AI Literacy Statement
Document version: 3.0
Date: 2026-10-15
Issued by: Hoodin
1. Purpose of this statement
This statement explains how artificial intelligence (AI) is used within Compliance Studio and what users and organisations need to understand to use its AI-supported functionality appropriately.
It provides guidance on AI-generated outputs, professional review, role-based competence and responsible use. It is intended for regulatory professionals, reviewers, quality functions, legal advisers and management.
This statement supports organisational AI literacy activities. It does not replace practical instruction, role-specific competence or customer procedures.
2. Relationship to the EU AI Act
This statement addresses two distinct aspects of Regulation (EU) 2024/1689, the EU AI Act:
Article 4, AI literacy: measures to support the development of AI literacy, taking account of personnel’s knowledge, experience, training and the context of use.
Article 50, transparency: applicable obligations to inform individuals about AI interaction and to identify AI-generated or manipulated content, including machine-readable marking where required.
Hoodin is responsible for AI literacy measures concerning its own personnel and for applicable provider obligations. Customers are responsible for measures appropriate to personnel operating or using AI systems on their behalf. This statement provides product-specific information to support those activities. ai-act-service-desk.ec.europa.eu
Reading or acknowledging this statement does not, by itself, demonstrate compliance with either article. Transparency also depends on the design and operation of the relevant system functions.
3. Role of AI in Compliance Studio
Compliance Studio uses AI to support regulatory discovery, analysis, monitoring and planning.
AI-supported capabilities include:
Regulations Register: generating proposals of potentially applicable regulatory instruments based on product, company and market context.
Record Scout: discovering potentially relevant regulatory instruments for review and possible inclusion in a register.
Provision Finder: identifying potentially relevant provisions within a regulatory instrument.
Regulatory Signals: supporting the identification and processing of regulatory developments for contextual review.
Studio Agent: supporting regulatory exploration, analysis, pathway exploration and preparation of working materials such as checklists and diagrams.
AI can propose applicability assessments, interpretations and next actions. It does not independently confirm applicability, approve regulatory conclusions or determine compliance.
Automated discovery and monitoring may operate without a user initiating each processing step. This does not constitute user review or approval of the resulting information.
4. Context-governed AI support
Compliance Studio organises regulatory work around a Regulatory Position, linking a product or company to a selected market and its associated regulatory context.
Studio Agent uses the context available within the relevant interaction. This may include product or company attributes, market information, register content, documented rationale and relevant Signals.
Context can originate from customer information, system records, regulatory sources and previous AI-supported processing. Its availability depends on the function and scope of the interaction.
Context improves relevance but does not guarantee accuracy or completeness. Users should check that relevant information is current and distinguish established facts from assumptions introduced for exploration.
For example, a pathway explored using a hypothetical intended purpose should not be treated as a conclusion about the actual product.
5. Understanding the status of outputs
The following distinctions describe how outputs should be treated. They do not imply that every output has a corresponding formal status or approval workflow within the system.
Output | What it represents | Required user response |
Applicability proposal | A candidate assessment based on available context and sources. | Verify the regulatory basis and relevance before confirming a determination. |
Regulatory analysis | A working interpretation or reasoning exercise. | Review sources, assumptions, omissions and alternative interpretations before relying on it. |
Regulatory Signal | Information about a regulatory development potentially relevant to a position. | Assess whether it changes applicability, obligations, timelines or required activities. |
Checklist or pathway | A proposed structure of activities, questions or evidence needs. | Adapt it to the actual circumstances and verify completeness before operational use. |
User-reviewed conclusion | A determination made by an authorised person following appropriate review. | Record the basis and any required approval through the organisation’s applicable procedures. |
A Signal does not automatically mean that action is required. Conversely, the absence of a Signal does not establish that no relevant change has occurred.
An AI-generated statement that describes itself as “verified” or “confirmed” is not evidence that professional review has taken place.
6. Limitations users need to understand
AI-generated content may be incorrect, incomplete, outdated or unsuitable for the specific question.
Users should recognise that:
Relevant regulations, provisions or developments may be missed.
Applicability proposals may rely on incomplete or misunderstood context.
Legal status, application dates and transitional arrangements may be misinterpreted.
References may be inaccurate or fail to support the stated conclusion.
Important exceptions, dependencies or jurisdictional differences may be omitted.
Confident language and detailed explanations do not establish reliability.
AI-generated reasoning supports examination of an answer. It does not provide full visibility into the model’s internal operation or prove that the answer is correct.
7. Role-based AI literacy
The following matrix provides a practical basis for assigning competence expectations. These are functional responsibilities, not mandatory separate job titles. One person may fulfil several roles.
Role | What the person should understand and be able to do | Suggested demonstration of understanding |
User | Recognise AI involvement, distinguish proposals from decisions, provide appropriate context, protect information and perform basic source checks. | Review an example output, identify an unsupported claim and explain when to seek assistance. |
Regulatory reviewer | Evaluate applicability, source authority, legal status, assumptions and uncertainty; document a defensible conclusion. | Review a representative proposal and explain the evidence supporting acceptance, revision or rejection. |
Quality function | Assess intended organisational use, proportionate controls, competence records, traceability and incorporation of outputs into controlled processes. | Explain how an AI-supported assessment is reviewed and retained under the organisation’s procedures. |
Legal function | Recognise when interpretation, liability, contractual or data protection issues require legal assessment. | Identify an issue requiring legal review and distinguish legal advice from AI-supported analysis. |
Management or process owner | Define permitted use, allocate accountability and resources, and understand residual risks and escalation arrangements. | Explain who may use, review and approve outputs and how significant concerns are addressed. |
8. Introduction, reinforcement and competence records
Before independent use, organisations should provide an introduction proportionate to the person’s role and intended activities. It should cover the relevant functionality, output limitations, verification, data handling and escalation arrangements.
Understanding can be assessed through practical examples, supervised use or discussion of representative scenarios.
Instruction should be revisited when significant changes in functionality, responsibilities, use or observed errors indicate a need. A fixed annual training cycle is not prescribed by this statement.
Organisations should retain proportionate records of the measures taken, such as the individual’s role, material reviewed, instruction date and any practical assessment or follow-up.
An acknowledgement records receipt or review of information. It should not be treated as equivalent to demonstrated understanding. Article 4 does not prescribe a particular training certificate or attestation format. digital-strategy.ec.europa.eu
9. Practical verification and escalation
Source hierarchy
Verification should start with the authoritative source appropriate to the question.
Source type | Appropriate use |
Official legislation and legally binding instruments | Establish obligations, scope, exceptions and applicable dates. Check amendments and transitional provisions. |
Official authority guidance and communications | Understand regulatory expectations and implementation. Distinguish guidance from binding requirements. |
Relevant standards and recognised technical documents | Assess technical expectations and their applicable status, edition and relationship to legislation. |
Secondary commentary and AI-generated explanations | Support discovery and understanding. Trace material conclusions back to appropriate authoritative sources. |
The legal effect of guidance and standards depends on the relevant framework. Their status should not be inferred solely from their title or source.
Minimum verification steps
Before relying on an output:
Confirm the product or company, market and question being assessed.
Open the cited source and check the relevant passage.
Verify its version, legal status, jurisdiction and applicable dates.
Check whether the passage supports the conclusion, including exceptions and conditions.
Resolve material assumptions and identify missing evidence.
Record the conclusion, rationale and required review through the applicable organisational process.
For example, publication of an amendment does not necessarily mean that all amended requirements apply immediately.
Escalation
Routine source checks may be performed by users within their competence. Uncertain applicability, conflicting sources or material effects on regulatory strategy should be referred to an appropriately qualified regulatory reviewer.
Questions involving disputed legal interpretation, contractual exposure or significant legal uncertainty should be referred to legal expertise where appropriate.
Where uncertainty could materially affect a decision, the output should remain unresolved until sufficient review has been completed.
10. Changing AI behaviour
The same question may produce different answers across interactions. Responses may also change because of updated sources, altered context, different instructions or changes to underlying AI services.
Users should therefore:
Treat a newly generated answer as a new working output requiring appropriate review.
Investigate material differences rather than assuming the latest answer is more accurate.
Recheck conclusions when relevant product, company, market or regulatory information changes.
Retain the source basis and reviewed conclusion through the applicable organisational process.
Avoid treating repeated agreement from the AI as independent corroboration.
A previous review does not automatically extend to a revised analysis or an answer generated using different assumptions.
11. Information handling and error reporting
Users should enter information only where permitted by their organisation and the service’s defined scope. Personal data should be limited to what is necessary. Patient records, clinical trial subject data and sensitive health information are outside the system’s intended scope.
Confidential information should only be introduced where the organisation has assessed the relevant contractual and security arrangements.
Third-party AI services may process information made available to AI-supported functions. Data handling, retention, provider arrangements and applicable safeguards are addressed in Hoodin’s security, privacy and contractual documentation. This statement does not establish a separate commitment concerning model training or retention.
Material errors or unexpected AI behaviour should be reported to quality@hoodin.com, including the affected function, time, relevant context, output and suspected consequence. Reports should avoid unnecessary personal or confidential information.
Where an output may be unreliable, users should suspend reliance on the affected conclusion and consider whether earlier decisions require review under their own procedures.
12. Relationship to other governance documents
This statement should be read alongside:
System overview & intended use.
Validation approach for Hoodin Compliance Studio.
Security & data handling overview.
Privacy Policy.
Procurement & vendor information.
Procurement questionnaire companion.
Terms and Conditions.
Compliance Studio supports professional regulatory work. Final regulatory decisions, compliance determinations and formal approvals remain the responsibility of the user organisation and relevant authorities or conformity assessment bodies.