On 30 April, APRA wrote to every regulated bank, insurer and super fund in Australia, telling boards that AI literacy is now a minimum expectation. Not a development goal. A regulatory requirement.
If you sit on a board in a regulated industry, the language is unambiguous. Boards must "maintain sufficient understanding and literacy with respect to AI in order to set strategic direction and provide effective challenge and oversight."
If you don't sit in a regulated industry, the signal will travel. Boards everywhere are about to be asked the same question.
What APRA has not done is define what literacy actually looks like in practice. That interpretive work falls to directors themselves.
Many will read "literacy" and consider whether they need to do another course or briefing. Those have their place. But they will not produce what APRA is really describing.
Real literacy is more than knowing about AI. It is the ability to provide effective challenge and oversight.
It is the judgement that comes from having actually done the work.
It is the risk awareness that comes from navigating real risk in your own practice, not in someone else's case study.
It is the deliberate, documented position you have built — by testing where AI adds value, where it doesn't, and where you have decided the lines need to sit.
This is a different kind of literacy. It is lived, not learned. And it is the kind a director can actually stand behind — in a board paper, a vendor pitch, or a regulator conversation.
The directors who navigate the next two years well will not be the ones with the most polished AI policy.
They will be the ones who built — through their own practice — the quiet authority that comes from having done the work.