When organizations talk about AI governance, the conversation quickly turns to platforms, policies and controls. The data points somewhere else. In the 2026 BARC study “The State of Data and AI Governance”, the most frequently named obstacle to governing data and AI is neither regulation nor technology. It is people: 41% of organizations cite a lack of skilled personnel or training.
At the same time, only 12% measure the success of their governance program by employee training completion. Skills are the biggest gap, and almost nobody tracks them. This post looks at what that means, why AI literacy decides whether governance works in practice, what the EU AI Act now requires, and how organizations can close the gap.
What AI literacy means in an organization
AI literacy is the knowledge, skills and understanding people need to use AI systems competently and responsibly. That includes knowing what AI can and cannot do, recognizing its risks, and knowing which rules apply to the data and tools in their own work.
In an organization, AI literacy is not one level that everyone has to reach. A developer who builds controls into an agent needs different skills than a business manager who approves an AI use case or a clerk who summarizes documents with an approved assistant. AI literacy is role-based, and it changes as fast as the tools do.
▼ SECTION 4 – OBSTACLES
Skills are the number one governance obstacle
BARC asked 234 data, AI, IT and business leaders to name the top three obstacles to governing data and AI effectively. The skills gap leads by a wide margin:
| Top obstacles to governing data and AI | Share of organizations |
|---|---|
| Lack of skilled personnel or training | 41% |
| Changing regulations | 25% |
| Inadequate data quality | 24% |
| Siloed data | 24% |
| Budget constraints | 21% |
| Insufficient executive sponsorship | 20% |
| Shadow (unsanctioned) AI use | 17% |
BARC sees these as familiar challenges that business and IT leaders have handled before. What makes them harder now is the pace of AI innovation. The study’s authors put the problem in one question:
“How do you train or hire skilled personnel to use agentic tools that did not exist three months ago?” BARC, The State of Data and AI Governance, 2026
Build a trustworthy data foundation to enable AI-driven automation and reliable decision-making. Download the whitepaper to learn how to establish Data Governance as a strategic capability — and unlock scalable automation and AI.
The measurement gap: 41% vs. 12%
If skills are the biggest obstacle, you would expect organizations to measure them. They don’t. Organizations measure the success of their governance programs mostly by the coverage of AI use cases (37%), the reduction of data quality incidents (33%) and the business value of governed AI projects (31%). Only 12% track employee training completion, and just 10% measure employee adherence to policies.
BARC calls this a mismatch in the area of human capital and draws a clear conclusion: organizations must close this gap by educating employees. The gap also explains why governance automation remains difficult.
“Organizations cannot automate governance effectively if they lack the skills and operating discipline to define what good governance looks like in live AI workflows. You need skilled teams to translate policies into automated controls at scale.” BARC, The State of Data and AI Governance, 2026
Why people decide whether AI governance works
AI literacy is often treated as an HR topic. In practice, it determines whether the rest of the governance program works. Three findings from the study show why.
Controls need people who can build them
Policies only reduce risk when they become controls inside live AI workflows. Someone has to define those controls, build them into models, pipelines and agents, and keep them current. Without that expertise, governance stays on paper. To see how controls work across the architecture, read our guide to building an AI governance framework.
Human oversight is only as good as the human
59% of organizations control AI agents through human-in-the-loop approval for sensitive actions. That control depends entirely on the person approving. Someone who does not understand what an agent is about to do, which data it uses or where its output goes can only click “approve”. Without AI literacy, human oversight becomes a formality.
Shadow AI grows where people lack orientation
22% of organizations already report unauthorized or shadow AI as an AI-related incident. Employees who don’t know which tools are approved, which data must not leave the organization, or what the alternative is will find their own way. Read more in our article Shadow AI: why EMEA reports more unsanctioned AI incidents.
The BARC study “The State of Data and AI Governance” is based on a global survey of data, AI, IT and business leaders. It shows what separates the AI Leaders from the rest of the market, and which steps turn governance from a compliance exercise into an operating model that lets AI scale with confidence.
Who needs which AI skills
The study shows how responsibility for data and AI governance is split today: CxOs set direction, business owners oversee, and engineers execute. Each group needs a different kind of AI literacy.
| Role | Main role in governance today | AI skills they need |
|---|---|---|
| CDO, CAIO, CISO | Oversee (39%, 38% and 29%) | Judging AI risks and value, setting priorities, steering the governance program together |
| AI/ML product owners, business managers | Execute (31%, 28%), oversee (27%, 26%) | Assessing use cases, defining acceptable risk, approving AI-driven decisions |
| Developers, data engineers, ML/AI engineers | Execute (56%, 55%, 53%) | Building controls into agents, pipelines and models from the design stage onward |
| Security analysts, engineers and architects | Execute (45%) | Identity, access, monitoring and protection against AI-specific threats |
| Legal and compliance officers | Advise (49%) | Regulatory requirements such as the EU AI Act and GDPR, applied to concrete AI use |
| All employees using AI | Not covered by the study | Safe everyday use: approved tools, data classes, recognizing wrong outputs, escalation |
BARC recommends that business and product owners take an oversight role and let technical experts handle execution, and that CxOs avoid getting bogged down in detail. Most importantly, closing the skills gap does not start with hiring:
“Governance does not require new titles; rather, it requires existing teams and roles to help, teach, and learn from one another.” BARC, The State of Data and AI Governance, 2026
AI literacy and the EU AI Act
For European organizations, AI literacy is also a legal requirement. Article 4 of the EU AI Act has applied since February 2, 2025. It covers both providers of AI systems and deployers, that is, any organization that uses AI systems in a professional context, including off-the-shelf assistants.
In July 2026, the Digital Omnibus on AI (Regulation (EU) 2026/1744) adjusted the obligation. It entered into force on July 27, 2026. Providers and deployers must still take measures to support AI literacy among their staff and others who operate AI systems on their behalf. What changed is the standard: the original wording required them to ensure, to their best extent, a sufficient level of AI literacy. The obligation now focuses on the measures taken rather than on guaranteeing a certain level of competence for every individual. The European Commission and the member states are to support organizations in implementing it. Deployers of high-risk AI systems remain subject to more specific competence requirements.
For practice, this means: doing nothing is still not an option. Organizations should be able to show which measures they have taken, for whom and why. That is easier when training is planned by role and documented, which brings us to the measurement gap again.
Five steps to close the AI literacy gap
1. Start from roles and use cases
Generic AI training reaches everyone and helps few. Start from the AI use cases in production and the roles involved: who builds, who approves, who uses, who monitors? Define for each role what they need to know to do their part safely. This also gives you the basis for documenting your measures.
2. Teach the governed path, not just the rules
Employees need to know more than what is forbidden. They need to know which tools are approved, which data they may use for which purpose, how to recognize a wrong or biased output and whom to contact when something goes wrong. A clear governed path is the most effective protection against shadow AI.
3. Build skills through a center of excellence
38% of organizations run their governance program as a center of excellence that sets standards centrally while distributed teams execute. Among AI Leaders, the share is 48%. According to BARC, this model encourages grassroots AI projects while training contributors, sharing knowledge and strengthening controls. It turns governance into a place where teams learn from each other, as the study recommends.
4. Train for agents and human oversight
Agents raise the bar. Anyone who approves agent actions needs to understand what the agent is allowed to do, what it is about to do and when to stop it. Today, only 16% of organizations have kill switches for agents. Train approvers on concrete scenarios from your own processes, and combine human oversight with automated controls such as audit logging and action boundaries.
5. Measure training like any other control
BARC recommends translating the main risks into a small set of operating metrics, explicitly including employee training. These metrics are one of the six building blocks of an AI governance framework. Track training completion by role, adherence to policies and the incidents that point to skills gaps, such as shadow AI or wrong outputs reaching customers. If 41% name skills as the biggest obstacle, skills belong in the governance dashboard.
How SoftProject helps
Training is essential, but no one can remember every rule for every data set and every AI tool. The more governance is built into the systems people work with, the less depends on individual memory. That is the idea behind SoftProject’s converged platform:
- Shared understanding of data: data governance with a business-oriented data catalog gives business and IT a common language: what a data set means, who owns it, how good it is and what it may be used for.
- Rules where the work happens: process automation embeds approvals, access rules and escalation paths directly in the workflow, so employees and agents follow the governed path by default.
- Traceability: lineage and audit trails show what happened to data and decisions, which supports both learning from incidents and documenting compliance.
AI literacy also has a limit: even well-trained people get poor results from poor data. Knowing how to use AI responsibly only pays off when the data behind it is reliable, documented and governed, which is why data governance is the foundation for AI.
Literacy and built-in governance work together: people understand why rules exist, and the platform makes the right way the easy way.
Edouard Cante is responsible for the strategic direction and further development of SoftProject’s product portfolio as Chief Product Officer. With a strong understanding of the market and a high level of innovative drive, he advances customer-centric solutions and ensures the company’s long-term competitiveness.
FAQ: AI literacy
What is AI literacy?
AI literacy is the knowledge, skills and understanding people need to use AI systems competently and responsibly. It includes knowing what AI can and cannot do, recognizing its risks and knowing which rules apply to the data and tools in one’s own work. In organizations, the required skills differ by role.
Why is AI literacy a governance issue?
Governance only works when people can translate policies into controls, judge what they approve and use approved AI correctly. In the 2026 BARC study, 41% of organizations name a lack of skilled personnel or training as their top obstacle to governing data and AI, more than any other factor.
Is AI literacy mandatory under the EU AI Act?
Yes. Article 4 of the EU AI Act has applied since February 2, 2025, to providers and deployers of AI systems. Since the Digital Omnibus on AI entered into force on July 27, 2026, they must take measures to support AI literacy among staff and others operating AI on their behalf, without having to guarantee a certain level of competence for every individual.
Who needs AI literacy training?
Everyone who builds, approves, oversees or uses AI, with different content per role. Executives need to judge risks and value, business owners need to assess use cases, engineers and developers need to build controls, legal and compliance need regulatory knowledge, and all employees need to know the approved tools and data rules.
How do you measure AI literacy?
Few organizations do: only 12% measure training completion and 10% employee adherence to policies. Useful metrics include training completion by role, policy adherence and incidents that point to skills gaps, such as shadow AI or incorrect AI outputs reaching customers.
