AI training for staff: what to cover and how to record it

BuildAIPolicy Research · Published 30 October 2026 · 3 min read

Most people learn AI tools by trial and error. Short training suited to their role helps them get real value from the tools and avoid the common mistakes, such as pasting in customer details or trusting a wrong answer. For organisations that provide or use AI in the EU, it's also part of a legal duty.

What the EU AI Act asks

Article 4 of the EU AI Act, on AI literacy, has applied since 2 February 2025. The 2026 Digital Omnibus on AI (Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026) changed its wording. Providers and deployers of AI systems must now take measures to support the development of AI literacy of their staff and others operating AI on their behalf, taking into account their knowledge, experience and the context the AI is used in. The amended text says this doesn't require guaranteeing any specific level of AI literacy for any individual.

"Deployers" includes ordinary businesses that use AI tools. In its AI literacy questions and answers (May 2025, written before the 2026 change), the European Commission said organisations whose staff use generative AI for tasks such as writing advertising text or translating content are covered. It also said that:

organisations don't need to issue a certificate, and internal records of training are enough;
a programme should at least give a general understanding of AI, reflect whether the organisation provides or uses AI, and take account of the risks of the systems used;
relying only on instructions for use, or asking staff to read them, may not be enough.

Our AI policy template for EU organisations puts this in context with the Act's other dates.

Outside the EU

In Australia, the UK and the US, AI training isn't usually a standalone legal requirement. It's still how staff learn the rules in your AI policy and the obligations that already apply to the information they use. For example, Australia's privacy regulator, the OAIC, says privacy obligations apply to any personal information put into an AI system.

What to cover

What the tools do well and badly, including that they can give confident answers that are wrong.
Your approved tools and accounts, and how to ask for a new one.
What information may and may not go into each tool.
How to check output, with more care for anything sent to customers or affecting decisions about people.
When to tell people AI was used, such as on a chatbot.
How to report a mistake, and who to report it to.

Match it to the role

Everyone who uses AI needs the basics above. People whose work carries more risk need more: for example, staff using AI to screen job applicants or assess customers, people who set up chatbots, and whoever approves new tools. A short induction before first use, a refresher when the tools or rules change, and a little extra for higher-risk roles is a proportionate approach for most organisations.

How to keep a simple record

A record doesn't need special software. A table with these columns is enough for most organisations:

name and role;
date of the training, and what it covered;
the version of the AI policy they've read, with their signed acknowledgement;
when their next refresher is due.

Keep it with the AI policy, and update it when people join or the policy changes.

Common mistakes

Sending the policy round and treating that as training.
Giving everyone the same session, whatever their role.
Training once and never again, while the tools change every few months.

If you're starting from nothing, our guide to a ChatGPT policy for employees covers the rules the training should teach.

Sources

This article is general information, last checked against these sources on 30 October 2026. It isn't legal advice. For advice on your situation, speak to a qualified adviser.