Directors need to understand what they are delegating to AI agents, how far it reaches, how it is proven, when it expires and who answers for it. That is the AI literacy boards need: depth, certification, the record and accountability. They do not need model internals or prompting skills. A few hours of tested learning covers the core.
What do directors not need to know?
It helps to clear the ground first. Directors do not need to understand how a model is trained, which provider supplies it or how to write prompts. Prompt literacy is a useful skill for people who build and use agents; for a board it is a distraction. Time spent on how the technology works is time not spent on what the business has authorised it to do.
The argument is made at length in boards should govern agent authority, not agent technology. The short version: a board governs delegation, and an agent is a delegate.
What must every director understand?
| Concept | What a literate director can say |
|---|---|
| Depth | "This agent reads at depth 1, drafts at depth 2, and may pay suppliers at depth 4 within our limits." |
| Earned, not configured | "Our plan allows depth 4, but the agent holds depth 3 because that is what its certification supports." |
| Expiry | "Its certificate lapses in 90 days unless it passes again, and a run that clears no depth drops it to depth 1 the same day." |
| The minimum chain | "Every action meets five bounds: role scope, certificate, sources, our own limits and platform guardrails. The lowest decides." |
| Verdicts | "Actions are allowed, held for a named person, refused, or withheld at the platform floor." |
| Provenance | "A sealed fact from our ledger outranks a customer's declared claim, and an external email cannot authorise a payment." |
| The record | "Every verdict is filed append-only, so we can reconstruct any decision and name who approved it." |
A director who can say each line in their own words, about their own business, is literate enough to govern.
Why does risk literacy matter more than technical literacy?
Boards already judge risk: credit, conduct, operational, reputational. Agents create familiar risks in unfamiliar places. A held payment released by an untrained manager is an operational risk. A drafted decline with wrong reasons is a conduct risk. Risk literacy is the ability to see those connections and ask about likelihood, impact and control. It is the skill that turns the concepts above into useful challenge.
What questions show a board is literate?
Literacy shows in the questions directors ask, not the slides they sat through. A literate board asks:
- Which capabilities run at depth 3 or above, and what evidence supports each?
- Where is our risk appetite enforced at the moment of action, and where is it only written down?
- What happened the last time an agent failed certification?
- Who released held actions last quarter, and did each hold a current credential?
- Can we see one decision reconstructed from the record, end to end?
How should board literacy be recorded?
Write the expectation into an AI literacy policy: who must be trained, to what level, and how often. Then record each director's training and test result in an AI literacy training record, with the date and the product version it covered. Results by concept, not just pass or fail, show what the next briefing should cover.
This matters beyond good practice. Article 4 of the EU AI Act expects deployers to ensure sufficient AI literacy among people dealing with AI systems on their behalf, and a supervisor may well ask how the board equipped itself to oversee agents. Programmes such as Pryme Intelligence Academy's Foundations track, about four hours with a free badge stamped with the product version, give a recordable baseline. The wider approach is in AI literacy and certification for people who work with agents.
Questions people ask
Should board literacy be tested or just delivered?
Tested. A short test scored by concept shows who understands depth and expiry and who does not, and gives the company secretary a record.
How often should directors refresh their AI literacy?
When the business adds agents at a new depth, when the product changes materially, and at least as part of the annual board evaluation.
Should one director specialise in AI?
One director can lead, but every director votes on delegation. Core literacy belongs to the whole board, not one member.