AI Literacy as a Governance Control
A company can report 98% completion of its annual AI training and still be unable to answer basic governance questions. Do the people approving AI-assisted decisions understand when the output should be challenged? Can system owners explain the controls they are responsible for? Do reviewers know when a change in the model or use case requires escalation?
That is the weakness of treating AI literacy as a learning campaign rather than a governance control.
AI literacy becomes controllable when four things connect: a person’s responsibility, the capability needed to perform it, evidence that the capability exists, and triggers for refreshing it.
AI literacy is no longer a one-level requirement
Article 4 of the current EU Artificial Intelligence Act requires providers and deployers of AI systems to take measures that support the development of AI literacy among staff and other persons operating or using AI systems on their behalf. Those measures must take account of technical knowledge, experience, education and training, the context in which the system is used, and the people or groups affected by that use.
There is an important change for compliance programs designed around the original 2024 wording. Following the July 2026 amendment, Article 4 no longer requires providers or deployers to guarantee a specific level of AI literacy for each individual. The duty remains, but the regulatory logic now focuses on taking contextualized measures to develop literacy. The European Commission also states that Article 4 does not itself require formal measurement of every employee’s AI knowledge and that training is not the only possible literacy measure. Supervision and enforcement of the provision began in August 2026.
This makes a one-size-fits-all course even harder to defend as a complete control. It may be administratively convenient, but it does not necessarily reflect system risk, user context, or assigned responsibilities.
For organizations based in Mexico or elsewhere in Latin America, Article 4 should not be presented as an automatic local requirement simply because they use AI. Applicability depends on the AI Act’s territorial scope and the organization’s role. The underlying control principle, however, remains useful well beyond the EU: capability should be proportionate to responsibility and risk.
Literacy should follow accountability
Not every employee needs to understand model training. But not every employee can stop at “AI sometimes makes mistakes,” either.
A practical role-based structure can distinguish at least four layers:
| Group | What they should be able to do | Useful evidence |
|---|---|---|
| General workforce | Recognize permitted and prohibited uses, basic risks, data-handling rules, and escalation channels. | Onboarding, communications, policy acknowledgement, short exercises. |
| Users, reviewers, and approvers | Challenge outputs, recognize relevant error or bias, apply human oversight, and know when not to rely on the result. | Use-case training, simulations, review criteria, observed practice. |
| Owners, developers, and validators | Understand lifecycle controls, data, testing, documentation, change management, monitoring, and incidents. | Competence matrices, experience, credentials, assessment results, validation records. |
| Governance, risk, compliance, and audit | Frame governance questions, interpret risk, assess evidence, and recognize when specialist support is needed. | Development plans, demonstrated experience, targeted learning, evidence of application in reviews. |
This is not a classification mandated by the AI Act. It is a control design that translates the Act’s contextual approach, together with competence expectations found in management-system and professional standards, into an operating model.
The principle is straightforward: the greater a person’s authority to design, approve, operate, oversee, or assure an AI-enabled decision, the deeper the literacy that role should require.
ISO/IEC 42001 makes competence auditable
ISO/IEC 42001:2023 adds the management-system discipline that many training programs lack. Clause 7.2 requires an organization to determine the competence needed by people whose work affects AI performance, ensure that they are competent on the basis of appropriate education, training, or experience, take action where needed, evaluate the effectiveness of those actions, and retain appropriate documented information as evidence of competence.
Clause 7.3 addresses a related but different concept: awareness. People working under the organization’s control are expected to understand the AI policy, their contribution to the effectiveness of the AI management system, and the implications of not conforming with its requirements.
The distinction matters. Knowing that a policy exists does not demonstrate that a reviewer can perform effective human oversight. Completing a course does not demonstrate that a validator can identify a meaningful degradation in system performance.
A completion record proves exposure to training; it does not, by itself, prove competence.
ISO/IEC 42001 is a management-system standard, not a general AI law. Organizations may adopt it voluntarily, contractually, or within a certification program. Its value for audit is that it provides a disciplined way to separate awareness, competence, evidence, and effectiveness.
What Internal Audit can actually test
Internal auditors do not need to design the literacy program to evaluate whether it works. They can reconstruct the control chain from AI risk to role, expected capability, and evidence.
A practical review can test:
- Coverage. Is the target population derived from the AI system and use-case inventory, or from a generic employee list?
- Role mapping. Are expectations different for people who use, approve, develop, validate, administer, or oversee AI?
- Content relevance. Does learning address the actual use-case risks, internal policies, system limitations, data handling, human oversight, and escalation?
- Evidence of competence. Where risk justifies it, is there evidence beyond attendance, such as simulations, practical assessments, supervised application, experience, or credentials?
- Effectiveness. Does the organization examine whether literacy measures reduce misuse, policy breaches, incidents, exceptions, or poor escalation decisions?
- Refresh triggers. Is literacy revisited when a system, use case, role, policy, or regulatory expectation changes?
Not every item above is a textual requirement of Article 4. They are audit criteria for determining whether a governance control is coherently designed and operating; some are more directly supported by ISO/IEC 42001 where the organization uses that framework.
Evidence should also remain proportionate. A casual user of an approved low-risk tool may need targeted onboarding and clear rules. A person validating a high-impact AI system should require much stronger evidence of both knowledge and application.
Internal Audit is part of the competence equation
An internal audit function cannot credibly assess AI governance if its own professionals lack the competence needed for the work.
The Global Internal Audit Standards make competency a professional requirement. Standard 3.1 requires internal auditors to possess or obtain the competencies necessary to perform their responsibilities and to continually develop and apply them. Standard 10.2 requires the chief audit executive to establish an approach for recruiting, developing, and retaining qualified auditors and to evaluate and develop the competencies of individual internal auditors.
That does not mean every auditor needs to become a data scientist. It means the function should know what it can assess with its existing capability, what skills it must build, and when specialist support is needed for areas such as model validation, cybersecurity, privacy, or legal interpretation.
The same control logic Internal Audit expects from the business should therefore exist inside the function: defined responsibility, appropriate capability, and evidence of development.
The control is capability, not the course
More mature organizations will stop asking only, “Who completed the training?” and start asking, “What does this person need to know to perform their responsibility over this AI system safely and effectively?”
That shift turns AI literacy into an auditable governance control. The AI inventory identifies where exposure exists. Role assignment clarifies who makes or oversees decisions. Competence expectations translate those responsibilities into capabilities. Evidence then allows the organization, and Internal Audit, to determine whether the control is actually working.
The goal is not to train everyone to specialist depth. It is to avoid the opposite condition: people with authority over AI-enabled decisions who do not understand the risks, limits, or obligations attached to those decisions.