In short: AI training for employees teaches staff to use generative AI tools safely: stick to approved tools and work accounts, never paste in personal data, client information, credentials or confidential plans, check every output before relying on it, and be open about AI use. It sits alongside an AI acceptable use policy and technical controls.
Why safe use of AI needs its own training
Generative AI tools are easy to reach and genuinely useful, which is exactly why staff use them without asking. The risks are different from phishing and malware, and most of them come from good intentions:
- Data leakage: pasting a client contract, a spreadsheet of customer details or internal financials into a consumer chatbot
- Shadow AI: using personal accounts or unapproved browser extensions and apps the organisation knows nothing about
- Wrong answers: confident, plausible text that is inaccurate, out of date or invented, including made-up references
- Over-sharing inside the organisation: AI assistants that can search everything a user has access to may surface files that were shared too widely
- Rights and confidentiality: uploading material you do not have permission to share
This page is about staff using AI. Attacks that use AI against your staff, such as voice clones and deepfake video calls, are covered on our AI phishing and deepfake awareness page.
What not to paste into an AI tool
The simplest rule to teach is: if you would not post it publicly or email it to a stranger, do not paste it into an unapproved AI tool. Information entered into a public AI service is visible to the provider and may be stored or used to improve the service, depending on its terms and your account settings.
| Never paste into unapproved tools | Usually fine |
|---|---|
| Personal data about customers, patients, pupils or staff | Public information and published material |
| Client or commercially confidential documents | Your own draft wording with names and details removed |
| Passwords, API keys, access tokens or system configuration | General questions about how to do something |
| Unreleased financial results, deal or merger information | Brainstorming headings or structure for a document |
| Source code your organisation has not approved for sharing | Rewording text that is already public |
Even with an approved, enterprise AI tool, the organisation's data protection and confidentiality rules still apply. Under UK GDPR, putting personal data into an AI tool is processing like any other, so it needs a lawful basis and appropriate safeguards. Our GDPR training for staff covers the basics. This is not legal advice.
Checking outputs and being open about AI use
AI output is a first draft, not a fact. Staff should be trained to:
- Check facts, figures and references against a trustworthy source before using them.
- Read it all before sending: tone, names and details can be wrong or inappropriate.
- Keep a human decision on anything that affects people, money, safety or legal obligations.
- Be open about AI use where your policy requires it, for example in client deliverables.
- Report problems, such as an AI tool producing something inappropriate or exposing information it should not.
AI meeting notetakers deserve a specific mention. The NCSC's guidance on securing online meetings says to be aware of AI attendees that may record, transcribe or analyse meeting content, to understand what data they collect and how it is used, and to know where recordings and transcripts are stored. On top of that, we recommend staff only use approved notetakers, tell attendees when one is in use, and remember that transcripts may contain sensitive information.
Approved tools and an AI acceptable use policy
Training works only when staff know what they are allowed to use. A short AI acceptable use policy should set out:
- Which AI tools are approved, and that staff must use their work account, not a personal one
- What information can and cannot be used with each tool
- Who approves new AI tools, browser extensions and plug-ins
- Rules for checking and disclosing AI-generated content
- How to report a mistake or a concern
Policy acknowledgement tools such as usecure uPolicy can record that each person has read and accepted it. If you use AI assistants that search your own documents, it is also worth reviewing sharing permissions first, so the assistant cannot surface files that should never have been widely shared.
Platforms with AI-focused training and controls
Several of the vendors we supply have added AI-specific material. Two examples:
| Vendor | What it offers |
|---|---|
| Breach Secure Now | An AI Adoption Suite, sold only through IT providers, with AI training courses (including AI cyber security and AI fundamentals), an AI acceptable use policy template, an AI readiness assessment and the AI Risk to Adoption Program, a structured engagement guided by your IT provider |
| Acronis | Alongside its security awareness training, Acronis GenAI Protection, a separately licensed service on the Acronis platform that discovers browser-based generative AI tools in use, inspects prompts and blocks sensitive data such as personal information from being sent to AI tools |
Technical controls complement training. A CASB (cloud access security broker) or secure web gateway can show which AI services staff use and enforce policy on them. See the vendors hub for the full list of platforms.
How we help
We help you write a practical AI acceptable use policy, add a short safe-use-of-AI module to your security awareness training programme, collect policy sign-off and review the controls that spot shadow AI and prevent data leaving through prompts.
Contact us to add safe use of AI training for your employees.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What should employees not put into ChatGPT or other AI tools?
Personal data, client or commercially confidential documents, passwords and keys, unreleased financial or deal information, and source code that has not been approved for sharing. If you would not publish it or send it to a stranger, do not paste it into an unapproved AI tool.
Do we need an AI acceptable use policy?
Yes, if staff use or might use generative AI, which in most organisations they already do. A short policy listing approved tools, what data may be used, who approves new tools and how to report problems gives training something concrete to teach.
Does UK GDPR apply to using AI tools?
Yes. Entering personal data into an AI tool is processing under UK GDPR, so you need a lawful basis, transparency and appropriate safeguards, and you should check the provider's terms. This is general information, not legal advice.
How is safe use of AI training different from deepfake training?
Safe use of AI training is about how your own staff use AI tools responsibly. Deepfake and AI phishing awareness is about recognising attacks that use AI against them, such as cloned voices or fake video calls asking for payments.
Can we stop staff using unapproved AI tools?
You can reduce it with clear policy, approved alternatives that meet people's needs, and technical controls such as a CASB, secure web gateway or AI-specific data protection add-on that can monitor and block unapproved services.