Teachers. View source
- European Commission Joint Research Centre. (2026). DigComp 3.0: The Digital Competence Framework. View source