Training & policy

The Working Session in team form: two hours, everyone involved in the work present. The same setup (through your own workflow, along both sides, and a first picture at the end) but with the people who do the work rather than only the leadership.

Alongside the A4 with the first picture you get an attendance list: who was there, when, and what the session covered. That is not a formality but something for your own file, because the AI Act expects staff who work with AI to know enough about it.

A team that walks through its own workflow together hears from each other what actually happens, and that is almost never what the leadership thinks. The early adopters say what they have quietly been doing, the reluctant ones say why they have not. That conversation is usually worth more than the outcome.

AI Act training that goes beyond tick-box e-learning: tailored by role, with scenarios built on the AI tools the organization actually uses, and an assessment that measures judgment instead of memory. The outcome is recorded in a file that holds up under an audit.

Employees learn to recognize the danger zones: when a use is prohibited, when a system becomes high-risk, when personal data flows into a chat model, and what to do about it. The assessment presents real situations ("a team lead wants job-application videos scored for enthusiasm, now what?") and asks for a judgment plus an action. Every participation, every test, and the rationale for why each role got which depth of training lands in the file.

First, the honest version: no training makes an organization "fully compliant," and anyone who promises that is selling something that doesn't exist. What a good training does do: prevent the expensive mistakes (the heaviest fines sit on prohibited practices, not on a missed course) and demonstrably record that the organization takes the AI-literacy duty seriously. That duty has applied since February 2025. For SMEs, the SLIM grant can cover a large part of the cost; we don't arrange that for you, but we do point the way.

The AI policy a small team is still following a year later: two to four pages of policy, one page of incident protocol, a register of the AI systems in use, and an annual rhythm with a half-hour monthly check.

Setting down what should already apply in practice: which data may never go into an AI service, who signs off before anything goes out, where to report a mistake, and who is responsible for what. Short enough to be read, concrete enough to be followed.

There's a misconception that policy has to be thick. For an organization of five to a hundred people, a thick framework isn't just unworkable but counterproductive: it doesn't get read, so it doesn't get followed, so effectively it doesn't exist. The best policy isn't the most complete one, it's the one that's followed. One simple count measures progress: the number of tasks that run from start to finish with AI, with agreements and checks in place. If that count reads four or five after a year, it's working.