Enter once, for the organisation as a whole. Go as deep as your organisation letter, and implement in your mode.
Why it exists
Train the organisation before the organisation trains itself. In the absence of instruction, people learn AI from marketing, from social media, and from trial and error on live data — and the most expensive AI failures begin exactly there, with a well-meaning employee pasting the wrong thing into the wrong tool, or trusting an answer because it sounded certain. Competence is a control, and like every control it must be built deliberately, differentiated by role: what a board member needs to understand about AI is not what a developer needs, and neither is what the person answering customer email needs. (The specialised security training for the people who build AI is mandated separately, in the AI Security Program dimension; this dimension covers everyone else.)
What to actually do
Aim the basic training at the risks people actually meet, not at theory. Teach every member of staff three things above all. First, that AI systems state falsehoods with complete confidence — the failure usually called hallucination — so an answer that sounds authoritative has not thereby been verified, and anything that matters gets checked before it is used. Second, that pasting confidential, personal, or proprietary material into an unapproved AI tool may hand that material to an outside company permanently; the approved tools exist precisely so this does not happen. Third, where the registration channel is: how to declare a tool they already use, without blame, so it enters governance instead of hiding from it. This one layer of training prevents more incidents than any technical control in this framework.
Teach people not to treat the AI as a person. A model does not think, understand, judge, or intend; it produces plausible patterns. People who forget this over-trust the output — they accept it because it sounded confident and human — and over-trust is the failure mode of the competent, not the careless. Build this into the awareness training explicitly, and aim it hardest at the people who act on AI outputs with the least time to verify them: managers and executives. The obligation to decide remains with the human; the training exists so the human still feels it.
Seed champions in every business unit. Appoint, in each unit, a person who knows the AI policy, knows the tools, and serves as the first point of contact for colleagues’ questions. Champions scale awareness in a way no annual course can, and they carry ground truth back to the committee: which tools people actually want, where the policy chafes, what is being used that no one has registered. They are the bridge between governance and daily practice; without them the two drift apart.
Put the everyday rules where people will actually meet them. A one-page policy states the boundaries; a short, practical usage guide is what a person consults before pasting a document into a public tool, and it is the artefact that changes day-to-day behaviour. Write it in plain language, keep it current, and make it the companion every user is pointed to — not a policy they are assumed to have read.
Ask which model is underneath. Many AI services are built on a model from another provider. Add to the due-diligence questionnaire which underlying models the service uses, who provides them, where they run, and whether the supplier will tell you when they change. A change of underlying model is a change of your system, even when the supplier’s name stays the same.
Controls
Baseline3 controls
Control 48
Deliver mandatory baseline AI training to all staff.
BaselinePreventiveall rolesthe whole organisation
What it is
Covering recognising confident falsehood, protecting confidential data, and using the registration channel — completed before, not after, people use AI tools in their work.
How to implement it · Minimum structure
Confident falsehood: AI states wrong things fluently; anything that matters is checked before use
Confidential data: what must never go into unapproved tools, and why the approved tools exist
Registration channel: how to declare a tool already in use, without blame
Format: 30–45 minutes, real examples, a short quiz
Timing: completed before access to any AI tool is granted; part of onboarding for new joiners
Completion recorded per person and checked against the list of tool users
How to start
Build a 30-minute session on the three topics using your policy and real examples, and require it before anyone gets access to an AI tool.
Evidence
Completion records per person, matched against the list of AI tool users.
Mode: light / standard / full
light
The owner-manager or a commissioned trainer runs one live session and keeps a signed attendance sheet.
standard
HR delivers it through the e-learning platform and IT grants tool access only after completion.
full
Learning and development runs it as a mandatory module linked to access provisioning.
Control 49
Include over-trust and the non-human nature of AI in the awareness content.
BaselinePreventiveall rolesthe whole organisation
What it is
Aimed explicitly at decision-makers as well as front-line users.
How to implement it · Minimum structure
What a model is: it produces plausible patterns; it does not think, understand, judge or intend
Why over-trust happens: fluent, confident, human-sounding answers, and time pressure
Real examples from your own use of a convincing but wrong answer
Habits: check the source, ask how you would know it is wrong; the decision stays with the person
Short version for managers and executives who act on AI summaries with little time to verify
How to start
Add a 10-minute over-trust segment to the baseline training and present it at the next management meeting.
Evidence
The training material with the over-trust section, and attendance records including managers and executives.
Mode: light / standard / full
light
The owner-manager covers it in the baseline session and briefs managers in person.
standard
HR includes it in the e-learning module and a short briefing is given to the management team.
full
A dedicated executive briefing is run each year, and the topic is tested in the course quiz for all staff.
Control 53
Issue a staff-facing secure-use guide for generative AI.
BaselinePreventiveall rolesthe whole organisation
What it is
Setting out what may and may not be placed into public or unapproved tools, how to recognise a confident falsehood, how to write and check a prompt, and what to do the moment sensitive information has been shared by mistake — the everyday companion to the one-page policy
How to implement it · Minimum structure
What may go where: refer to the information-versus-tools matrix
Never paste into public or unapproved tools: personal data, credentials, confidential contracts, unpublished figures, source code
Spotting confident falsehood: check figures, citations and legal or medical claims against a source
Writing a prompt: give context, strip sensitive details, review the answer before use
If sensitive data was shared by mistake: stop, delete where possible, report to the named contact the same day
Plain language, two pages at most, reviewed whenever approved tools change
How to start
Write a two-page guide from your acceptable-use policy and send it to every AI tool user with the approved-tools list.
Evidence
The published guide with its review date and the record of its distribution.
Mode: light / standard / full
light
The owner-manager writes it and circulates it by email with acknowledgement.
standard
The AI lead writes it with IT and publishes it on the intranet, linked from each tool.
full
The governance function maintains it and shows it at tool sign-in.
Enhanced3 controls
Control 50
Provide role-specific training for developers, managers, and oversight bodies.
EnhancedPreventiveall rolesthe whole organisation
What it is
Each audience trained to the depth its decisions require.
How to implement it · Minimum structure
Developers and data specialists: secure use of models and data, testing outputs, prompt-writing guidance
Managers: judging AI output, approving use cases, autonomy and reversibility rules, accountability for decisions
Oversight bodies (committee, board, risk and audit): the AI risk picture, the indicators they receive, the decisions they own
Training matrix: role, modules, depth, frequency, deadline
New role holders trained within a set period, e.g. 60 days
How to start
Draw up a training matrix mapping each role to the modules it needs, and deliver the oversight-body session first.
Evidence
The training matrix and completion records per role.
Mode: light / standard / full
light
A commissioned external trainer delivers one short session per audience, recorded in a spreadsheet.
standard
HR maintains the matrix and the e-learning platform tracks completion by role.
full
Learning and development runs role-based curricula with assessments, and the committee reviews coverage gaps.
Control 51
Keep awareness continuous rather than annual.
EnhancedPreventiveall rolesthe whole organisation
What it is
Refreshed when tools, threats, or rules change — because all three change faster than a yearly course.
How to implement it · Steps
Name an owner who decides and issues refreshes
Triggers: a new approved tool, an incident or near miss, a new attack technique, a change in applicable rules
Issue a refresh within about two weeks of a trigger, and at least quarterly without one
Short formats: five-minute update, bulletin item, team-meeting slot
Log each refresh: date, trigger, audience, material; track acknowledgement for critical updates
How to start
Name the owner and publish a first short update on the most recent change in your approved tools.
Evidence
The refresh log of materials issued, with dates and triggers.
Mode: light / standard / full
light
The person who leads AI use sends a short email update when something changes and keeps a list of what was sent.
standard
Internal communications issues regular bulletins with the AI owner, logged on the intranet.
full
A continuous programme delivers targeted micro-content by role, with reach and acknowledgement measured.
Control 54
Provide secure prompt-writing guidance to the people who build with AI.
EnhancedPreventiveall rolesthe whole organisation
What it is
How to keep trusted instructions separate from untrusted content, what must never be placed in a prompt, and how a prompt is made to fail safe rather than leak or obey the wrong source
How to implement it · Minimum rules
Separate trusted instructions from untrusted content (user input, documents, tool results); mark the latter as data
Never put credentials, keys or unneeded personal data in a prompt; assume prompts can be extracted
Do not rely on the prompt for access control; enforce permissions in code
Fail safe: on conflicting instructions or suspicious input, refuse or hand to a human
Constrain output format and validate it before any downstream use
Version prompts with the code; test them against injection before release
How to start
Write a short guidance note with these rules and review the prompts of the AI system already in production against it.
Evidence
The guidance with its review date, and a record that everyone who builds with AI received it.
Mode: light / standard / full
light
The developer or commissioned integrator applies the note and keeps it with the project documentation.
standard
The engineering lead owns the guidance and checks prompts in code review.
full
Security architecture maintains it, with prompt checks built into release pipelines.
Advanced1 controls
Control 52
Run a champions programme across business units.
AdvancedPreventiveall rolesthe whole organisation
What it is
Named, trained champions with a standing line to the committee.
How to implement it · Minimum structure
One named champion per business unit, with time allocated, e.g. a few hours a month
Training deeper than baseline: policy, approved tools, secure-use guide, registration channel
Role: first contact for colleagues' questions; encourages registration of tools in use
Standing line to the committee: periodic report on tools requested, policy friction, unregistered use found
Roster kept current; the network meets regularly
How to start
Ask each business-unit head to nominate a champion and hold a kick-off session with the committee.
Evidence
The champions roster, their training records and their reports to the committee.
Mode: light / standard / full
light
With few units, one or two named people act as champions and report directly to the owner-manager.
standard
Each unit nominates a champion; the AI lead coordinates them and collects quarterly reports.
full
A coordinated network with its own training path, objectives and a standing slot on the committee agenda.
Evidence
Completion records against the pre-use requirement; the curricula by audience; awareness materials and their refresh history; the champions roster and their reports to the committee. the secure-use guide and the prompt-writing guidance, with their review dates.