AI literacy has become an organisational skill

You must now treat AI literacy as a demonstrable control process within your organisation, not as a voluntary training programme. Record which AI systems each role may use, which errors employees must recognise, when escalation is mandatory and how you will test effectiveness periodically. A general course alone is insufficient.

An analysis of 21 October 2026 of organisational AI literacy as a measured control obligation argues that employee training must be tied to the specific systems and risks your organisation actually deploys, rather than treated as a standalone skill acquisition. The substantiation draws on employee surveys, academic research on competence domains and correlations between training uptake and increased AI use. In our assessment, the practical shift is this: whoever deploys AI in your workflows must be able to demonstrate that training, assessment and usage limits match the actual systems in use and the risks they carry—and cannot rely on a one-off or voluntary course to satisfy that obligation.

What competence domains does a prompting course actually cover?

A structured review of generative AI competence identifies four distinct domains of capability. A training programme focused only on prompt engineering leaves three of those domains unmeasured. These unmeasured domains are directly relevant to whether your employees can recognise uncertainty in AI outputs, calibrate their reliance on those outputs and control AI use before information enters a decision, file or piece of advice. If your training tests only prompting skill, you have no evidence that employees can perform these other functions.

Which concrete controls do the new expectations demand?

Because employee surveys show that leaders and staff judge training adequacy differently, your board's confidence in the programme is not reliable proof of its effectiveness. Because research correlates training uptake with more frequent AI use, a training programme can increase your organisation's actual exposure to AI risk by driving adoption further. Because competent deployment requires recognising uncertainty and limiting AI agents, a prompting course alone is not sufficient evidence of due care.

You must establish:

1. Define permitted systems and data per workflow — document which AI systems each role may use and which types of data they may input, before training drives adoption further.
2. Measure effectiveness with employees themselves — assess training outcomes directly with staff and include results in periodic risk reporting to the board.
3. Record mandatory escalation points in writing — establish and document when human review is required and who holds final judgement before an AI output is used.
4. Test source and output checking separately — build assessment moments that evaluate confidentiality awareness, error recognition and stop-escalation capability independently of usage figures.
5. Link training to concrete systems, not AI in general — record the arrangement in documents that name the specific systems and tasks, not abstract AI competence.

How does this differ from existing training practice?

The difference is between ticking off a course completion and being able to show that employees master the systems they actually use. A defensible programme makes the link between training, usage limits and testing visible in your records. This approach aligns with broader professional duties to verify—the same principle that applies to signing lawyers and audit trail software. For organisations that deploy AI structurally, the obligation is no longer optional.

What role does tooling play in this process?

Software can help you record which systems are in use, track which employees have completed role-specific assessments and flag when usage patterns diverge from documented limits. Tooling cannot, however, determine whether your organisation's risk appetite matches your usage policy, whether the limits you have set are appropriate for your sector or whether an employee has genuinely understood when to escalate. Those judgements remain yours. The tool is a record-keeper and a prompt; the responsibility for the control itself stays with your leadership and your legal function.