Do not train every part of a policy the same way. Sort each part by the worst that could happen if someone gets it wrong. Practise the serious parts in realistic situations. Explain and test the parts where a mistake can be put right. Ask people only to read and confirm the rest.
It takes minutes for a typical policy. You can try it on your own policy with our free planner before you spend anything. The reason it matters is in the 2026 figures: most organisations now have an AI policy, but far fewer have trained people to use AI safely.
Isn’t having the policy enough?
Writing the policy is the part most organisations have done.
- Riskonnect’s 2026 New Generation of Risk Report was published on 7 October 2026, from a survey of more than 250 risk, compliance and resilience professionals. It found that 72 percent of risk leaders now have a policy governing employee use of AI, up from 58 percent in 2025.
- In the same survey, just 46 percent said their organisation has trained employees on how to evaluate AI outputs.
- ISACA’s 2026 AI Pulse Poll was published on 5 May 2026, from more than 3,400 digital trust professionals. Of those surveyed, 33 percent said their organisations train all employees on AI. That is up from 22 percent in 2025, but it is still a third.
The usual way a policy reaches people is an email and a signature. A signature shows someone opened the document. It does not show they would get it right when a client is waiting and the deadline is today. The gap between having a policy and people following it is where most of the risk sits.
Step 1: List the parts of the policy
Use the policy’s own headings. Most policies have between six and twelve. Do not try to judge anything yet. Write each part down as the people who must follow it would recognise it, for example “Checking AI output before it leaves the firm” rather than “Section 5.2”.
Step 2: Ask one question of each part
For each part, ask: if someone gets this wrong, what is the worst that could happen? There are only three answers.
- Serious harm. A client, a person or the organisation is hurt, and it cannot easily be undone. Sending a client a figure that an AI tool got wrong is an example.
- A fixable mistake. A rule is broken, but it can be put right. Forgetting to note on the file that AI was used is an example.
- Low risk. People just need to know the part exists and where to find it. Definitions and contact details usually sit here.
The question works because it is about consequences, not about how long the section is or how much the author cared about it. A one-line clause about what must never be typed into an AI tool can matter more than three pages of definitions.
Step 3: Match each group to a way of training
| What happens if they get it wrong | How to train it | What you can keep as evidence |
|---|---|---|
| Serious harm | Practise with a scenario: a realistic work situation where they decide what to do and see what follows | The decision each person made |
| A fixable mistake | Explain and test: a short explanation in plain English, then a quick question | Their answer to the question |
| Low risk | Read and confirm: they open the policy, find what they need and confirm it | That they opened it and confirmed it |
The rule underneath the table is simple: the worse the mistake, the more practice it needs. Reading is fine for a phone number. It is not enough for a judgement call made under pressure.
A worked example: an AI use policy
Here is a typical firm’s AI use policy with eight parts, sorted with the question above.
| Part of the policy | Worst that could happen | How to train it |
|---|---|---|
| Purpose and scope | Low risk | Read and confirm |
| Definitions | Low risk | Read and confirm |
| Approved AI tools | A fixable mistake | Explain and test |
| What must never be typed into an AI tool | Serious harm | Practise with a scenario |
| Checking AI output before it leaves the firm | Serious harm | Practise with a scenario |
| Telling the client | A fixable mistake | Explain and test |
| Recording AI use on the file | A fixable mistake | Explain and test |
| Signing off work you did not write | Serious harm | Practise with a scenario |
The result is three scenarios, three short explanations with a check, and two parts to read. Every part has a place, so nothing is left out. Most of the training time goes where the risk is.
Try it on your own policy
We built a free planner that does this on screen. You type the headings of your policy and answer the one question for each part, and your plan builds as you go. It needs no sign-up. Nothing you type is saved or sent to us. It opens with two examples, an AI use policy and a code of professional conduct, so you can see how it works first.
Plan the training for your policy →
Frequently asked questions
Is asking staff to read and sign a policy enough?
For low-risk parts such as definitions and contacts, usually yes. For parts where a mistake causes serious harm, a signature shows they opened the policy, not that they would act on it. Those parts are better practised in a realistic situation.
Which parts of a policy need scenario training?
The parts where getting it wrong would cause serious harm that cannot easily be undone, and where people have to make a judgement rather than follow a fixed rule.
Can I plan this myself, without a training provider?
Yes. List the headings, ask the one question of each part, and sort them into three groups. Our free planner does the sorting on screen.
Does every part of a policy need a video?
No. Video is only one way to explain a part. Most parts need a short explanation or a read, and only the serious parts need a practised scenario. That keeps the training short.
What happens when the policy changes?
Sort the changed parts again with the same question, and train only those parts. People do not need to repeat the whole policy because one section moved.
What LearnFrame builds
LearnFrame, in Dublin, Ireland, turns policies and professional standards into short training for firms, professional bodies and training providers in Ireland, the United Kingdom, Europe and internationally. We follow the plan above. Realistic scenarios cover the serious parts, short explanations with a check cover the fixable ones, and the rest is read and confirmed. Your people open it in their browser, and you get a record of who has completed it.
You can try a scenario yourself in our free course, AI for Professional Practice, Module 1, at learnframe.com/ai-for-professional-practice.
Sources: Riskonnect, 2026 New Generation of Risk Report, press release 7 October 2026 (prnewswire.com). ISACA, 2026 AI Pulse Poll, press release 5 May 2026 (isaca.org). See more insights from LearnFrame.