AI competence and AI literacy: developing a viable concept
By Nico Freitag, Geschäftsführer, Cybersecurity und Governance
AI competence and AI literacy leads to responsible use of generative AI in the respective work context if the target image, roles, limits and verifiable assumptions are clarified before choosing the tool. The practical start consists of a limited scope of application, designated responsible parties, measurable baseline values and a fallback path. What is important is not the amount of technology used, but whether benefits, risks and operation can be proven together.
How does an idea become a testable plan?
The most common starting point is: Employees should use AI, but do not know about approved cases, data rules, quality limits and escalation paths. Before a provider or tool is selected, it must be clear which specific decision is to be improved, which users are affected and which result must be verifiable. For this perspective, the focus is on the target image, roles, boundaries and verifiable assumptions. Note assumptions separately from proven facts and identify points that would preclude starting. This makes offers comparable and prevents an impressive individual demonstration from replacing actual everyday work.
Which problems need to become visible first?
When it comes to AI competency and AI literacy, the main risk is often shadow AI, confidential input and unvetted adoption of convincing answers. Creates a concise map of process steps, data paths, systems, handoffs and responsible roles. Adds current processing time, error consequences and known exceptions to each step. Conversations with real users are more important than a pure management perspective. The goal is not a hundred-page specification, but rather a common picture of where damage occurs, what limits apply and which small part can be improved first.
What does a reliable solution look like?
A sustainable structure combines concrete role cases, permitted tools, source checking, secure input and documented human control. Starts with a zoned pilot containing normal and critical cases. Defines in advance who gives technical approval, who is allowed to make technical changes and when the pilot will be stopped or dismantled. Interfaces, data formats and protocols should be designed in such a way that decisions can be traced later. Documents not only the target architecture, but also operation, maintenance and the way out of the solution. This means that the result remains manageable even after the project team has finished.
Which market trends are really relevant?
Automation, platform services and AI shorten development times, but at the same time increase the speed of changes and the number of external dependencies. For AI competence and AI literacy, it therefore matters less whether a single trend sounds modern. What is relevant is whether it measurably supports the responsible use of generative AI in the respective work context and fits into existing responsibilities. Requires transparent versions, open export channels, comprehensible security commitments and regular reassessment. Consciously foregoing is a good decision if additional operating costs or risk exceed the expected benefit.
How are quality, safety and costs checked together?
Measures correctly classified cases, safe rejection, reported uncertainties and work quality on representative cases and separated into normal operations, special cases and disruptions. The cost accounting includes implementation, internal collaboration, licenses, infrastructure, monitoring, maintenance, training, readiness and subsequent change. Security isn't done with a one-time release: permissions, logs, updates and recovery need fixed review dates. Each key figure is given a starting value, a target and a person who can act if there is a deviation. This turns a technical delivery into a controllable operational process.
What is the next sensible step?
Conducts a ninety-minute working workshop with the department, data protection, IT, human resources and management. Brings a real process, two problematic special cases, existing contracts and known key figures. The end result is a clear pilot scope, three measurable success criteria, open risks, required data and a responsible next date. Use the checklist in this article to prepare and link the result to the appropriate performance and regionality page. This creates a testable starting point instead of a non-binding collection of ideas.
AI competence and AI literacy: work checklist before the next appointment
- Write down the goal and expected result for AI competence and AI literacy in one sentence
- Assign responsibility by name between the department, data protection, IT, human resources and management
- Measure baseline for correctly classified cases, safe rejection, reported uncertainties and work quality before project start
- Completely capture data, systems, service providers and technical dependencies
- Document mandatory criteria, reasons for exclusion and accepted residual risks
- Define pilot, acceptance, fallback path and escalation before implementation
- Plan operation, maintenance, testing and budget for at least twelve months
- Check the results with a specialist user after four to eight weeks
From the answer to implementation
Training
View services, procedures and technical contacts
Open →sudo/PORT Cockpit
Get to know the right product route and practical application
Open →Organize IT security incidents
Download fillable checklist as PDF
Open →Training in Schleswig-Holstein
Regional implementation, special features and contact route open
Open →Sources and basis
The central statements in this article were reviewed against the following primary sources.
Frequently asked questions
- How big should a first step be in AI competence and AI literacy?
- Small enough that results, risks and operations can be checked in four to eight weeks, but large enough to map a complete real work route.
- Which people need to be involved from the start?
- At least department, data protection, IT, human resources and management. Names and decision-making rights are more important than a long list of only informed bodies.
- When should a project be stopped?
- If must-have criteria are not met, critical risks have no person responsible or the benefits cannot be reliably measured compared to the initial value.
- How do you prevent permanent provider dependency?
- Data export, interfaces, documentation, termination process and replacement operation are evaluated before the contract is concluded and regularly tested in practice.