Most companies now have an AI acceptable-use policy. Far fewer have staff who could explain it. A policy that lives in a PDF does not change what someone pastes into a chatbot at 6 p.m. on a deadline.
This guide covers policy training: teaching employees the rules for using AI safely at work and confirming they understood. It does not cover building AI skills, such as prompting or automating workflows. That is a separate program with different goals, owners and measures.
Policy Training vs Skills Training: Keep Them Apart
| AI policy training | AI skills training | |
|---|---|---|
| Goal | Safe, permitted use | Better, faster work with AI |
| Question it answers | "What am I allowed to do?" | "How do I do this well?" |
| Audience | Everyone who can access AI tools | Roles chosen by business need |
| Owner | Legal, compliance, security, HR | L&D and business leaders |
| Proof | Acknowledgment and scenario check | Applied work and performance |
| Refresh trigger | Policy, tool or law change | New use cases and tools |
Mixing them causes problems. Skills courses that bury the rules in module six leave people unsure what is allowed. Policy courses that try to teach prompting get long and lose attention.
Why Train on the Policy at All
Frameworks expect it. The NIST AI Risk Management Framework's GOVERN 2.2 outcome says personnel and partners should receive AI risk management training to perform their duties consistent with policies. Its Playbook suggests tailoring training to technical and oversight roles.
If you operate in the EU, Article 4 of the EU AI Act addresses AI literacy for providers and deployers of AI systems. Its wording has been through amendment, so confirm the current text with counsel.
The practical reason is simpler. Training is meant to prevent an ordinary employee from making a reasonable-looking choice without knowing the rule.
Step 1: Turn the Policy Into Rules People Can Apply
Policies are written for lawyers. Training needs rules a busy employee can apply in seconds. Pull five things out of your policy:
• Approved tools: which AI tools are allowed, and through which accounts
• Data rules: what information may and may not go into each tool
• Prohibited uses: decisions or content AI must not be used for
• Review rules: when a human must check AI output before it is used
• Disclosure rules: when to tell customers, colleagues or clients that AI was used
If the policy cannot answer one of these, fix the policy before you train on it.
Template: The Data Traffic Light (Illustrative)
Replace the examples with your own data classes and approved tools.
| Light | Data examples | Approved enterprise AI tool | Public or personal AI tools |
|---|---|---|---|
| Green | Public marketing copy, published docs | Allowed | Allowed |
| Amber | Internal plans, non-sensitive internal emails | Allowed | Not allowed |
| Red | Customer personal data, health data, credentials, source code, unreleased financials, client confidential material | Only where the policy names a specific approved use | Never |
A one-page version of this table, posted where people work, does more than a long policy section.
Step 2: Map Audiences and Risk
Everyone gets the core module. Some roles need an add-on because their mistakes cost more.
• All staff: approved tools, data traffic light, review and disclosure rules, how to report a mistake
• Managers: how to answer team questions, approve exceptions and spot misuse
• HR and recruiting: AI in hiring, performance and employee data decisions
• Legal and finance: client confidentiality, privileged material and financial reporting
• Engineering: source code, secrets, AI coding assistants and third-party model terms
• Customer-facing teams: what can be said to customers about AI and how to handle their data
Step 3: Build a Short Core Module Around Scenarios
Rules stick when people practice applying them. Build the core module around realistic scenarios from your own company, then end with a short scenario check.
Template: Scenario Bank (Adapt to Your Policy)
Scenario 1: A sales rep wants to paste a customer's contract into a free chatbot to summarize it. *Expected answer:* Not allowed. Customer contracts are red data; use the approved tool only if the policy names this use.
Scenario 2: A marketer uses the approved tool to draft a blog intro from the company's public product page. *Expected answer:* Allowed. Green data, approved tool; review before publishing.
Scenario 3: An engineer pastes an error log containing an API key into an AI assistant. *Expected answer:* Not allowed. Credentials are red data; rotate the key and report it.
Scenario 4: A recruiter asks AI to rank candidates and plans to reject the bottom half automatically. *Expected answer:* Check the prohibited-uses list. Many policies forbid using AI alone for employment decisions; escalate to HR and legal.
Scenario 5: An analyst uses AI to draft figures for a board deck and does not check them. *Expected answer:* Not allowed. Review rules require a human check of AI-generated facts and numbers.
Scenario 6: An employee realizes they pasted customer data into the wrong tool yesterday. *Expected answer:* Report it now through the named channel. Explain that prompt reporting is expected and supported.
Scenario 6 matters most. People hide mistakes when training only lists punishments.
Step 4: Record Acknowledgment
Ask each person to confirm they completed the module and agree to follow the policy. Keep the record with the policy version.
Template: Acknowledgment Text (Have Counsel Review)
> "I have completed AI policy training for policy version [X], dated [date]."
> "I understand which AI tools I may use, what I must not enter into them, when to review AI output and how to report a mistake."
> "I will follow the policy and ask [contact] if I am unsure."
Keep it short and specific. Long legal text gets clicked through without reading.
Step 5: Run a 30-Day Rollout
Days 1 to 5, pilot: run the module with one team from each high-risk role. Collect confusing questions and fix the content.
Days 6 to 10, manager briefing: brief managers first, with a short Q&A sheet, so they can answer questions when the wider launch lands.
Days 11 to 25, launch: open the module to all staff, with a clear deadline and reminders. Leaders should complete it visibly first.
Days 26 to 30, follow-up: chase incomplete records, review scenario-check results and publish answers to the top questions.
Make access to approved AI tools depend on completion where your systems allow it. That links the rule to the tool people want.
Step 6: Measure Understanding, Not Just Completion
Completion rates show who clicked through. They do not show who understood. Track a few signals:
• Scenario-check results by question; a question most people miss points to unclear content or an unclear rule
• Questions to the policy inbox by theme
• Exception requests and how many are approved
• Self-reported mistakes; a rise after launch can mean people trust the reporting channel
• Use of unapproved tools, where security tooling can see it
For broader training metrics, see our guide on measuring corporate AI training effectiveness.
Step 7: Plan Refreshers and Triggers
Schedule a regular refresher, and also retrain when something changes:
• The policy changes, especially data rules or prohibited uses
• A new AI tool is approved or a tool's terms change
• A relevant law or regulation takes effect where you operate
• An incident or near miss reveals a misunderstanding
Keep refreshers short and focused on what changed.
Common Mistakes
• Training on a vague policy. If the rules are unclear, the training will be too.
• One module for everyone. High-risk roles need specific add-ons.
• Only listing prohibitions. People need to know what is allowed and how to get help.
• Measuring completion only. Use scenario checks to see understanding.
• Merging policy and skills training. Keep the rules short and separate from longer skills programs.
Our Own Product Note
Disclosure: this is our own service. LuMay Academy offers AI learning programs for teams. We are not ranked or recommended in this guide.
Next Step
Pull the five rule types out of your current policy, build the data traffic light and write six scenarios from real situations at your company. Pilot with one high-risk team before launch.
References
• NIST, AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
• NIST AIRC, AI RMF Playbook, Govern (GOVERN 2.2): https://airc.nist.gov/airmf-resources/playbook/govern/
• EU AI Act, Article 4: AI literacy (AI Act Explorer): https://artificialintelligenceact.eu/article/4/
