AI literacy is not a single competence that somebody either has or lacks. It is a set of twelve, in five groups, and the common pattern is to be genuinely strong in two or three and never to have considered the others.
Understanding what AI is
1. Telling the types apart. Knowing whether a tool generates content, predicts an outcome or classifies an input, because each fails in a different way. A useful self-check: can you name one AI system in your workplace that does not generate anything? Most people cannot, which is why the risks of scoring and ranking systems go unexamined.
2. Knowing the current limits. A realistic sense of what today’s tools do well, such as drafting, summarising and reformatting, and what they do badly, such as exact arithmetic, niche facts and recent events. Self-check: would you accept a chatbot’s total of four hundred invoice lines?
Understanding how it works
3. Understanding how output is produced. Knowing that a language model predicts plausible continuations, which is precisely why it can invent a citation that has the right shape and no referent. Self-check: can you explain a hallucination to a colleague in one sentence, without using the word hallucination?
4. Knowing what the tool knows. Training cutoffs, context limits, and whether the tool is reading the document in front of it or recalling something approximate. Self-check: does the assistant you use know about a rule that changed last month?
Using AI effectively
5. Giving clear instructions. Stating the task, the audience, the format and the constraints. “Summarise this for a finance manager, under 300 words, with clause numbers” is a different instrument from “summarise this”.
6. Supplying the right sources. Giving the tool the actual policy, contract or dataset rather than asking it to remember one. This single habit removes a large share of errors, and it is the cheapest of the twelve to adopt.
7. Choosing the right tool, or none. A spreadsheet for sums, a search engine for current facts, a model for drafting and restructuring, and a person for the judgement call. Competence here is mostly the willingness to not use the interesting option.
Evaluating what comes back
8. Verifying output. Checking figures, names, dates, citations and omissions, in proportion to what is at stake. This is the most important skill on the list and the one most often assumed rather than practised. Self-check: when did you last catch an error in AI output before somebody else did?
Omissions deserve their own mention, because they are the hardest class to catch. A summary that is accurate in everything it says can still be wrong by leaving out the clause that mattered, and nothing in the output signals the gap.
Using AI responsibly
9. Protecting data. Knowing what must never enter which tool, and knowing the difference between a consumer product and a contracted enterprise deployment. The distinction is not intuitive and is rarely explained to the people making the decision at speed.
10. Spotting bias. Recognising that a system trained on historical data can reproduce patterns nobody endorsed, and being willing to ask how a tool was tested before trusting what it ranks.
11. Knowing the rules that apply. The organisation’s own AI policy first, then data protection law, then awareness-level familiarity with the frameworks that govern the sector.
12. Owning the decision. Accepting that “the system said so” is not a defence, knowing when to escalate, and recording what was checked. This is the skill that converts the other eleven into something an organisation can rely on.
How they map to the assessment
The Council’s AI Literacy Certificate is built on five domains, and the twelve skills map onto them directly.
| Skills | Domain | Weight |
|---|---|---|
| 1–2 | AI fundamentals | 20% |
| 3–4 | How AI works | 20% |
| 5–8 | Generative AI and everyday use | 20% |
| 9–10 | Risks, limits and responsible use | 25% |
| 11–12 | AI governance awareness | 15% |
Which ones are usually missing
The pattern is consistent enough to predict. Frequent AI users are strong on 5 to 7 and weak on 8 to 12: fluent with the tools, less practised at checking, protecting and owning the result. Occasional users are usually the reverse, cautious and slow, with sound instincts they rarely exercise.
Both profiles read as “comfortable with AI” in an interview. Only one of them is safe with a client file, and the difference does not show up until something goes wrong.
That asymmetry is why risks and governance together carry 40% of the assessment. The syllabus sets out every topic in advance, and the result comes back scored by domain, so a pass that hides a weak domain still tells the holder where the gap is.