How to Run an AI Literacy Programme for Employees: A 12-Week Method

What are the steps to run an AI literacy programme?

Most organisations start with a video and a quiz. It is quick, and it produces a completion report, but it rarely changes what people do at four o'clock on a Friday when a client is waiting. A programme is different: it starts from what is really happening, fits training to roles, and keeps evidence that it worked. These ten steps cover a first cycle of about 12 weeks.

• 1. Get a sponsor and agree scope, budget and a report date in a one-page memo.
• 2. Build an inventory of AI use from IT, managers and staff.
• 3. Score a maturity self-assessment of 12 practices from 0 to 4 and rank the gaps.
• 4. Place every person in a role-based literacy level.
• 5. Run an anonymous training-needs survey with a short knowledge pre-check.
• 6. Map a curriculum: a short core for everyone and modules by level, with minutes and owners.
• 7. Turn your acceptable-use policy into three to five quick rules and teach them through scenarios.
• 8. Deliver in formats that reach everyone: LMS, live, virtual, huddles, clinics.
• 9. Keep records: training record with content versions, attendance registers, an evidence register.
• 10. Measure behaviour at four levels, report at week 12 and plan the refresher.

What does AI literacy mean for different roles?

AI literacy is the skill, knowledge and understanding a person needs to use AI tools sensibly in their job: to get useful output, judge it, keep data where it belongs, notice harm to others and know when to stop and ask. The definition in the EU AI Act is similar: it talks about informed use and awareness of opportunities, risks and possible harm.

The key word is role. A receptionist who tidies a notice twice a month and an engineer connecting an AI tool to a claims system need very different things. Five levels work for most organisations: all staff, frequent users, managers, AI owners and approvers (people who sign off AI-assisted work that reaches clients), and technical staff. Each person sits in the highest level their role needs. Managers can place their people with four questions: do they configure or test AI tools; do they own or approve an AI-enabled process; do they manage people; do they use the approved assistant several times a week?

Smaller organisations can use three levels. A 45-person accountancy practice, for example, might use all staff, frequent users and partners who sign off client work, run the core as two lunchtime sessions and keep the record on one sheet.

Is AI literacy training a legal requirement?

In the European Union, yes in a specific sense. Article 4 of the AI Act asks providers and deployers of AI systems to take measures to support the AI literacy of their staff and of other people operating or using AI systems on their behalf, taking account of their knowledge, experience, education and training, the context of use and the people affected. The Digital Omnibus on AI, Regulation (EU) 2026/1744, rewrote the article in 2026 to make clear it does not require a guaranteed level of literacy for any individual. The European Commission's questions and answers say no certificate is needed and suggest an internal record of trainings. The Commission's AI Act Service Desk publishes the current text and timeline.

In the UK, the US, Canada, Australia and New Zealand there was no general AI literacy law at November 2026. That does not mean nobody expects it. The US NIST AI Risk Management Framework, which is voluntary, says personnel and partners should receive AI risk management training for their duties. Australia's Guidance for AI Adoption includes AI literacy and training among its practices, including training for anyone overseeing or using AI systems. Privacy regulators such as the UK ICO and the Australian OAIC publish guidance on personal data in AI tools; the OAIC recommends, as best practice, not entering personal information into publicly available generative AI tools. Clients ask in tender questionnaires too.

This article is general information, not legal advice. Laws in this area change often; check the official source and your adviser for your situation.

What should the core training for all staff cover?

Keep the core short and practical: two 45-minute sessions. The first covers what AI tools are and are not good at (a live demo that gets something wrong works well), the organisation's quick rules for tools and data, how to write a clear request, and how to report a mistake. The second practises one routine, stop, check, act, on six situations that cover most of the everyday risk.

Stop: is this data allowed in this tool, is this a decision about a person, is this an unusual request for money or data? Check: is every fact, figure, name and source real, is the wording fair, did it borrow someone else's work? Act: fix it, ask, or report it.

• Data leakage: a client's medical notes and a personal AI app on a phone.
• Made-up facts: a draft letter that cites a clause the policy does not have.
• Bias: an AI-written job advert asking for a 'young, energetic team'.
• Copyright and confidentiality: 'make ours like the competitor's brochure'.
• Deepfakes: an urgent video call from 'the finance director' asking for a payment.
• Over-trust: a meeting summary that records an agreement nobody made.

How do you measure whether AI literacy training worked?

Use four levels of evaluation, an approach credited to Donald Kirkpatrick: reaction (did people find it useful), learning (do they know and can they do it), behaviour (do they do it at work), and results (did anything change for the organisation). Most programmes stop at learning because the LMS reports quiz scores automatically. The risk sits in behaviour.

Three behaviour measures are cheap to collect. The share of AI web traffic going to tools that are not approved, which IT can usually report weekly. The number of near misses reported: a rising count early on means people know how and feel safe to report. And a short manager follow-up about 30 days after training, where each person shows how they checked a recent AI draft.

When most people miss the same quiz question, check the question before blaming the people. Unclear options are a common cause.

What does a worked example look like?

Take a fictional 600-person insurance broker in Manchester with a 40-person Dublin office, rolling out an approved AI assistant to everyone. Its survey found 31% of respondents had used a personal or unapproved AI tool for work and 11% had pasted client or personal data into one. It placed people in five levels and ran the 12-week plan. These are the numbers that came out of it; they illustrate the method and are not a benchmark.

• Learner hours: 236 x 1.5 + 260 x 3 + 72 x 2.75 + 14 x 5.75 + 18 x 5 = 1,502.5 hours.
• At a loaded cost of £31 an hour, that is £46,578 of staff time, by far the biggest cost line.
• The big drop in unapproved use came in week 4, when the approved assistant went live and personal accounts were blocked the same day; training is why it kept falling afterwards.

How do you make the business case?

Count time as well as cash. Learner hours from the curriculum map multiplied by a loaded hourly cost usually dwarf the cash budget. Then estimate the cost of doing nothing as ranges: a data breach from a personal AI tool, an unchecked output reaching a client, rework from poor prompts, AI-enabled payment fraud, licences paid for but unused. Put a low and high cost and a low and high chance in a year against each, and a modest share the programme might avoid.

Be honest when the low case does not pay back on avoided risk alone. In the worked example it did not; the case rested on a legal duty for the Dublin office, client expectations and the high-case upside, and the sponsor approved it because the memo said so plainly.

What are the common mistakes?

• One video for everyone, reported as a programme.
• Training before an approved tool exists, so people practise on personal accounts.
• Blocking personal AI before offering an approved option, which pushes use onto phones.
• Forgetting agency, temporary, part-time, shift and contract staff.
• Quiz questions about article numbers instead of judgement at work.
• Using quiz scores in appraisals, which kills honest reporting.
• No record of content versions, so you cannot say who learned which rule.
• Treating zero near misses as success.
• Claiming 'compliance' in client answers instead of describing what you did.
• No refresher plan while tools change every quarter.

How do you find the gaps before you train?

Use an eight-minute anonymous survey with four parts: role and use, four honest 'have you ever' habit questions, confidence ratings with a three-question knowledge check, and format and access needs. Report only in groups of ten or more and promise that no answer is used in performance reviews. Compare confidence with the quick check: a level with high confidence and low scores does not know what it does not know.

If you want an independent baseline, AssessAll's Artificial Intelligence Literacy Assessment for Employees in Every Role measures the same ground across roles. And because most learning happens at work rather than in a session, plan clinics, champions and follow-ups alongside the courses; Jobulary's explainer on the 70-20-10 model shows why.

The AI Literacy Programme Kit from Bodhih Training includes the survey, the workbook that turns results into gaps by level, three ready-to-run sessions and the records.