It is a Wednesday budget review, and the head of learning is watching the general counsel present a slide to the executive committee. The slide has one line that changes the room: "Under the EU AI Act, we must be able to demonstrate our workforce has a sufficient level of AI literacy, and national authorities begin enforcement 2 Aug 2026." The CEO turns to the room and asks who owns that. The head of IT points at security. Security points at HR. HR points at legal. Legal points at whoever runs training. And in that moment the head of learning realizes two things at once: the org-wide AI-literacy obligation has just landed on the learning function whether it wanted it or not, and the function is the only one in the room actually built to deliver it. This is the moment L&D stops being a passenger in the organization's AI transformation and becomes its engine, or misses the moment and spends the next decade explaining why the training did not work.

The Obligation That Lands on L&D

The forcing function behind this lesson is a specific legal duty, and an enterprise learning leader has to state it accurately, including the part that is in flux. The EU AI Act introduced an AI-literacy duty in Article 4, which has been in application since 2 February 2025, with enforcement by national market-surveillance authorities beginning 2 Aug 2026. As the text stands in force, it binds deployers, which is to say ordinary employers using AI, to ensure that staff and others operating AI on their behalf have a sufficient level of AI literacy, scaled to their role and context. Why you care: for most organizations, there is no certificate to buy and no vendor to outsource this to. The organization itself has to design and deliver AI literacy to its own workforce, and designing and delivering capability to a workforce is the definition of what L&D does.

Now the honest complication, because teaching stale text is a way to lose credibility. The Digital Omnibus, a Commission proposal from 19 November 2025 that the European Parliament endorsed on 16 June 2026 but which is not yet published in the Official Journal, would soften the direct employer duty into a Commission and Member-State obligation to promote and encourage literacy, while keeping intact the separate duty to train staff for human oversight of high-risk AI systems. So the enterprise leader teaches the live state, names the amendment in flight, and teaches the through-line that survives either outcome: whether the wording says "ensure" or "promote," a workforce still has to be made AI-literate, and a high-risk-oversight training obligation is not going away. The demand is real under any version. The learning function that waits for the wording to settle has already lost the year.

Whether the law says "ensure" or "encourage," someone has to actually make the workforce AI-literate, and that someone builds capability for a living. That is L&D.

Passenger or Engine

When the AI-literacy obligation lands, a learning function reveals which of two things it is. A passenger function treats literacy as a compliance box: it buys a generic "AI awareness" e-learning, assigns it to everyone, records completions, and calls the duty discharged. An engine function treats literacy as the capability that determines whether the organization's entire AI investment pays off, and builds it the way it builds any serious capability, with analysis, role-scaled objectives, evidence of behavior change, and governance. The difference is not effort. It is whether the function understands what "AI literacy" actually is.

The passenger's fatal error is treating AI literacy as a single, uniform thing you can deliver in one forty-minute module to everyone. Real AI literacy is role-scaled: the literacy a warehouse associate needs to use an AI scheduling tool responsibly is not the literacy a recruiter needs to avoid a discriminatory AI screen, which is not the literacy a manager needs to exercise human oversight of a high-risk system, which is not the literacy an executive needs to sponsor AI governance. A single generic module satisfies none of them well and satisfies the legal standard of "sufficient, scaled to role and context" for nobody. The engine function does a literacy needs analysis, defines role-scaled objectives, and builds differentiated paths, which is exactly the instructional-design discipline the function already owns.

The engine function also understands that "sufficient AI literacy" is not the same as "knows how to prompt a chatbot." A workforce that can prompt fluently and cannot recognize a hallucination, question an AI recommendation, or know when a decision needs a human is not AI-literate; it is AI-dependent, which is worse than illiterate because it is confidently wrong. Literacy is the capacity to use AI and to know its limits and to keep human judgment where it belongs. That framing, familiar from the iron rule that runs through this entire program, is precisely what a learning function is positioned to teach and a generic vendor module is not.

What Role-Scaled Literacy Actually Looks Like

Because "AI literacy" collapses into mush unless it is specified by role, the enterprise leader needs a concrete map of what sufficient literacy means for different populations. The table below is that map, and it is also the artifact that turns a vague legal duty into a set of measurable learning objectives an auditor can see satisfied.

Read the middle column and notice that none of these are "how to write a good prompt." Every one is about judgment, limits, and the human's place in the loop, which is the part a tool vendor cannot teach because the tool vendor is selling the tool. The right-hand column is why the organization should care beyond compliance: each failure the literacy prevents is a real, expensive, name-attached incident, and preventing incidents is a far stronger business case than checking a box. The learning function that presents this map to the executive committee has just reframed AI literacy from a cost to a risk control, which is the framing that gets it funded.

Aligning to the AI Management System: ISO/IEC 42001

The literacy work does not float free; it plugs into the organization's AI management system, and the relevant standard is ISO/IEC 42001, the AI management system standard published in December 2023. An AI management system is the organization's structured way of governing how it develops, deploys, and oversees AI: its policies, roles, risk assessments, controls, and the competence of the people involved. Why you care: ISO/IEC 42001 explicitly expects an organization to ensure the competence of persons doing work that affects its AI performance, which means the standard has a built-in slot labeled "the workforce must be competent," and that slot is a learning obligation. The AI-literacy work L&D owns is not adjacent to the AI management system; it is one of its required components.

This alignment is a strategic gift to the learning function, and the enterprise leader should treat it as one. It means the literacy program is not a standalone L&D initiative that has to justify itself alone; it is the workforce-competence pillar of a governance system the whole organization is building for its own credibility, its customers, and its regulators. When L&D frames its literacy program as "our contribution to ISO/IEC 42001 conformance and our Article 4 evidence," it stops being a training request competing for budget and becomes an indispensable part of the organization's risk and governance posture. The same work, framed as governance rather than training, changes who fights for it in the budget review.

The Competence Loop

ISO/IEC 42001 thinks in terms of a loop, and the learning function should mirror it: determine the competence needed, provide it, evaluate its effectiveness, and keep records. That is not a foreign discipline. It is the ADDIE and Kirkpatrick cycle the function already practices, aimed at AI literacy. Determine competence is the literacy needs analysis by role. Provide it is the differentiated learning paths. Evaluate effectiveness is measuring to behavior, not completion, because a records-only "everyone finished the module" is exactly the passenger's evidence that satisfies no serious auditor. Keep records is the tamper-evident evidence trail. An organization that can show a role-scaled literacy program, delivered, measured to behavior change, and recorded, has both its Article 4 evidence and its ISO/IEC 42001 competence evidence in one artifact, built by the one function equipped to build it.

Completion is not competence, and an auditor who accepts "everyone finished the module" as proof of AI literacy has not read the standard. The learning function's advantage is that it already knows the difference.

A Worked Example: Before and After

Return to the budget review and the slide about the literacy duty, and watch the same organization respond two ways.

Before (L&D as passenger). The head of learning, handed the obligation, procures a generic forty-minute "AI Awareness" course, assigns it to all 12,000 employees, and reports 94% completion to the executive committee as evidence the duty is discharged. Eight months later a manager in the hiring function rubber-stamps an AI screening tool's ranked shortlist without questioning how it scored candidates, a rejected applicant challenges the process, and the organization discovers it cannot show that the manager received any literacy specific to overseeing a decision about people. The generic module covered "AI is a powerful tool, use it responsibly" and nothing about bias, oversight, or contestable inference. The completion record proves the manager finished a module. It proves nothing about whether the manager was competent to do the job the law and the standard both required. The box was checked. The obligation was not met.

After (L&D as engine). The same head of learning treats the obligation as a capability build. A literacy needs analysis maps the workforce into role bands, from general users to people-decision roles to high-risk-oversight managers to builders to executive sponsors. Each band gets role-scaled objectives and a differentiated path: the hiring manager's path teaches recognizing bias in AI outputs, keeping the decision human, and handling a contested inference, and assesses it with a scenario, not a completion tick. Behavior is measured, so the function can show that hiring managers actually changed how they use the screening tool, not just that they watched a video. The evidence trail is tamper-evident and mapped to both the Article 4 duty and the ISO/IEC 42001 competence requirement. When the rejected applicant challenges the process, the organization shows the specific literacy the manager received, the behavior evidence, and the human-decision record. Same duty, same workforce, same deadline. One response checked a box; the other built the capability the box was supposed to represent, and can prove it.

The lesson is not that generic AI-awareness training is worthless in every setting. It is that "sufficient AI literacy, scaled to role and context" is a capability claim, and a capability claim is met by building and measuring capability, which is precisely the discipline the learning function exists to practice. The organization that treats its most learning-shaped obligation as a procurement task has handed its single biggest opportunity of the decade to a generic module, and kept the liability.

The Strategic Move: Own It Before It Is Assigned

The final move is one of timing and positioning, and it is the difference between the function that leads the transformation and the one that is handed the blame for it. When the CEO asks "who owns AI literacy" and every other function points sideways, the learning leader who says "we do, and here is the plan, the role map, and how it satisfies both Article 4 and ISO/IEC 42001" has done something no reorganization can undo: made the learning function indispensable to the organization's AI governance. The literacy obligation is going to be owned by someone. The only question is whether L&D claims it as its defining contribution or has it assigned to it later as a burden with someone else's design.

This is why the strategy tier of this program is organized around owning literacy rather than around tool features. Tools change every quarter. The organization's need to make its workforce genuinely capable of using AI well, safely, and lawfully does not change, and it will grow. The learning function that positions itself as the engine of the organization's AI-readiness, with a role-scaled literacy program aligned to the AI management system and evidenced to behavior, is not adapting to the AI disruption. It is leading it, and it has made itself the function the organization cannot govern AI without.

Key Takeaways

• The EU AI Act's Article 4 literacy duty, in application since 2 February 2025 with enforcement from 2 Aug 2026, requires an organization to ensure its workforce has sufficient AI literacy scaled to role and context, and there is no certificate to buy the way out; the organization must design and deliver literacy, which is what L&D does.
• Teach the live state honestly: the Digital Omnibus (Commission proposal 19 November 2025, Parliament endorsement 16 June 2026, not yet in the Official Journal) may soften the direct employer duty to promote-and-encourage, while the duty to train staff for human oversight of high-risk systems stays; the workforce-literacy demand survives either outcome.
• When the obligation lands, a learning function reveals whether it is a passenger (buy a generic module, record completions, call it done) or an engine (analyze, define role-scaled objectives, build differentiated paths, measure behavior, govern the evidence).
• Real AI literacy is role-scaled: general users, people-decision roles, high-risk-oversight managers, builders, and executive sponsors each need a different sufficient literacy, and one generic module satisfies the legal standard for nobody.
• Sufficient literacy is not fluent prompting; it is the capacity to use AI, recognize its limits, question its outputs, and keep human judgment where it belongs, which is exactly what the program's iron rule teaches and a tool vendor cannot.
• ISO/IEC 42001 (published December 2023) has a built-in competence requirement, so the literacy program is not adjacent to the AI management system; it is the workforce-competence pillar of it, and framing it that way changes who fights for it in the budget.
• The ISO/IEC 42001 competence loop (determine, provide, evaluate, record) mirrors ADDIE and Kirkpatrick, so completion is not competence, and behavior-level evidence is what satisfies both the Article 4 duty and the standard in one artifact.
• The strategic move is to own literacy before it is assigned: when the CEO asks who owns it, the learning function that answers with a plan, a role map, and the governance alignment makes itself indispensable and leads the AI transformation rather than being blamed for it.