AI literacy needs clear rules and decision rights

Faster AI-assisted work does not establish enterprise readiness

An employee who summarizes a customer complaint in 30 seconds may still be making a decision the organization is unprepared to manage. Consider a hypothetical task that normally takes 15 minutes: the employee submits the complaint to an artificial intelligence (AI) assistant and receives a concise summary almost immediately. Before a manager counts that as a productivity gain, four questions need answers. Is entering customer data into the tool permitted, could the summary be inaccurate, when is human review required, and how should a problem be reported?

These questions make judgment part of doing the job well. The employee must assess whether the input is appropriate and whether the output can be used, while the organization must set permissions, review requirements and reporting routes. Employees need practical knowledge suited to their work to make these decisions. The organization must back that knowledge with clear rules.

The same requirement applies when employees use AI to draft emails, summarize documents, analyze data, build presentations or write code. Training in ChatGPT, Microsoft Copilot and other tools can teach prompts, features and productivity shortcuts, helping managers raise productivity and leaders lower costs, improve customer experience and gain a competitive advantage. Better models and stronger platforms can support those goals too. But their value depends on whether people can make the surrounding decisions responsibly.

AI literacy supplies judgment; governance supplies authority

Making those decisions requires both personal competence and organizational authority. AI literacy means understanding what AI can do, where its limits lie and what responsibility remains with the person using it. Governance establishes who can make decisions, the boundaries within which they act and who remains accountable. Training develops the knowledge people need, while governance establishes how they can apply it.

The difference becomes clear in a second hypothetical example: an organization trains thousands of employees in responsible AI but leaves approval and response procedures undefined. Employees remain uncertain about who may approve AI systems, which uses are prohibited, how to assess risks and who responds when something fails. They may recognize a risk yet lack permission to act or a route to a decision. Training therefore needs organizational arrangements that turn understanding into action.

Authority also requires competence. A manager authorized to approve an AI use needs enough understanding to examine its benefits, risks and assumptions. A specialist reviewing controls, the safeguards intended to manage risks, needs to understand the system those controls govern. Literacy and governance meet different needs, and effective decisions depend on both.

Because these decisions arise throughout ordinary work, a central governance team needs an informed workforce. The team can define boundaries, assign authority and establish escalation routes, including which decisions require central review. Employees still need to recognize when entering data or accepting an output brings those rules into play. Their learning must therefore match their responsibilities.

Users, managers, specialists and leaders need different kinds of judgment

Responsibility provides a practical basis for organizing learning around four groups: users, managers, specialists and leaders. This recommended model defines each group by the decisions it must make. Someone operating an assistant, someone approving its use and someone assessing its risks need different preparation. A shared introductory course can establish common concepts, while role-specific learning develops the judgment each responsibility demands.

For users, that judgment begins before information enters an AI tool. They need to understand its capabilities and limitations well enough to decide whether the task and data are appropriate, including whether they may submit confidential or personal information. In the complaint-summary example, permission to enter customer data comes before assessing the summary’s quality. Training should make that order clear.

Permission to submit information leaves users with a further responsibility: assessing the result. A clear, concise response can still be unreliable, so users need to question outputs and recognize when human judgment or review is required. Learning should help them identify those situations in their own work and decide whether a response is suitable for use.

Managers must decide whether a proposed use should proceed, which requires examining its suitability, expected benefits, risks and supporting assumptions. A time-saving claim gives them a benefit to weigh against the consequences of the proposed work. They also need to recognize when a proposal exceeds what they can reasonably assess themselves and requires additional oversight. Training should prepare them to set approval conditions and seek further review when needed.

Specialists need to examine how risks and safeguards operate throughout the AI-system lifecycle: the sequence in which a system is designed, built, tested, deployed, monitored, changed and eventually retired. Privacy, security, risk, legal, audit and compliance functions bring different responsibilities to that review. Each needs enough understanding of the lifecycle to connect its requirements to the relevant decisions. Otherwise, a documented safeguard may have little connection to the work it is meant to govern.

The lifecycle also explains why specialists must look beyond initial approval, since design choices, testing, deployment conditions and later changes can all affect whether a control works as intended. An earlier argument by the advocate of this role-based approach emphasized that professionals need to understand AI behavior across its lifecycle, alongside prompting skills. This gives people building or changing systems a distinct learning requirement within the four-group model, based on their actual responsibilities. It does not establish builders as a separate fifth category.

Leaders, in turn, set the conditions under which these operational decisions occur. They need to understand accountability, risk appetite and oversight: who answers for decisions, how much risk the organization is willing to accept and how decisions remain subject to review. Their judgment must also address how AI choices affect privacy, security and trust. Executives can develop this understanding through preparation suited to their responsibilities without becoming data scientists.

Informed leadership must then turn those expectations into authority and support. Leaders assign responsibility and decide whether people have what they need to fulfill it, while balancing innovation with protection for those affected. Technical teams may handle implementation, but executives remain responsible for setting the conditions under which uses are approved, operated and reviewed. Those conditions must be clear enough for the other roles to apply.

Decision rights and escalation must extend beyond IT

Making those conditions usable requires policies, defined roles, decision rights, escalation paths and controls. Decision rights specify who may approve or reject an action; escalation paths identify where a question or problem goes when someone cannot resolve it within their role. Training should connect directly to these arrangements. A person who recognizes a risk needs to know what they may do and where to seek a decision.

Consistent arrangements also give separate decisions a shared basis. In 2023, the advocate of this approach recommended AI policies and governance structures to support consistent assessment and review of AI projects. These arrangements establish permitted uses, approval responsibilities, risk-assessment requirements and who is responsible for responding when something fails. Learning can explain the responsibilities once the organization has assigned them.

Assigning responsibilities requires participation beyond IT because AI decisions affect privacy, security, legal duties, employees, customers and strategy. Technical knowledge is essential to many assessments, while other functions have obligations that require their own judgment. Relevant teams therefore need to work together to define requirements and review proposed uses. Sole ownership by IT would separate some decisions from the people accountable for their consequences.

These shared responsibilities also connect AI management with privacy and trust. The same advocate has more recently argued that these concerns need to be managed together because they depend on how organizations handle information and make decisions. For the employee handling a customer complaint, that connection appears in the permissions, review requirements and reporting route already described. Learning and governance need to give the employee the same account of their responsibilities.

Build learning around responsibilities, then test its application

Once responsibilities and authority are clear, the enterprise can design learning around the decisions people face. The recommended process has four steps: map interactions with AI, define the required capabilities, train for each role and test practical application. The order matters because choosing a standard course first can force the organization to adapt its needs to the course’s contents. Starting with the work makes learning needs clearer.

The first step is to identify where each group uses, approves, builds or oversees AI systems. Mapping these interactions reveals the decisions attached to each responsibility and distinguishes people who may use the same technology in different ways. Access to an assistant, for example, says little about whether someone also approves its use or oversees the system. The mapping should establish those responsibilities before specifying what each person must learn.

The second step turns the mapped decisions into required knowledge and skills. For each responsibility, identify what the person must understand, what assumptions they must examine and when they must seek help. This connects the user’s assessment of inputs and outputs, the manager’s approval judgment, the specialist’s review of controls and the leader’s accountability decisions to concrete learning requirements. Those requirements guide the choice of instruction.

The third step builds instruction around the workplace decisions and risks identified in that analysis. An awareness session can introduce common concepts, while governing an AI system, challenging its controls or overseeing a high-risk project requires deeper learning and opportunities to apply it. The depth should match the consequences and complexity of the responsibility. Training then prepares people for the work they are expected to perform.

The fourth step tests that preparation through realistic situations. For the complaint scenario, an assessment could ask the employee to make and explain the four decisions established at the outset. The exercise tests whether the employee recognizes when a rule applies and can act on it. Recalling the rule contributes to that judgment, but applying it requires connecting it to the circumstances.

Structured professional education and certification can support this process by organizing the knowledge people need. Programs aligned with recognized standards for AI management, privacy and security can provide a basis for learning. Their contribution should be assessed through learners’ ability to apply knowledge, ask informed questions and exercise judgment. A certificate records educational achievement, while practical assessment examines readiness to carry out a responsibility.

Practical assessment has a limit: sound judgment in an exercise cannot guarantee sound decisions in every future situation. It can, however, show whether a learner can use the knowledge when a decision is required. That makes realistic assessment a recommended way to examine capability alongside completed instruction.

Key takeaways for leaders

• Assess readiness alongside speed: Managers evaluating AI productivity gains need to check data permissions, output accuracy, human review requirements and reporting routes. These conditions determine whether faster work can be used responsibly.
• Connect literacy with authority: Governance owners need to define who approves AI uses, assesses risks and responds to failures. Role-specific learning gives employees the knowledge to exercise that authority and recognize when to escalate.
• Match learning to responsibilities: Users need judgment about inputs and outputs; managers need approval skills; specialists need lifecycle and control knowledge; leaders need to understand accountability and risk appetite. Assign training according to the decisions each role makes.
• Share governance across functions: IT, privacy, security, legal, risk and business functions need to agree on requirements and review responsibilities. Clear decision rights and escalation paths give employees a usable route from recognizing a concern to resolving it.
• Test judgment in realistic situations: Learning owners need to map AI interactions, define required capabilities and build instruction around workplace decisions. Practical assessments show whether employees can apply their knowledge when those decisions arise.