The debate about responsible AI adoption is often framed as a question of skills.
Do employees understand how to use AI?
Have they received appropriate training?
Should people using AI at work hold recognised certifications?
How should organisations respond when employees use tools that have not been formally approved?
These are important questions. But I think they increasingly miss a deeper issue.
What happens when AI stops being a discrete tool and becomes part of the infrastructure through which ordinary work is performed?
That is the question behind my new policy paper, Reframing AI Governance & Education: Beyond User Certification: Governing AI as Embedded Infrastructure.
The paper responds to the [BCS AI Skills and Adoption Report 2026], which makes an important contribution to the discussion. Its research documents a significant gap between the pace of AI adoption and the ability of organisations to govern it effectively. British Computer Society (BCS) reports widespread use of AI tools, including tools that have not been formally approved by employers, alongside concerns around accuracy, trust, security, data protection and skills.
I agree with much of that diagnosis.
Where I diverge is on where the centre of gravity for governance should sit.
The AI “user” is becoming an increasingly unstable category
It made sense to think about AI as a distinct application when using AI meant deliberately opening a system such as ChatGPT, Claude, Gemini or another standalone generative AI service.
That model is changing rapidly.
AI capabilities are now being incorporated into operating systems, search, office software, development environments, communication platforms and enterprise applications.
An employee may not consciously decide to “use AI”. They may simply use the software their organisation has already provided.
That creates a difficult governance question.
If an AI capability is embedded inside an approved piece of software, where exactly does ordinary software use end and “AI use” begin?
And if organisations cannot reliably identify that boundary, can governance realistically depend primarily on identifying, training and certifying individual AI users?
This doesn’t mean people don’t need AI skills
They do.
In fact, one of the areas where my paper agrees strongly with BCS is the need to move beyond superficial tool training.
Knowing which button to press in today’s AI assistant is not a durable skill.
The interface will change. The model will change. The vendor will change. The capabilities will change.
What is much more durable is the ability to:
- question an AI-generated claim;
- verify information against reliable sources;
- recognise uncertainty;
- identify flawed reasoning;
- understand data and privacy risks;
- decide when automation is appropriate;
- recognise when human judgement must take over.
That distinction is central to my argument.
AI literacy should increasingly mean the ability to supervise and interrogate automated systems, not simply operate particular AI products.
The problem with treating “shadow AI” as purely a user problem
BCS’s research identifies widespread use of AI tools that organisations have not formally approved.
That deserves attention.
But I don’t think the answer is simply to treat every instance as rogue employee behaviour.
Sometimes an employee introduces an external AI service and creates a genuine security or data-protection problem.
But sometimes employees adopt tools because organisational procurement and governance have failed to provide a useful alternative.
And increasingly, AI functionality can arrive through software that has already been approved.
These are different problems.
A mature governance system therefore needs to discover, classify, assess, approve, monitor and restrict AI according to risk, rather than simply drawing a binary line between “approved AI” and “shadow AI”.
Who actually controls the risk?
This is the question I think deserves much more attention.
An employee can be trained to identify hallucinations.
They cannot personally control:
- how a vendor retains prompts;
- what data an integrated model can access;
- whether a software update introduces a new AI capability;
- how an API handles organisational information;
- whether an AI system provides adequate auditability;
- whether a vendor changes a model’s behaviour;
- whether an organisation’s procurement process properly assessed those risks.
Those are architectural, organisational and vendor-level questions.
So my proposal is for a layered governance model:
Vendors should provide meaningful controls, documentation, transparency and auditability.
Architects and technology leaders should govern data flows, permissions, integrations and AI capabilities across the software estate.
Procurement teams should assess AI-enabled products as part of normal technology governance.
Boards and executives should own organisational AI strategy and risk.
Professional standards should apply proportionately to high-impact technical and professional roles.
And users should receive the training and judgement capabilities appropriate to the risks of their work.
The point isn’t to remove responsibility from users.
It is to put responsibility where the ability to control the underlying risk actually exists.
Education needs to change too
There is a related question that extends well beyond the workplace.
If today’s AI tools are likely to be obsolete or substantially transformed within a few years, should schools spend their limited curriculum time teaching students how to operate particular products?
I think the more durable investment is in the capabilities that allow people to work intelligently with whatever automated systems emerge.
My paper proposes five:
1. Epistemic judgement and output scrutiny
Can a student distinguish fluent output from reliable knowledge?
2. Critical reasoning and formal logic
Can they identify flawed premises, causal errors and unsupported conclusions?
3. Independent inquiry
Can they formulate questions, investigate evidence and pursue an argument without outsourcing the intellectual work?
4. Creativity and conceptual synthesis
Can they formulate original problems and combine ideas in ways that machines do not simply determine for them?
5. Cross-disciplinary AI fluency
Can these habits be applied in history, science, mathematics, English and computing rather than being confined to an isolated “AI” lesson?
This isn’t an argument against AI literacy.
It is an argument for a deeper form of AI literacy.
The bigger shift
The central proposition of the paper is therefore quite simple:
As AI becomes embedded in the infrastructure of computing, responsible AI adoption cannot be governed primarily through credentials attached to individual users.
People need competence.
But competent people operating inside poorly governed architectures are still exposed to systemic risk.
The answer is not to choose between skills and infrastructure.
It is to connect them:
competent people + accountable organisations + governable architectures + responsible vendors.
That, I believe, is a more sustainable foundation for AI governance than treating AI as another standalone software category.
I have written the full argument, including a proposed governance framework and recommendations for government, enterprise leaders and education policymakers, in the accompanying paper:
The paper is intended as a contribution to the debate, not as an argument that the skills agenda is wrong, but as a challenge to broaden the governance lens before the distinction between “using software” and “using AI” disappears altogether.
Disclaimer: The following AI tools – Google’s NoteBookLM and ChatGPT – were used to help better articulate, into a policy paper, my thoughts. All conclusions and recommendations were determined by me.
First dropped: | Last modified: September 26, 2026