AI literacy for agencies in 2026: turn policy into practice

AI literacy is easy to reduce to a training slide: “Use AI responsibly.” That is not enough for an agency where people work across proposals, reports, forms, creative, contracts, and client data.

The European Commission’s AI Act guidance says AI literacy obligations have applied since 2 February 2025, while the Act’s broader application has a staged timeline. The exact obligation depends on the organisation, the system, the role, and the jurisdiction. This is not legal advice.

The practical lesson is broader than one regulation: people need enough understanding to use an AI system safely in the work they actually do.

Make literacy task-specific

An account manager needs to know what can be uploaded to a drafting tool and how to describe AI assistance to a client. A designer needs to understand provenance, rights, and review of generated assets. A developer needs to understand permissions, tool calls, logging, and failure modes. A reviewer needs to know how to challenge unsupported claims.

One generic course cannot replace those task-level habits.

Teach five things for every approved tool

Purpose

What job is the tool approved to help with? Drafting from a supplied brief is not the same as making an eligibility decision or sending client communications.

Inputs

What data may enter the tool? Identify confidential, personal, regulated, and client-restricted information. Teach redaction with examples from the agency’s real work.

Limits

What can the tool get wrong? Cover invented facts, missing context, stale data, poor transformations, bias, unlicensed material, and overconfident language.

Controls

Who checks the output? What requires approval? Which actions are read-only, reversible, or external? Where are comments and versions kept?

Escalation

What should a team member do when the tool produces a problem? Give them a person, a channel, and a simple incident note. “Do not use it again” is not a response plan.

Keep an evidence trail

For material client work, record the tool, purpose, source material, reviewer, and final approval. You do not need to save every exploratory prompt forever, but you should be able to explain how a deliverable was produced and who owned the final judgment.

For a connected or agentic workflow, record permissions and actions as well. The OWASP GenAI Security Project’s 2026 resources are a useful prompt to treat access and agency as part of literacy.

Practice with realistic examples

Training sticks when it uses the work people see every week. Try a short exercise:

1. Give the team a harmless but messy brief.
2. Ask them to identify missing information and sensitive fields.
3. Have them produce a draft with assumptions marked.
4. Review facts, scope, tone, privacy, and next action.
5. Discuss what they would tell the client.

The goal is not perfect output. It is a shared vocabulary for noticing risk early.

Review the policy when the workflow changes

Update the rule when a new model provider, connector, agent, data source, or client promise enters the workflow. An old policy that describes yesterday’s tool gives false confidence.

AI literacy is not about making every person an AI engineer. It is about making the safe path obvious: use approved tools for approved work, minimise inputs, review outputs, protect permissions, document material decisions, and ask for help when the workflow no longer fits the rule.