AI moves fast: are you training your people to use it wisely?

You can't supervise every decision your people make, so what they actually learn from compliance training, and how they apply it, matters more than ever.

I keep having the same conversation with senior leaders about privacy, cyber and AI. They worry about what staff are uploading, what they rely on, and what decisions they make based on what comes back.

They also recognise that at some point you have to trust your people. It's simply impossible to be in every meeting or supervise every document or decision.

My question is: what have you done to make sure your people are ready for that responsibility? If the answer is an annual compliance course that everyone clicks through as quickly as possible, you have a problem.

For too long, training has been bought and measured around completion. Assign the course, chase everyone up, get the report and show the board that it is done. But "everyone has completed their training" and "everyone understands what they need to do" are two very different statements.

This matters when someone is about to put a confidential client document into an AI tool for a quick summary, or accept an AI-generated answer without checking the source. People can create serious problems while genuinely believing they are doing a good job.

Applying knowledge

That is why today more than ever, employees need to understand privacy, confidentiality, cybersecurity, fraud and integrity well enough to apply them in unfamiliar situations. And they need this front-of-mind when using AI, not sitting in a course they vaguely remember completing six months ago.

Take integrity for example. There should be no issue with people using an approved AI tool to help prepare a piece of work, but they need to be honest about how they used it and accountable for what they put their name to.

Passing on an unchecked AI-generated response as though you have personally researched and verified it is simply not ok. Your people need to understand that distinction and your culture needs to reinforce it.

Technical controls, clear policies and oversight will always play a role, but eventually there will be moments when a person has to make a judgement call. Good compliance training helps them make it.

AI-suitable training

So what does AI-suitable training actually look like?  For a start, it needs to be a fit for the person doing it. People working in an office, in the field, or serving customers in a retail store face very different situations. Managers also have responsibilities that non-managers do not. Quality training delivers people courses and scenarios that reflect their roles and the decisions they actually face.

It should also respect what they already know.

There is no value in making a knowledgeable employee sit through material they can already show they understand, while giving them too little time to focus on what they are getting wrong. Especially in today's highly regulated environment when some professionals may need to complete 20+ courses per year.

The best training is adaptive, where pre-assessment allows employees to demonstrate their knowledge upfront. Where they meet the required standard, they can move swiftly through the course material to focus on the gaps in their knowledge. 

It should also highlight where action is needed. For example, if a team repeatedly gets questions about confidential information wrong or if managers don't know how to respond to a complaint. Having this insight gives you a chance to act before a misunderstanding becomes a real incident.

From completion to compliance

The best good compliance training helps you identify patterns in training responses across roles, teams and locations. A completion report alone cannot do that.  If your approach compliance training cannot help you identify risk, you are missing out on one of the most valuable tools in your arsenal, and in this environment, one you cannot afford to be without.

This is why we need to make the case to senior leaders that budgeting and buying decisions are so important. Privacy, cyber, and AI are among the biggest business risks, and the budget to help people manage them needs to reflect that.

These risks could seriously damage your business; so we can't treat compliance training as something to buy at the lowest possible price. Cheap training that fails to build understanding is a false economy. There is no benefit in saving on the course and while leaving your business exposed to the very problem the training was meant to prevent.

Quality does not mean making everyone do more training. It means choosing courses that are relevant, engage people, test understanding, and provides actionable intelligence to help businesses mitigate risk.

Good compliance training should be part of every business's cultural framework. It sets expectations for what is acceptable, what to question, and what to do when something doesn't feel right. As AI becomes part of everyday work, that foundation is one of every our most important protections.