The CSO has a redesigned org chart and a redesigned workflow, and a workforce that cannot run either. The senior analyst is brilliant with a spreadsheet and has never verified an AI-suggested emission factor against a source. The disclosure lead writes beautifully and does not know how to catch a softened impact in an AI draft. The new AI-Reporting Lead role has been open for four months because nobody applying combines disclosure depth with AI-operating skill. Green hiring grew about 7.7% in 2024-25, nearly double the growth in the supply of green skills, which means the talent is not sitting on the market waiting. You cannot buy your way to an AI-literate function. You have to build one. This lesson is the capability framework, the training ladder, and the hiring-versus-upskilling and retention strategy that builds it.

AI Literacy Here Is Not Prompt Training

The phrase "AI literacy" has been cheapened by a thousand generic courses that teach people to write a clever prompt and stop there. In a regulated, externally-assured disclosure function, prompt skill is the least of it. The literacy that matters is the ability to operate AI inside an assurance regime: to know which AI output is load-bearing and which is decorative, to recognize the failure modes that end careers, to keep every AI-touched number traceable, and to sign your name to a figure knowing an assurer will read it. A person can be a genuine expert prompter and completely unable to defend a single figure to an assurer. That person is not AI-literate for this work.

So the framework is built on a specific definition. AI literacy for a sustainability professional is the capability to use AI to produce disclosure artifacts faster while keeping them assurable: traceable to evidence, correctly labeled as primary or secondary, honest about estimation and uncertainty, and faithful to the underlying impact. It is assurance-first literacy, not automation literacy. It rests on three legs that generic training omits entirely: disclosure knowledge (double materiality, ESRS datapoints, the GHG Protocol, limited versus reasonable assurance), AI-operating skill (grounding, verification, catching hallucinated factors and invented targets), and the judgment to keep the two in their proper places, humans on judgment, AI on throughput.

This definition matters because it changes who you consider a strong candidate and what you consider a successful training outcome. Under the generic definition, the person who produces the most polished output fastest looks like the star. Under the assurance-first definition, that same person is a liability if the polish hides an unsourced factor or a softened impact, and the quieter analyst who produces slightly slower but fully traceable work is the one you want. The definition also reframes what AI is for. It is not there to let the function do the same work with fewer people; it is there to let the same people do more of the defensible work, moving human effort off the mechanical steps and onto the judgment and verification that only humans can own. A workforce that internalizes this stops treating AI as a threat to headcount and starts treating it as leverage on the part of the job that was always the point.

An expert prompter who cannot defend a figure to an assurer is not AI-literate for disclosure work. Literacy here is measured at the assurance file, not at the prompt.

The Capability Framework by Role and Level

A workforce program needs a shared map of what "good" looks like at each role and each seniority. The framework crosses two axes: the level (analyst, lead, head, CSO) and the capability domain. It answers, for any person, "what must you be able to do, and to what standard." Without it, training is a scattershot of courses; with it, training is a ladder each person can see themselves climbing.

The capability domains are consistent across roles; the depth expected rises with seniority. The domains are: disclosure fluency (the frameworks and the assurance regime), AI-operating skill (grounding, prompting under constraint, structured output), verification and skepticism (catching the hallucinated factor, the mislabeled estimate, the softened impact), provenance and evidence discipline (labeling, traceability, basis-of-preparation), and judgment and accountability (knowing what must stay human and owning the sign-off).

Why Literacy Rises, Not Narrows, With Seniority

A common mistake is to treat AI literacy as a junior skill, something the analysts need and the CSO can delegate. The opposite is true. The higher the role, the more the AI literacy required is about judgment and accountability rather than hands-on operation. A CSO who cannot tell an assurable AI workflow from a glossy one will approve the wrong vendor, set the wrong policy, and sign a figure they cannot defend. Every level needs literacy; what changes is its character, from operating the tool at the analyst level to governing its use at the top.

The Training Ladder

The framework says what "good" is; the ladder is how people get there. It runs in four rungs, each producing a demonstrable capability rather than a certificate of attendance, because in an assurance-first function the only training that counts is training that changes what someone can defend.

Rung one, read an AI output skeptically. The foundation. Everyone, analyst to CSO, must be able to look at an AI-produced number or narrative and ask the right questions: where is the source, is this primary or estimated, does this factor exist in a named database, did the model invent a target or soften an impact. This is the literacy that stops a bad output at the door, and it is universal.

Rung two, operate AI on a labeled throughput stage. For those who run the workflow. Extract activity data with source location preserved, look up a factor and trace it, draft a narrative grounded on the evidence file, parse supplier responses into tagged data. The demonstrable outcome is a piece of AI-assisted work with clean provenance attached.

Rung three, own a judgment stage and its sign-off. For leads and accountants. Make and document a boundary decision, judge an estimate as honest or laundered, edit a narrative for faithfulness, sign a figure against evidence. The demonstrable outcome is a defended artifact: a decision an assurer can reconstruct and a sign-off that records what was checked.

Rung four, govern AI use across the function. For the Head of Sustainability Data, the AI-Reporting Lead, and the CSO. Design the workflow, govern the factor library, set the policy, manage the assurer relationship. The demonstrable outcome is a running, assurable operating model, not a personal skill.

Two properties make this a ladder rather than a menu. First, the rungs are cumulative: you cannot own a judgment stage well if you cannot read AI output skeptically, and you cannot govern the function's AI use if you have never operated it and defended an artifact. This is why a governance role staffed by someone who skipped the lower rungs is so dangerous, they set policy for work they have never done and cannot evaluate. Second, each rung is assessed by a produced artifact, not a passed quiz. Rung one is evidenced by a marked-up AI output showing the questions the person asked and the problems they caught. Rung two by a piece of AI-assisted work with clean provenance. Rung three by a defended sign-off an assurer could reconstruct. Rung four by an operating model that runs. In an assurance-first function this is the only honest way to certify capability, because the assurer will not accept your training records as evidence that a number is right, only the reconstructable artifact itself.

The ladder also gives the function a language for career progression that maps directly onto the org chart from the role design. An analyst climbing from rung two to rung three is visibly becoming a lead. A lead reaching rung four is on the path to Head of Sustainability Data or AI-Reporting Lead. This alignment is not cosmetic. It means every rung of capability the function invests in is simultaneously a retention investment and a succession plan, so the training budget and the workforce-risk budget are spent once, on the same thing.

Hiring vs. Upskilling, and Retaining Scarce Talent

Given a market where demand for green skills outpaces supply, the default assumption that you will hire the AI-literate function you need is usually wrong. The thin intersection roles, above all the AI-Reporting Lead, rarely exist ready-made, and when they do they are expensive and quickly poached. The realistic strategy is a deliberate mix, and knowing which lever to pull for which role is the core of the workforce plan.

Upskill for the disclosure-deep roles

Where the scarce, hard-to-teach ingredient is disclosure knowledge, upskill. Your carbon accountant already knows the GHG Protocol and the 15 Scope 3 categories; teaching them AI-operating skill is faster than teaching a data scientist the assurance regime from scratch. The same holds for the disclosure lead and the value-chain data lead. The AI-Reporting Lead is best grown this way too: take a reporting professional with genuine disclosure depth and build their AI-operating capability, rather than hiring a technologist and hoping they absorb double materiality. Disclosure depth is the ingredient the market is short of and the one that takes longest to build.

Hire for the data-platform spine

Where the scarce ingredient is genuine data-platform engineering, hire, then teach the domain. The Head of Sustainability Data may need to come from a data or analytics-engineering background, because architecting a lineage-preserving pipeline and a retrieval layer is a deep skill that is faster to hire than to grow. But hire deliberately for someone willing and able to learn the GHG Protocol, because a data engineer who never grasps why a spend-based factor is secondary data will build a fast pipeline that produces unassurable numbers.

Retention is a control, not a perk

Retaining scarce green-skill talent is not an HR nicety in this function; it is a disclosure control. When a number's basis lives partly in a person's head, that person leaving is an assurance risk, exactly the reconstructability finding an assurer raises. Retention therefore does double duty. The strongest retention lever is the one the whole program supplies: framing AI as a promotion of the work, not a threat to the person. The carbon accountant who feared being automated becomes the one who owns and defends the methodology; the analyst becomes the AI-Reporting Lead. Pair that with a visible ladder people can climb, real ownership of a stage and its sign-off, and the recognition that these are among the fastest-growing, best-paid green roles, and you keep the people whose knowledge is itself part of your control environment. The redesigned workflow reinforces this: when provenance is built into the data rather than into an analyst's memory, the function is less hostage to any one departure, which is both an assurance control and, paradoxically, what makes it safe to invest in developing people rather than hoarding them.

Worked Example: Building One Person's Capability Ladder

Take a real person: a mid-level ESG analyst, three years in, strong on spreadsheets, anxious that AI will hollow out her role. Here is how the framework and ladder turn her into an AI-literate professional the function depends on, and how that plan retains her.

Baseline. She meets rung one partially: she is naturally skeptical but has no structured way to interrogate an AI output. She has never traced a factor to a named database, and she has never owned a judgment stage. On the capability framework she is strong on disclosure fluency for her level, weak on AI-operating skill, and untested on provenance discipline and accountable sign-off.

Quarter one, rungs one and two. She learns to read AI output against the skeptic's checklist, then to run the AI-assisted extraction and factor-lookup stages with source location and named-source provenance attached to every datapoint. Demonstrable outcome: a partial Scope 3 section produced with AI, every figure traceable, primary and secondary correctly tagged. She stops fearing the tool because she now controls it.

Quarter two, rung three. She takes ownership of a judgment stage: labeling estimates with method and uncertainty, and signing that a set of figures is ready against the evidence. Demonstrable outcome: a defended artifact the assurer reconstructs without her in the room. Her role has visibly moved up, from data wrangling to accountable judgment.

Quarter three and beyond, toward rung four. Because she now combines her existing disclosure fluency with real AI-operating skill and evidence discipline, she is the internal candidate for the AI-Reporting Lead the function struggled to hire externally for four months. She is upskilled into designing the workflow and verification protocol. The function fills its hardest role from within, and the analyst who feared being automated is now the person operating the AI for the whole team. That is the workforce program working: hiring avoided, a scarce role filled, a valued professional retained, and the assurance posture strengthened, all from one deliberate capability ladder.

Key Takeaways

• AI literacy for disclosure is not prompt training: it is the capability to produce artifacts faster while keeping them assurable, traceable, correctly labeled, honest about uncertainty, and faithful to the impact, measured at the assurance file, not at the prompt.
• The literacy rests on three legs generic courses omit: disclosure fluency, AI-operating skill, and the judgment to keep humans on judgment and AI on throughput.
• A capability framework maps what "good" looks like by role and level across five domains: disclosure fluency, AI-operating skill, verification and skepticism, provenance and evidence discipline, and judgment and accountability.
• Literacy rises rather than narrows with seniority: at the top it is about governing AI use, and a CSO who cannot tell an assurable workflow from a glossy one will set the wrong policy and sign figures they cannot defend.
• The training ladder has four rungs, each producing a demonstrable capability: read AI output skeptically, operate a throughput stage, own a judgment stage and its sign-off, and govern AI use across the function.
• Upskill for the disclosure-deep roles because disclosure knowledge is the scarce, slow-to-build ingredient; hire for the data-platform spine but only someone willing to learn why a spend-based factor is secondary data.
• Grow the AI-Reporting Lead from a reporting professional with real disclosure depth rather than hiring a technologist and hoping they absorb double materiality, because that intersection almost never exists ready-made.
• Retention is a disclosure control, not a perk: when a number's basis lives in a person's head, their departure is an assurance risk, so framing AI as a promotion, offering a visible ladder, and building provenance into the data rather than into memory keep both the talent and the assurance posture.