"Have you had AI training yet?" It's a question increasingly heard in boardrooms, often followed by a relieved nod when the answer is affirmative. But those who reduce AI literacy to a one-time training miss the point entirely. The Dutch Data Protection Authority (DPA) published a clear framework in February 2025 that shows why AI literacy is a strategic, multi-year process – not a checkbox you can tick off.
Debunking the myth of one-time training
Since February 2, 2025, the EU AI Act requires organizations to ensure AI literacy among their personnel1. This obligation has unleashed a wave of activity in Dutch organizations, but much of it misses the core of what AI literacy truly entails. The reflex to see this as a training challenge is understandable but fundamentally wrong. AI literacy goes beyond understanding ChatGPT or being able to write prompts – it encompasses technical, social, ethical, and practical aspects of AI systems that are constantly evolving.
The problem with the training mentality lies in the time dimension. AI develops at breakneck speed, meaning what you learn today may be outdated tomorrow. Different roles within organizations require different knowledge and skills, while risks vary by AI system and context. Compliance is not a snapshot you capture with a certificate, but an ongoing process of adaptation and improvement. The DPA states it clearly: "AI literacy is a constant process, as AI developments move quickly and new opportunities and risks emerge"1.
The strategic compass: the Dutch Data Protection Authority's 4-phase framework
The framework presented by the DPA is not a theoretical construction, but a practical roadmap that helps organizations evolve from reactive compliance to proactive AI governance. The four phases – Identify, Set Goals, Execute, and Evaluate – form an iterative cycle that enables organizations to build AI literacy as a strategic capability.
Phase 1: Identify – mapping the invisible AI landscape
Before an organization can invest in AI literacy, it must know where AI has nested itself in its processes. This first phase goes far beyond a simple inventory of software and systems. It requires a forensic look at all processes where algorithms, machine learning, or automated decision-making play a role, from the most obvious chatbots to the subtle predictive models hidden in CRM systems or HR tools.
Take project manager Sandra at a medium-sized consultancy organization. She thought her company barely used AI, until the inventory revealed that their recruitment platform deploys algorithms for CV screening, their CRM makes predictive analyses of customer behavior, and their financial software automatically categorizes invoices based on text recognition. Suddenly it became clear that AI was not only present, but woven into daily business operations. Sandra had to not only understand which systems use AI, but also assess their risk level, identify which employees work with them, and map how these systems affect candidates, customers, and colleagues.
Phase 2: Set goals – why one-size-fits-all fails
In this phase, the limitations of standard AI training become painfully clear. The required knowledge and skills differ not only by function, but also by context, risk level, and organizational culture. An HR employee who screens CVs daily with AI needs fundamentally different knowledge than an executive making strategic decisions about AI investments, and both have different needs than a data scientist building models.
| Role | Required knowledge | Focus |
|---|
| HR employee | Bias recognition, transparency to candidates | Ethics and practice |
| Teacher | Recognizing AI-generated content, source criticism | Quality control |
| Data scientist | Model validation, explainability, bias mitigation | Technology and ethics |
| Executive | Strategic risks, governance, compliance | Policy and oversight |
The DPA document illustrates this with concrete examples. A teacher using generative AI to prepare lessons must understand how information is created and realize that AI can contain prejudices and incorrect information. HR personnel using a profiling assessment with AI, on the other hand, must know enough about the risks of bias in recruitment and the legal requirements for transparency to candidates. These differences are not superficial – they touch the core of how AI literacy should take shape within an organization.
Phase 3: Execute – from theory to daily practice
The execution phase is where many organizations stumble, because they fall back on familiar patterns of classroom training and e-learning modules. The DPA framework calls for a much richer and more integrated approach. Effective AI literacy does not emerge in a classroom, but in daily work practice where employees actually interact with AI systems.
Organizations that are successful in this phase combine different strategies. They develop an organization-wide AI vision that clarifies how AI contributes to the organization's mission and values. They organize informal learning moments such as 'lunch & learn' sessions where employees share experiences about new AI developments. But crucial is that they also invest in hands-on exercises with the AI systems that employees actually use, so that abstract understanding is converted into practical skills.
Structural measures are as important as educational ones. Large organizations appoint an AI officer who coordinates the strategic development of AI literacy and serves as a point of contact for complex AI issues. AI considerations are integrated into existing processes such as project management, risk management, and quality control. Decision trees are developed that help employees determine when and how AI tools can be deployed in concrete situations.
Phase 4: Evaluate – the iterative spiral toward maturity
In the evaluation phase, the difference between training and process becomes most pronounced. Where training ends with a certificate, a strategic AI literacy program starts here again with the question: what have we learned and how can we improve? This phase revolves around systematically collecting feedback, measuring progress, and identifying new challenges and opportunities.
Organizations that do this well use a mix of quantitative and qualitative indicators. They measure employee knowledge and skills through regular assessments, but also look at the number of AI-related incidents, compliance scores in audits, and stakeholder satisfaction. Annual employee surveys provide insight into how AI literacy is experienced in the organization, while periodic audits of AI systems identify technical and procedural improvement points.
What really distinguishes this phase from traditional training evaluation is the forward-looking orientation. Organizations actively monitor new regulations, technological developments, and best practices in their sector. They anticipate changes instead of just reacting to them. Evaluation thus becomes a strategic instrument that helps the organization stay ahead instead of chasing facts.
From cost center to strategic capability
The transformation of AI literacy from compliance obligation to strategic capability is perhaps the most fascinating development that the DPA framework enables. Organizations that make this mental shift discover that investing in AI literacy delivers much more than just meeting legal requirements. It becomes a catalyst for innovation, efficiency, and competitive advantage.
The direct benefits are measurable and substantial. Organizations that systematically train their employees in effective AI use report time savings of up to 65% for certain tasks. This efficiency gain arises not only because employees use AI tools, but especially because they deploy these tools smartly and strategically. Compliance risks drop significantly because employees better understand when and how AI systems can fail. Productivity increases not only through automation, but also through improved decision-making by AI-aware employees who can critically assess system output.
The strategic advantages reach even further. Organizations that lead in AI literacy develop a competitive advantage through faster and more effective AI adoption. They become more attractive employers for AI talent, because these professionals know they will enter an environment where their expertise is valued and supported. Stakeholder relationships improve through increased transparency about AI use, which is crucial for trust especially in sectors like financial services and healthcare. Perhaps most importantly: these organizations build adaptive capacity that makes them future-proof against the next wave of AI innovations.
Executive leadership: why the top makes the difference
The DPA document is explicit about one critical success factor: executive commitment. Without support and direction from the top, AI literacy remains a side issue that drowns in daily operational pressure. This is not a bureaucratic formality, but a practical necessity that stems from the nature of AI literacy as an organization-wide cultural change.
Effective executive commitment manifests in concrete actions. The board establishes a multi-year plan that positions AI literacy as a strategic priority, not as a temporary compliance exercise. Budget is reserved for continuous development, because AI literacy is not a one-time investment but an ongoing operation. Responsibilities are assigned to specific roles, so it's clear who is accountable for progress and results. Periodic reporting and monitoring are organized to make visible how AI literacy evolves within the organization.
This involvement of the board is crucial because AI literacy affects all organizational layers and cultural change requires time and persistence. Employees take initiatives seriously when they see the board actually investing in them. Moreover, compliance with the EU AI Act requires demonstrable efforts – efforts that are only credible if they are directed and supported from the top.
The roadmap to AI maturity
A strategic approach to AI literacy requires a multi-year roadmap that systematically leads organizations to maturity. The DPA framework provides the structure for this, but practical implementation requires customization and patience. Organizations that successfully complete this process develop from reactive compliance followers to proactive AI leaders.
In the first year, it's about laying foundations. Organizations conduct a complete AI inventory that reveals much more than expected. They make risk analyses per system and often discover that AI is more deeply woven into their processes than thought. The first role-specific training is set up, with emphasis on awareness and basic skills. AI policy and procedures are developed that are practical and workable, not bureaucratic and restrictive.
The second year revolves around expanding and integrating. Advanced training is set up for power users who use AI systems intensively. AI considerations are systematically integrated into all organizational processes, from project management to risk management. The first evaluation takes place, followed by adjustment based on lessons learned. Knowledge sharing and best practices are formalized, so that individual experiences generate organization-wide learning effects.
In the third year and beyond, the focus is on optimizing and innovating. A mature AI governance structure is operational, providing both control and flexibility. Proactive trend monitoring is institutionalized, so the organization anticipates new developments instead of reacting to them. Continuous improvement becomes the norm, not the exception. Strategic AI partnerships are entered into that help the organization stay ahead.
The paradigm shift: from compliance to competition
The DPA framework marks a paradigm shift in how organizations should look at AI literacy. Where it was initially seen as a compliance obligation – something that must be done because of the EU AI Act – the framework shows that AI literacy is a strategic capability that distinguishes organizations from their competitors.
This shift is fundamental. Organizations that still see AI literacy as a cost center that should be minimized are missing the boat. Organizations that see it as an investment in their future position themselves for success in a world where AI skills become as important as digital literacy has become in recent decades.
The choice lies with each organization individually. The DPA framework provides the roadmap, the EU AI Act creates urgency, but the strategic vision and commitment to embrace AI literacy as an ongoing process – that must come from within. Organizations that make this choice and act consistently on it will discover that AI literacy is much more than compliance. It is an investment in human potential, organizational improvement, and competitive advantage.
The question is no longer whether you should invest in AI literacy, but how quickly you can start with the strategic process that the DPA framework describes. The time of ad-hoc training and superficial compliance is over. The future belongs to organizations that embrace AI literacy for what it really is: a strategic process that transforms people, processes, and performance.
