Most corporate AI training teaches staff which buttons to press and how to write a better prompt. That is useful, but it doesn't answer the question a board, a regulator or a customer will eventually ask: who decided, and on what basis? In our earlier piece on AI governance we argued that firms need AI judgement as well as AI access. This article sets out how to build it through your people.
Regulators now expect competence, not just tool access
Bank Negara Malaysia published its discussion paper on Artificial Intelligence in the Financial Sector in August 2025. It set out the central bank's proposed regulatory and developmental approach and invited feedback until 17 October 2025. In its submission, CPA Australia urged clear human oversight and better supervisory training. We expect the final direction to put more weight on governance and accountability, though firms should read the paper itself for the detail.
Singapore is moving the same way. The Monetary Authority of Singapore issued its final Guidelines on Artificial Intelligence Risk Management on 7 October 2026, following a consultation launched on 13 November 2025. They cover oversight, lifecycle controls, and the capabilities and capacity firms need to use AI. Across ASEAN, the direction is that firms must show they have people able to oversee AI, not only that they own it.
The EU benchmark: literacy that fits the role
Article 4 of the EU AI Act has applied since 2 February 2025. As amended by Regulation (EU) 2026/1744 in July 2026, it requires providers and deployers to take measures to support the development of AI literacy among their staff and representatives, without requiring them to guarantee a specific level of literacy. The Commission's guidance does not mandate exams or certificates. Commentators note that firms must assess needs and build literacy by role, not rely on one generic course. Any ASEAN firm with EU customers or operations should check how this applies to it.
The principle is useful well beyond the EU. A credit analyst, a recruiter and a customer-service lead face different AI risks, so they need different training.
Why "a human in the loop" is not enough
Many firms treat human review as the safeguard. The research is less comforting. Ben Green's 2022 paper in Computer Law & Security Review reviews evidence that people, including experts, defer to automated systems and scrutinise less. It concludes that giving people discretion has not reliably improved outcomes. A 2026 paper in AI and Ethics on designing meaningful oversight makes a related point. Oversight failures often come from predictable effects such as automation bias, complacency and over-trust, not from a lack of information. It also notes that reviewers sometimes override accurate recommendations, which lowers decision quality in the other direction.
The EU AI Act itself recognises the problem. Its human oversight provisions expect overseers to stay aware of automation bias. Legal scholars have questioned whether that awareness can be achieved by instruction alone. A 2023 study in Frontiers in Psychology tested practical ways to reduce automation bias in AI-assisted recruitment screening. Reducing it is a design and training task, not an assumption.
Four components of a decision-quality programme
1. Scenario drills. Build short, realistic cases from your own workflows. Examples are a loan decline the model recommends, a flagged transaction, a shortlist of candidates, or a drafted customer reply. Ask the team to decide, justify and record. Run them quarterly, not once.
2. Error-spotting exercises. Seed AI outputs with known faults: a fabricated citation, a biased pattern, a stale figure, a confident but wrong summary. Track how often staff catch them. That catch rate is your most honest measure of oversight quality, and it will probably be lower than leaders expect.
3. Escalation rules. Write down when a person must stop and escalate: low confidence, unusual cases, customer harm, regulatory exposure, or any disagreement between the AI and the reviewer. Make escalation normal and not penalised.
4. Named human accountability. Every AI-assisted decision needs an owner who can explain it. Record whether the person accepted, changed or rejected the AI's output. Frequent unexamined acceptance is a warning sign.
Who owns what
Programmes fail when they sit only in IT or HR. We suggest a simple split:
- CEO and board: set the risk appetite for AI-assisted decisions and review a short quarterly report on catch rates, escalations and overrides.
- HR: build the role-based curriculum, tie it to competency and promotion, and keep training records.
- Risk and compliance: define the escalation rules, test them, and map the programme to regulatory expectations.
- Line managers: run the drills and hold the named accountability.
For regulated financial institutions, this maps naturally onto existing three-lines-of-defence structures, so it does not need a new bureaucracy.
Starting in 90 days
In the first month, inventory where AI already informs decisions, including unofficial tool use. In the second, pick the three highest-impact decisions and write drills and escalation rules for them. In the third, run the first round, record the error catch rate, and report it to the executive team. Then expand by role. Keep the first version small, because a modest programme that runs every quarter beats a large one that stalls.
The test that matters
The test is simple: can a named person explain, in plain language, why an AI-assisted decision was right and what they would have done if the AI had been wrong? If they can, your training works. If they cannot, more prompt courses will not fix it.