AI Literacy & Staff Training Plan
Plans and evidences AI literacy training for staff who use or oversee AI systems.
Available soon
- Format
- Excel
- Size
- 73 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this workbook is. It is the plan for AI literacy that rule AG-18 of the AI Acceptable Use & Security Policy asks for. The ai governance lead owns it. The awareness lead runs the modules and keeps the record. |
| 2 | Start on the Plan and counts sheet. Set the as-at date, the date the plan launched, the days allowed for people who already have access, the months between refreshers and the smallest group you report. Keep the settings the policy sets (AG-18). |
| 3 | Read the Article 4 and evidence sheet once. It says what Article 4 asks and what evidence to keep. The measures must fit the people: the same module is not right for everyone. |
| 4 | On the Audiences sheet, keep the audiences that fit you and delete the rest. For each audience enter the owner, the number of people, how many have completed the modules, how many have time left, and the due date. Enter the people from your inventory (AI System & Use Case Inventory) and your accounts, counted once for each audience. |
| 5 | Read the state the sheet works out. Complete: everyone has finished. Not yet due: nobody is late and some people still have time. Overdue: some people are neither done nor within their time. Fix an overdue audience with its owner and a date. |
| 6 | Check the modules on the Modules sheet. Set the length and the version in use for each, and write how it is delivered. Every module should be taken by at least one audience. The sheet says "None" where it is not. |
| 7 | Record each completion on the Completion record sheet: person, audience, module, module version, due, completed, how delivered and where the evidence is filed. The sheet works out when the refresher falls due and flags a row that does not fit the plan. If a learning system holds the same fields, keep the record there and link it. |
| 8 | Treat the completion record as personal data. Give named results only to the person and to the awareness lead. Everyone else sees group results of at least 10 people (P16 AW-13). The Plan and counts sheet says which audiences are too small to report alone. |
| 9 | Enter a new joiner with access to an AI tool on the Completion record sheet before the account is switched on (AG-18, IS-6 of the AI Use Case Intake & Approval Procedure). A new member of the management body takes the briefing within 10 working days of joining (AU-5, P04). |
| 10 | Report the counts each month to the security and IT leadership team with every gap named: AIM-04 is the number of people with access who have completed AI essentials, out of all people with access (AG-22). |
| 11 | Review the plan whenever a new tool, a new audience or a change in the law changes who needs what. A new tool goes through intake first (AI Use Case Intake & Approval Procedure). Keep the plan, the module versions and the completion record for 3 years after the use ends (AG-12). |
| 12 | To clear the EXAMPLE, replace the settings, delete the EXAMPLE rows on the Audiences and Completion record sheets once your own are entered, and set your own module lengths. The formulas stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps you govern the AI your organisation uses. It is not legal advice, and following it is not a statement that you comply with the EU AI Act, the GDPR or any standard. Whether the Act binds you, in which role, and which of its duties apply to each system depends on the facts and on how your Member State applies the Act: confirm it with counsel.
Rule AG-18: Everyone who uses or oversees an AI tool completes the AI essentials module (AL-01) before access is switched on, or within [[60]] calendar days of the plan's launch if they already have access, and refreshes it every [[12]] months. People in the roles of A09 take the role modules. The organisation keeps an internal record of what each person completed. No certificate is needed (EU AI Act Article 4).
AI essentials (AL-01) is a separate module from the baseline security awareness course of P16 (LM-01 to LM-07). It does not change how P11 counts that course (MC-36). Run both.
P09 owns incident response. The module AL-01 teaches people to report an AI-related event at once through the incident route (P09 IM-01) and names the triggers (AT-1 to AT-8). The incident pack decides what is an incident and what must be reported.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders as at 30 Sep 2026. The plan launched on 1 Sep 2026. People who already had access have until 31 Oct 2026. 104 of 131 people with access have completed AI essentials; 2 of 7 audiences are complete and 0 entries are overdue.
Adapting this template:
• Replace the [[placeholders]] with your own values, and delete the EXAMPLE rows on the Audiences and Completion record sheets once you have entered your own. The formulas stay.
• Keep the audiences that fit your organisation and delete the rest. A small organisation often has two or three: everyone with access to a tool, the people who own or check a use, and the management body. Add an audience on a blank row, with its own ID, if your inventory shows a group the seven do not cover.
• Change the modules to fit the tools you actually use. The minutes are EXAMPLE lengths. A regulated organisation adds its sector's rules to the modules. An organisation that buys its training from a service provider or an outsourced learning system keeps the plan here and links each module to the provider's course in the Version column.
• Use the learning system's own record where you have one. This workbook holds the plan, the counts and the evidence you keep. It does not replace the system.
• Add your own columns to the right of the calculated ones, so the layout stays the same as the formulas expect.
This workbook is your own record. Keep it with the approved policy and the completion record behind it.
Plan and counts
Settings and counts
Enter the settings (yellow). The white cells count the Audiences and Completion record sheets. Counts only: "104 of 131", never a percentage or a score (AG-22).
Settings
| As-at date | 30 Sep 2026 | States and counts are worked out at this date. EXAMPLE: 30 Sep 2026. Type a date, never a formula. |
| Date the plan launched | 1 Sep 2026 | The day the policy's literacy rule (AG-18) began to apply to people who already had access. EXAMPLE: 1 Sep 2026. |
| Days allowed for people who already have access | 60 | Calendar days from the launch (AG-18). The house default is 60; the adopter sets it. A new joiner completes AI essentials before the account is switched on. |
| Last day for people who already have access (calc) | 31 Oct 2026 | The launch date plus the days allowed. EXAMPLE: 31 Oct 2026. |
| Months between refreshers | 12 | AG-18. The house default is 12, the cadence of the baseline course in P16 (AW-04). |
| Working days for a new member of the management body | 10 | AU-5. The window P04 sets for a joiner to acknowledge the policy (AG-19); the briefing takes the same time. |
| Smallest group to report alone | 10 | P16 AW-13: everyone except the person and the awareness lead sees group results of at least this many people. Smaller audiences are reported with another audience. |
Counts
| Audiences in the plan | 7 | Rows on the Audiences sheet with an ID. |
| Audiences where every person has completed the modules | 2 | The state is Complete. |
| In words | 2 of 7 audiences complete | Report this with the audiences named. Never a percentage (AG-22). |
| Audiences with someone overdue | None | Audience IDs, in the order of the Audiences sheet. Each is a gap to close with its owner. |
| Entries: people in each audience, counted once for each audience | 239 | A person in two audiences is one entry in each, so this is not a count of people. |
| Entries where the modules are complete | 139 | |
|---|---|---|
| In words | 139 of 239 entries complete | |
| Entries not yet due | 100 | People who have time left at the as-at date. |
| Entries overdue | 0 | People in an audience who are neither complete nor within their time. |
| In words | 0 of 239 entries overdue | |
| AIM-04: people with access to an approved AI tool who completed AI essentials | 104 of 131 | AU-1 on the Audiences sheet: completed, out of all people with access (AG-22). Report it as these two numbers. |
| of the rest in AU-1 | 27 not yet due, 0 overdue | Not yet due people are inside the window above. Overdue people are the gap. |
| Completion record rows that need attention | 0 | Rows on the Completion record sheet whose check is not OK. |
| Completion record rows overdue or past their refresher | 0 | Rows in a state of Overdue or Refresh overdue. |
Audiences too small to report alone
| Under the smallest group (calc) | AU-4, AU-5, AU-6 | Report each of these with another audience. A count for a very small group shows what one person has done (P16 AW-13). |
Audiences
EXAMPLE: 7 audiences, as at 30 Sep 2026. Yellow columns are inputs; white columns calculate from them and from the Modules sheet. One row for each audience. A person in two audiences counts once in each.
| Example | Audience ID | Audience | Who is in it | Modules | When, and how often | Owner | People | Completed | Not yet due | Due | Note | Overdue (calc) | Completed, in words (calc) | State (calc) | Minutes for each person (calc) | Check on the counts and date (calc) | Reporting (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | AU-1 | People with access to an approved AI tool | Everyone who can use an approved tool for work, including contractors and supplier staff with our accounts | AL-01 | Before access is switched on; then every 12 months | [[e.g. Information Security Manager]] | 131 | 104 | 27 | 31 Oct 2026 | 120 office-assistant licences, 6 design-tool users and 9 planners, counted once each. | 0 | 104 of 131 | Not yet due | 20 | OK | Can be reported by group |
| EXAMPLE | AU-2 | AI use owners and the people who check output | Every named owner and overseer in the inventory | AL-01, AL-02 | Before the first approval they hold; then every 12 months | [[e.g. Head of Risk]] | 12 | 9 | 3 | 31 Oct 2026 | The named owners and checkers in the inventory. | 0 | 9 of 12 | Not yet due | 50 | OK | Can be reported by group |
| EXAMPLE | AU-3 | Customer service staff | Staff who answer customers, who would hand over from, or correct, a customer-facing assistant | AL-01, AL-04 | Before any customer-facing assistant goes live; then every 12 months | [[e.g. Information Security Manager]] | 60 | 0 | 60 | Before any customer-facing assistant goes live | The 60 customer service agents of P13's RP-03. The chatbot is held, so the module is not yet due. | 0 | 0 of 60 | Not yet due | 40 | OK | Can be reported by group |
| EXAMPLE | AU-4 | Staff who publish content | Marketing, sales and anyone who publishes text, images, audio or video outside the organisation | AL-01, AL-05 | Before they use a generative tool for published work; then every 12 months | [[e.g. Information Security Manager]] | 6 | 6 | 0 | Done | Marketing, including the four who had used the free assistant. | 0 | 6 of 6 | Complete | 40 | OK | Under 10 people: report with another audience (P16 AW-13) |
| EXAMPLE | AU-5 | The management body and the Tier 3 decision-maker | Members of the management body, and whoever your procedure names to take Tier 3 decisions (executive management by default; the board or its equivalent where your governance structure puts it) | AL-06 | A briefing when the policy is approved and each 12 months; new members within 10 working days of joining | [[e.g. Head of Risk]] | 7 | 0 | 7 | [[Date of the next board meeting]] | The board of seven (P12). The Executive Committee was briefed when it approved the policy on 11 Aug 2026. | 0 | 0 of 7 | Not yet due | 45 | OK | Under 10 people: report with another audience (P16 AW-13) |
| EXAMPLE | AU-6 | HR and people managers | HR staff, and managers who recruit, appraise or discipline | AL-01, AL-07 | Before any use that touches a decision about a person; then every 12 months | [[e.g. HR Business Partner]] | 9 | 9 | 0 | Done | The HR team, after the recruitment add-on proposal. | 0 | 9 of 9 | Complete | 50 | OK | Under 10 people: report with another audience (P16 AW-13) |
| EXAMPLE | AU-7 | Developers and IT administrators who connect tools | People who write code with an AI assistant, connect plug-ins or set up an AI system | AL-01, AL-03 | Before they connect or build; then every 12 months | [[e.g. Head of IT]] | 14 | 11 | 3 | 31 Oct 2026 | Developers and IT administrators who connect tools. | 0 | 11 of 14 | Not yet due | 50 | OK | Can be reported by group |
Modules
EXAMPLE: 7 modules. The minutes are EXAMPLE lengths: set your own. The audiences that take each module come from the Audiences sheet.
| Example | Module ID | Module | Minutes | What it covers | Taken by (calc) | Version in use | Usual delivery |
|---|---|---|---|---|---|---|---|
| EXAMPLE | AL-01 | AI essentials | 20 | What an AI system is and is not; how generative tools can be wrong or invented; the approved list and the data limits (AG-02, AG-03); signing in with the work account; checking output; what to disclose (AG-08); what to report (AT-1 to AT-8). | AU-1, AU-2, AU-3, AU-4, AU-6, AU-7 | [[Version]] | |
| EXAMPLE | AL-02 | Owning and overseeing an AI use | 30 | The intake questions, the tiers and the inventory; what human oversight means and how to do it (AG-07); reviews and triggers; what a competent overseer checks. | AU-2 | [[Version]] | |
| EXAMPLE | AL-03 | Building with AI safely | 30 | Keeping secrets out of prompts; reviewing AI-generated code (AG-15); plug-ins and agents that act (AG-16); the supplier terms ST-1 to ST-8; prompt injection. | AU-7 | [[Version]] | |
| EXAMPLE | AL-04 | Customers and AI | 20 | Telling customers they deal with an AI system (AG-08); how to take over from an assistant; what never to leave to it; recording a complaint about its answer. | AU-3 | [[Version]] | |
| EXAMPLE | AL-05 | Publishing AI-generated content | 20 | Labelling realistic AI images, audio, video and text (AG-08); no real people without consent; checking facts, rights and tone before publishing. | AU-4 | [[Version]] | |
| EXAMPLE | AL-06 | AI and the management body | 45 | The pack's idea, the tiers, the Tier 3 decision, what the EU AI Act asks of a deployer and when, the prohibitions, and the measures the management body sees. | AU-5 | [[Version]] | |
| EXAMPLE | AL-07 | AI and decisions about people | 30 | Why a person decides (AG-06; GDPR Article 22); Annex III area 4; the prohibition on inferring emotions at work (AG-05); telling and consulting staff (AG-21); candidates' and staff members' rights. | AU-6 | [[Version]] |
Completion record
EXAMPLE: 2 records. One row for each person and module, with the nine fields in the order of the plan. The records are personal data: restrict who sees them (P16 AW-13).
| Example | Person | Audience | Module | Module version | Due | Completed | How delivered | Evidence reference | Next due (calc) | State (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | [[Name of an HR team member]] | AU-6 | AL-07 | [[Version]] | 24 Sep 2026 | [[How it was delivered]] | [[Where the completion is filed]] | 24 Sep 2027 | Complete | OK | |
| EXAMPLE | [[Name of a planner with access]] | AU-1 | AL-01 | [[Version]] | 31 Oct 2026 | [[How it will be delivered]] | Not yet due | OK |
Article 4 and evidence
What Article 4 asks, and what to keep
Article 4 of the EU AI Act, as replaced by Regulation (EU) 2026/1744, asks for measures. It does not ask for a certificate or a level for each person. The points below follow the text in the Framework References sheet.
What the text asks
| Point | What it says | |
|---|---|---|
| 1 | Providers and deployers take measures to support the development of AI literacy of their staff and of other persons who deal with the operation and use of AI systems on their behalf. | |
| 2 | The measures take account of each person's technical knowledge, experience, education and training, the context the systems are used in and the people they are used on. | |
| 3 | The duty does not require a provider or deployer to guarantee any specific level of AI literacy of any individual. | |
| 4 | Article 4 has applied since 2 February 2025. The replaced wording applies from 27 July 2026, when Regulation (EU) 2026/1744 came into force. | |
| 5 | The Commission says there is no need for a certificate and that an internal record of training or other guiding initiatives is enough. National market surveillance authorities supervise Article 4 from 2 August 2026. | |
The plan in this workbook
| Article 4 asks for | How this workbook answers | |
|---|---|---|
| Measures that fit the people | Seven audiences, each with its own modules (Audiences sheet). The management body, people who decide about other people and people who connect tools do not take the same module as everyone else. | |
| Measures that fit the context | The modules cover the approved list and the data limits (AG-02, AG-03), so the content follows the tools and data in use. Add a module when a new kind of tool arrives. | |
| A record of what was done | The Completion record sheet holds who did what and when. An internal record is enough. | |
| No level to certify | The plan counts who has done the module. It does not score understanding and it gives no pass mark. | |
Evidence kept
| What | What to keep | Why |
|---|---|---|
| The plan | This workbook, with the audiences, the modules and the dates, approved by the AI governance lead and kept under document control. | Shows the measures you chose and who they are for. |
| The module content | The version of each module in use, and the date it last changed. | Shows what people were taught on the day they completed it. |
| The completion record | One row for each person and module with the nine fields of the Completion record sheet, or the learning system's own export with the same fields. | An internal record of what was done is enough. No certificate is needed. |
| The management briefing | The date, the attendees and the slides or notes for the briefing to the management body (AU-5, AL-06). | Shows that the people who decide Tier 3 uses were briefed. |
| The counts | The Plan and counts sheet, saved at each month end with the as-at date. | Shows progress over time. The AI governance lead reports them as counts (AG-22). |
Keep the plan and the record for 3 years after the use ends, or longer where law or a contract asks (AG-12). 9 fields in the completion record: Person, Audience, Module, Module version, Due, Completed, How delivered, Evidence reference, Next due.
Lists
Delivery
Learning system
Live session
Briefing
Reading with sign-off
Other
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| AI literacy | Skills, knowledge and understanding that let people make an informed use of AI systems and be aware of the opportunities, risks and possible harm (EU AI Act Article 3(56)). |
| Audience (AU-nn) | A group of people who need the same AI literacy modules, such as everyone with access to an approved tool, or the management body. AU-1 to AU-7 are the audiences of this plan. |
| Module (AL-nn) | One piece of AI literacy training, with a length and a version. AL-01 to AL-07 are the modules of this plan. The minutes are EXAMPLE lengths. |
| Entry | One audience's head count. A person in two audiences is one entry in each, so the total of entries is not a count of people. |
| Completed | The person has finished every module their audience takes, and the date is on the completion record. |
| Not yet due | The person has not finished and the due date has not passed at the as-at date. |
| Window | The days from the launch that people who already have access are allowed to finish AI essentials (AG-18). A joiner finishes it before the account is switched on. |
| Refresher | The same or an updated module taken again after the months between refreshers (AG-18). |
| AI essentials (AL-01) | The module every person with access takes. It is separate from the baseline security awareness course of P16 (LM-01 to LM-07) and from the way P11 counts that course (MC-36). |
| Approved tool | An AI tool on the approved list (A07) with a state of Approved or Approved with conditions, and the data levels it may take. |
| Human oversight | A named person who is competent to judge the output reads it before it is relied on, sent outside the organisation or published, and has the authority to reject it. |
| AG-nn, AT-nn | Rules and AI incident triggers of the AI Acceptable Use & Security Policy. The rule that asks for this plan is AG-18. |
| Group result | A count for an audience. Only groups of at least the smallest group on the Plan and counts sheet are reported alone (P16 AW-13). |
| Complete | On the Audiences sheet: every person in the audience has completed the modules. On the Completion record: the module is done and its refresher is not yet due. |
| Not yet due | Nobody in the audience is overdue, and some people still have time. Their due date has not passed at the as-at date. |
| Overdue | On the Audiences sheet: some people have neither completed the modules nor have time left. On the Completion record: the due date passed and the module is not done. |
| Refresh overdue | The person completed the module, and the next refresher fell due before the as-at date. |
| Enter the counts | The audience has no head count yet. |
| Check the counts | Completed plus not yet due is more than the people in the audience. |
| Enter a due date | The record has no completion date and no due date. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 6.3 — Information security awareness, education and training | Audiences, Modules and Completion record sheets: the training that the awareness control asks for, who needs which module and the record of completion |
| ISO/IEC 42001:2023 | Clause 7.2 — Competence | Audiences sheet: the competence each audience needs for its part in the AI uses |
| ISO/IEC 42001:2023 | Clause 7.3 — Awareness | Modules sheet: awareness of the AI policy and the person's part in it (AL-01) |
| ISO/IEC 42001:2023 | Annex A 4.6 — Human resources | Plan and counts sheet: the plan is the organisation's human resources measure for people who use AI |
| NIST CSF 2.0 | PR.AT-01 — “Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind” | Audiences and Completion record sheets: personnel are given awareness and training, and the record shows who has had it |
| EU AI Act — Regulation (EU) 2024/1689 | Article 3(56) — “AI literacy” means “skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause” | Modules and Audiences sheets: the modules teach the skills, knowledge and understanding that the Act's definition of AI literacy describes |
| EU AI Act — Regulation (EU) 2024/1689 | Article 4(1), as replaced by Regulation (EU) 2026/1744 — providers and deployers of AI systems “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”, taking into account their technical knowledge, experience, education and training, the context the systems are used in and the persons on whom they are used; “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” Article 4(2) and (3) have the Commission and the Member States support deployers, in particular SMEs, with practical examples, and have the AI Board adopt recommendations. The replaced text applies from the Omnibus’s entry into force on 27 July 2026; Article 4 itself has applied since 2 February 2025 | Plan and counts, Audiences, Modules and Completion record sheets: measures for each audience that fit the people and the context, and a record of what was done. No level is guaranteed for any individual |
| EU AI Act — Regulation (EU) 2024/1689 | Article 4 before 27 July 2026 — providers and deployers “shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”; Regulation (EU) 2026/1744 replaced it and removed the words “to ensure, to their best extent, a sufficient level” | Article 4 and evidence sheet: the wording that applied until 27 July 2026. This plan follows the replaced text and does not ask anyone to reach a level |
| EU AI Act — Regulation (EU) 2024/1689 | Article 26(2) — deployers “shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support” | Audiences sheet, AU-2: the people who check output are trained for it. For a high-risk system the deployer gives human oversight to people with the necessary competence, training and authority (Annex III systems from 2 December 2027) |
| EU AI Act — Regulation (EU) 2024/1689 | Article 113, as amended — the Regulation applies from 2 August 2026, except that Chapters I and II (including Articles 4 and 5) apply from 2 February 2025, with Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b) applying from 2 December 2026; Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 as regards systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 as regards those under Article 6(1) and Annex I. Article 50 is not listed in an exception and so applies from 2 August 2026 | Article 4 and evidence sheet: Article 4 applies from 2 February 2025; the other dates are those of Article 113 as amended |
| EU AI Act — Regulation (EU) 2026/1744 (Digital Omnibus on AI) | Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Official Journal, 24 July 2026); in force on the third day after publication (its Article 4), 27 July 2026. Its Article 1 amends Regulation (EU) 2024/1689 | Article 4 and evidence sheet: the Regulation that replaced Article 4, in force from 27 July 2026 |
| EU AI Act — Commission guidelines (non-binding) | Commission, AI Literacy — Questions & Answers (last updated 27 July 2026): “There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives.” It says that supervision and enforcement of Article 4 lie with national market surveillance authorities, from 2 August 2026 | Article 4 and evidence and Completion record sheets: no certificate is needed, and an internal record of the training is enough |
| NIST AI RMF 1.0 | GOVERN 2.2 — “The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.” | Modules and Audiences sheets: the modules train personnel for their duties under the AI policy and procedures (AG-18) |
| GDPR — Regulation (EU) 2016/679 | Article 39(1)(b) — the data protection officer’s task “to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits” | Audiences sheet: awareness-raising and training of staff in processing operations is among the Data Protection Officer's monitoring tasks; the modules cover the limits on personal data in AI tools (AG-03) |
| NIS2 — Directive (EU) 2022/2555 | Article 20(2) — members of management bodies are required to follow training to identify risks and assess cybersecurity risk-management practices | Audiences sheet, AU-5 and the module AL-06: training for the management body |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training” | Modules sheet: AL-01 sits beside the baseline security awareness course of P16, which carries the cybersecurity training |
Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); NIST CSF 2.0; NIST AI RMF 1.0; Regulation (EU) 2016/679 (GDPR); as published and read on 8 October 2026
ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
This pack does not say which ISO/IEC 42001 or ISO/IEC 27001 controls, or which NIST AI RMF outcomes, meet a requirement of the EU AI Act. Each reference says what the source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
Regulation (EU) 2024/1689 binds the operators of its Article 2(1): providers, deployers, importers, distributors, product manufacturers and authorised representatives. An organisation that uses another party’s AI system under its own authority for its business is a deployer (Article 3(4)). An organisation that sells goods and is called a distributor in its trade is not an AI Act distributor unless it makes an AI system available on the Union market (Article 3(7)). Which role an organisation holds for each system depends on the facts, and counsel confirms it.
Dates are those in Article 113 as amended by Regulation (EU) 2026/1744, in force from 27 July 2026: the prohibitions and AI literacy from 2 February 2025; general-purpose AI models from 2 August 2025; the general date and Article 50 from 2 August 2026; Article 5(1) points (ba) and (bb) from 2 December 2026; high-risk systems under Annex III from 2 December 2027 and under Annex I from 2 August 2028.