People & Skills ยท PPL-01
AI literacy for all staff
Everyone in the organisation has a baseline understanding of what AI is, what it can and cannot do, and how to use it safely under the organisation's policy.
Why it matters
Staff meet AI in the tools they already use, whether or not the organisation plans for it. A shared baseline lets people spot unreliable output, avoid sharing what they should not, and see where AI could help their work.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No organisation-wide AI learning; understanding depends on individual interest. |
| 2 Developing | Some AI awareness material exists, but it is optional, reaches few staff or is out of date. |
| 3 Defined | Everyone who uses or operates AI for the organisation must complete a defined AI literacy baseline that is kept current, and completion is recorded. |
| 4 Managed | Completion and understanding are measured across the organisation, gaps by group are followed up, and content is refreshed on a set cycle. |
| 5 Optimising | The baseline is updated from incidents, staff feedback and changes in AI tools, and its effect on safe use is assessed. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- PPL-01.1 A defined AI literacy baseline covers what AI can do, its limits and its risks.
- PPL-01.2 The baseline covers the AI policy, the adopted ethical principles, and the environmental and social impact of AI use.
- PPL-01.3 The baseline covers the AI security threats relevant to all staff, and updates are issued as new threats appear.
- PPL-01.4 The baseline is required for all staff, including new joiners.
- PPL-01.5 The baseline is also required for contractors and others who operate AI on the organisation's behalf.
- PPL-01.6 Completion of the baseline is recorded for everyone it is required of.
Assessment questions
- What does every member of staff need to know about AI, and where is that set out?
- How many staff have completed it, including new joiners and contractors?
- How do you know people understand it, not just that they completed it?
- The literacy baseline or curriculum, with an owner and review date
- Completion records by group
- Results of knowledge checks or surveys
- Literacy completion records for contractors who operate AI
- AI security content in the literacy baseline and recent threat updates
How to reach Level 3
- Write a short literacy baseline that covers what AI can and cannot do, its main risks, the security threats every member of staff could meet, the AI policy (GOV-01), the adopted ethical principles (RSK-05) and the environmental and social effects of AI use.
- Name an owner for the baseline and set a way to send staff brief updates when a new threat or significant tool change appears.
- Make the baseline required for all staff, add it to the joining process, and make it a condition for contractors and others who operate AI on your behalf.
- Record completion for every group, including contractors, in one place that can be reported by team.
Common pitfalls
- Teaching only how to use one tool, so staff learn the buttons but not the limits and risks.
- Leaving contractors and temporary staff out because they sit outside the normal learning system.
- Writing the security content once and never updating it as new threats appear.
Starter artefacts
- AI literacy baseline with owner and review date
- Completion register covering staff and contractors
- Threat update bulletin template
Ownership and sequence
- Accountable
- people lead
- Contributors
- ai governance lead, security lead
- Depends on
- GOV-01
- Roadmap step
- 3
- Lifecycle
- strategy, operate
Cross-references
| AI Cyber Security Code of Practice | 1.1 partial; 1.2 direct; 4.5 partial; 10.2 partial |
|---|---|
| EU AI Act | Art 4 direct |
| GDS AI Playbook | P1 direct |
| ISO/IEC 42001 | 7.3 direct |
| JSP 936 Part 1 | para 15 partial; para 185 partial |
| MITRE AI Maturity Model | P3.1 partial; P3.3 partial |
| NIST AI 600-1 | R2 partial; R7 partial |
| NIST AI RMF 1.0 | GOVERN 2.2 partial; GOVERN 4.1 partial |
| UK Data and AI Ethics Framework | Environmental sustainability 5 direct; Safety 9 direct |
| UNESCO AI Maturity Framework | 2.5 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.