What should you train employees on regarding the AI Act?

The AI Regulation does not specify any concrete content. We do – developed in collaboration with specialist departments, learning experts, AI experts and lawyers.

Article 4 of the EU AI Act initially only states that 

"Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf […]"

(See Article 4 of the EU AI Act)

That is quite broadly worded. So what should you actually train employees on?
As experts in security, regulation and learning, we asked ourselves the same question – and so we brought together AI experts, specialist departments from our clients, lawyers and learning experts to jointly define the content of an "AI literacy training".

AI fundamentals for AI Act training

This one's a no-brainer. Anyone using AI should understand the mechanics behind it:

• How does AI actually work?
• How does an AI learn?
• What is grounding and reasoning?
• What is the difference between a public LLM and an enterprise AI system?
• What are hallucinations, and why is AI often biased?

The key messages here: AI produces probabilities, not truths. With public systems, your input data may be used for training purposes. And you should never adopt AI output without reviewing it. The "human in the loop" remains essential.

The EU AI Regulation and AI literacy requirements under the AI Act

All experts quickly agreed that AI literacy training should also explain the essence of the EU AI Regulation:

• Why does it exist?
• What do the risk categories mean?
• What obligations does the EU AI Regulation introduce?

For everyday users, this chapter is primarily informational. They should be familiar with the risk categories and the transparency obligations – and understand that they are always personally responsible for the outcome and must stand by it.

"The AI did it" 

is not an excuse. 

Topics such as ethics, fairness, bias mitigation, data protection and data security are, in our view, so important that we address them in dedicated chapters.

AI and cyber security / data protection

We have divided this chapter into two main sections. 
The first covers how attackers use AI (phishing, social engineering, deepfakes): AI is a superpower – for attackers and defenders alike. Phishing emails are becoming more sophisticated and deepfakes are virtually undetectable. But protection is still relatively straightforward: verify, verify, and verify again.

The second section addresses the incidents that AI can cause – even unintentionally – when the wrong AI system is fed sensitive information. This covers both cyber security and data protection, since personal data is, at its core, simply sensitive information. The key messages: do not upload sensitive data to public AI systems; if necessary, pseudonymise it first. 
 

AI systems in everyday work: what employees need to know

A common requirement from our clients was:

 "We need our specific use cases and tools to be reflected in the training." 

That is why this chapter was created:

• Which AI should I use for which purpose?
• How do integrated systems such as Gemini or Copilot differ from ChatGPT or Claude?
• Which AI systems has the organisation approved for use? 

The key messages: use AI – it is already becoming an integral part of working life. But always engage your critical thinking. AI is a tool, not a decision-maker. You are, and remain, the responsible party.

Practical tips for using AI

Finally, we equip participants with practical tips for their day-to-day work – for example, trying out different AI systems, including in different languages. Or how to avoid the "garbage in, garbage out" problem. Ultimately, the right prompt is fundamental to the quality of the output: role, task, format and, above all, context. 

We also explain the correct approach to copyright. Can AI-generated content be protected by copyright? Can it infringe copyright? Is it permissible to use AI-generated images freely?

And we reinforce once more the importance of the "human in the loop" – that AI output should never be adopted without review. 

We are confident that these 5 chapters, delivered in approximately 30–40 minutes, not only fully address Article 4 of the EU AI Regulation, but cover all relevant topics for the target group of AI system users – concise, easy to understand, with videos and plenty of practical tips. 

The training is also available for use in your organisation's own LMS (the magic word being "SCORM"), or via our GDPR-compliant training platform – complete with assessment and certificate.

Role-specific content for AI training 

Under the EU AI Regulation, training should be tailored to the relevant role (e.g. HR, IT or management). As the topic is still relatively new for most people, the majority of organisations start with a broad, general approach. 
Larger organisations in particular often have no way of assigning different training content to different target groups. We do. We can integrate conditional logic into our training – for example, "do you work in HR?" – and deliver role-specific content accordingly.

Refresher courses and test-out options in line with AI Act requirements 

The EU AI Regulation also states that the learner's existing level of knowledge should be taken into account. That is not straightforward with a one-size-fits-all e-learning – but it is achievable. 
We offer refresher pathways that revisit existing knowledge, right through to test-out options for more experienced learners: "Already up to speed? Prove it with a pre-assessment. Pass the questions for a chapter and you can skip it entirely. Don't pass, and you've just shown yourself that the chapter is worth your time."
Participants love refresher pathways and test-out options – particularly when they already covered the content the previous year. 
And organisations love them too, because no valuable productivity is wasted needlessly; the training takes only as much time as is actually needed.