AI literacy has become an organisational control obligation, not a voluntary skill

Treat AI literacy as a demonstrable control process, not voluntary prompting skill: record per role and workflow which AI systems are permitted, which errors employees must recognise, when escalation is mandatory and how you test effectiveness periodically. A general course is not enough, because leaders and employees demonstrably judge its adequacy differently.

On 20 October 2026, the research agency JANSON Research & Strategy announced a national study into the question of whether employee training keeps pace with the speed at which organisations introduce AI. This is an announced study for which participants are still being recruited; there are therefore no results yet. That study does not itself confirm that AI literacy has already shifted towards an organisational responsibility. Our analysis, however, is that the combination of the available research gives reason to treat AI literacy as a responsibility that organisations must demonstrably control.

In our assessment, that is the core of the shift: whoever deploys AI in the work must be able to show that training, assessment skills and usage limits match the actual systems and risks — and cannot make do with a one-off or voluntary course.

What exactly does the new research into AI training and adoption establish?

The announcement by JANSON Research & Strategy describes an as-yet ongoing study and provides no findings of its own. The substantiation comes from other, already published sources. These show correlations and perceptions, not universal causality or a legal norm.

• The Center for Workplace Culture and Innovation at UC Berkeley reports that trained employees used AI more often than untrained ones and saved more time on average. At the same time, the study warns that training does not automatically lead to sustainable productivity.
• A study in Management Review Quarterly (Springer Nature) found, among more than three hundred managers, that applied AI literacy is positively associated with perceived usefulness and job satisfaction — AI literacy is therefore also a management competency, not only something for technical specialists.
• Research by Wharton Human-AI Research and GBK Collective shows a perception gap: more than three-quarters of leaders felt that employees receive sufficient training, compared with a clearly smaller share of the employees themselves.

The Society for Human Resource Management states in its employee survey Navigating AI in the Workplace: 2026 that organisations must provide comprehensive education and resources for safe, compliant and productive AI use. That is a view from a survey, not an independent legal obligation.

Why is a general AI course not enough as proof of literacy?

Because competent deployment of generative AI requires more than knowing how to write a prompt. A structured review with an exploratory meta-analysis on arXiv distinguishes four domains of competence. A course focused only on prompting would not, by itself, demonstrate competence across the other domains.

The review on measuring competent generative-AI use — still a preprint, and therefore provisional — names these domains:

• Knowledge and use: knowing what a system can do and how to operate it.
• Epistemic control: recognising uncertainty in the output and knowing when an answer cannot be trusted.
• Calibrated trust: relying neither too much nor too little on the system, attuned to the risk of the task.
• Operational control: being able to limit, stop or escalate tool-using AI agents.

A course that tests only prompting skill leaves the last three domains unmeasured. These domains are relevant to assessing whether a professional can recognise uncertainty, calibrate reliance and control AI use before an output is used in a decision, file or advice. Our topic hub on AI governance covers how such requirements land in policy.

What does this mean for directors, lawyers and CISOs who are responsible?

Our analysis: because the Berkeley study reports a correlation between training and more frequent AI use, a training programme can increase the actual exposure to AI risk in the organisation by leading more employees to use AI; therefore a CISO must establish per workflow which systems and which types of data are permitted before the programme drives adoption further. Because, in the surveyed sample, leaders estimated the adequacy of training higher than employees did, the board's picture is not reliable proof; therefore the responsible director must measure effectiveness with the employees themselves and include the outcome periodically in the risk reporting. Because competent deployment also requires recognising uncertainty and limiting AI agents, a prompting course is not enough as evidence of due care; therefore a lawyer must record in internal guidelines when human escalation is mandatory and who bears the final judgement. Because training and productivity do not automatically go together, a programme may not be assessed on usage figures alone; therefore the responsible person must build in an assessment moment in which source and output checking, confidentiality awareness and stop-escalation capability are judged separately.

Our assessment is that, without role-bound limits and testing, an organisation may have less reliable insight into the risks of its AI use and may be unable to demonstrate that employees were equipped for the systems they actually used.

How do I record AI literacy per role and workflow demonstrably?

Record the arrangement in documents that refer to the concrete systems and tasks, not to AI in general. A defensible programme makes the link between training, limits and testing visible.

1. Inventory which AI systems employees actually use per role, including versions of models and policies.
2. Determine per workflow which tasks and which data are permitted and which are not.
3. Name the errors and uncertainties that employees must recognise in that workflow.
4. Record when human escalation is mandatory and who makes the final judgement.
5. Determine per role which training is needed, and alongside knowledge also test source and output checking, privacy and confidentiality awareness, calibrated trust and the ability to stop AI use.
6. Repeat the testing periodically and link the outcomes to the risk reporting.

This approach ties in with broader duties to verify in professional practice, as we described concerning the growing duty to verify of the signing lawyer and concerning audit trail software that can suggest control without proving it. For organisations that deploy AI structurally, this is the difference between ticking off a course and being able to show that employees master their systems.

Sources: The article relies on the research announcement by JANSON Research & Strategy and on published research from UC Berkeley, Springer Nature Management Review Quarterly, Wharton Human-AI Research with GBK Collective, SHRM and an arXiv preprint.