AI training for employees: how to use AI safely at work

From a security perspective, AI training for employees teaches three things: what not to paste into AI tools, which account and tool to use, and how to check what the AI says. Writing better prompts is a separate topic. Here the point is for ChatGPT, Copilot or Gemini to help with work, not to carry contracts, customer data and code out of the company. Below you will find what to include in such training, what to put in an AI policy and how to practise it with your team.

Why training in safe use of AI is needed

Employees use AI whether the company has planned for it or not. In its DBIR 2026, Verizon writes that 45% of employees are regular users of AI (approved or not) on work devices. A year earlier the figure was 15%. Using unapproved AI tools, known as shadow AI, has become the third most common non-malicious employee action detected by data loss prevention systems.

45%

of employees regularly use AI on work devices (15% a year earlier)

Verizon, DBIR 2026

67%

of users of unauthorised AI tools log in on work equipment with a non-corporate account

Verizon, DBIR 2026

3rd place

for shadow AI among non-malicious employee actions detected by DLP systems, with a fourfold year-on-year increase in share

Verizon, DBIR 2026

Banning everything usually ends with people doing the same thing quietly on a private phone. It is better to show how to use AI without harming the company and its customers.

AI literacy in the AI Act (Art. 4)

Article 4 of Regulation (EU) 2024/1689, the AI Act, concerns AI literacy. This article has applied since 2 February 2025, because Article 113 provides that Chapters I and II apply from that date.

The wording of Art. 4 was amended by Regulation (EU) 2026/1744, the so-called Digital Omnibus on AI, published on 24 July 2026 and in force from the third day after publication. The provision now says that providers and deployers of AI systems take measures that support the development of AI literacy among their staff and other persons dealing with the operation of AI systems on their behalf. In doing so, they take into account the knowledge, experience and education of those persons and the context in which the AI is used. The new wording adds that this obligation does not mean that a specific level of literacy has to be ensured for each person.

Who does this apply to? Under Art. 3(4), a "deployer" is a person or organisation that uses an AI system under its authority, except in the course of a personal, non-professional activity. In practice, a company that allows employees to use AI tools at work is a deployer. In its answers to questions about AI literacy, the European Commission explains that if employees use ChatGPT, for example, to write advertising copy or translations, the company should inform them about specific risks such as hallucinations. The Commission adds that no certificate is required, and the organisation can keep an internal record of training and other activities.

Is ChatGPT safe to use at work?

It depends on three things you can influence.

1. Type of account. Business versions of AI tools usually have different data processing terms from free private accounts. Exactly what they are is checked by the IT or legal department in the contract and the provider's current policy. An employee does not need to know the details, but should know which account to use.
2. Settings. Some tools let you, for example, turn off chat history or the use of content to train the model. The company should decide which options are required.
3. What you paste in. Even the best-configured tool does not change the fact that the data leaves your computer. If content should not go to an outside company, it should not go into a chat either.

So ChatGPT is neither "safe" nor "unsafe" in itself. What is safe is the way it is used: an approved tool, a company account, the right settings and data that can be shared externally. The same applies to Copilot, Gemini and any other assistant.

What data should not go into AI tools

This list is the core of the training. Employees should know it as well as the rule that you never give anyone your password.

A good everyday rule: imagine you are emailing this text to an outside company. If you are not allowed to send that email, you are not allowed to paste the text into a chat either.

Also show how to rework a task safely. Instead of pasting a whole contract with the names of the parties, you can describe the problem in general terms: "How should a clause on contractual penalties for late delivery be worded?". Instead of a real table of customer data, you can give a few rows with made-up values and ask for a formula.

Shadow AI: private accounts and unapproved tools

Shadow AI means using AI tools the company has not approved, or private accounts in approved tools. The Verizon DBIR 2026 shows the scale: 67% of users of unauthorised generative AI services use non-corporate accounts on work equipment. The most frequently submitted type of data was source code, followed by images and structured data. In 3.2% of DLP policy violations, research and technical documentation was sent to such tools.

Shadow AI is a special case of a broader phenomenon, shadow IT, which we write about in our article on shadow IT as an attack surface. On the technical side, DLP systems help (what a DLP system is), as do tools for controlling data sent to AI tools. Technology cannot, however, replace an employee who understands why the company account matters.

In training, a clear message is enough: which tools we use, how we log in to them and who to contact when we need a new tool. If the approval process takes months, people will choose a private account.

Risks employees need to understand

Data leaks

This is the risk described above: data pasted into an external tool is no longer under the company's control. In its Top 10 for LLM Applications 2025, OWASP places sensitive information disclosure (LLM02) second on the list.

Hallucinations and verifying output

Language models can state with complete confidence a provision that does not exist, an invented source or a wrong figure. OWASP describes this as misinformation (LLM09), and the European Commission lists hallucinations as an example of a risk employees must be informed about.

The rule for the team: AI prepares the draft, a person is responsible for the result. You check every provision, figure, quotation and name against the source before the text goes to a customer, a public authority or the board. The more serious the decision, the more thorough the check.

Prompt injection: hidden instructions in documents and emails

Prompt injection is when someone smuggles an instruction into the model that the user did not give. OWASP puts it first on its list (LLM01:2025) and distinguishes two variants. Direct: an instruction typed into the chat window. Indirect: the model takes in content from external sources, such as websites or files, and content hidden in them changes its behaviour.

For employees, the second variant is the important one. You ask an AI assistant to summarise an email from an unknown sender, and the content contains a hidden sentence, in white font for example, with an instruction for the model. The assistant may then give a false summary, recommend clicking a link or, if it has access to the mailbox or files, carry out an action nobody asked for. That is why you should treat documents from untrusted sources with the same caution in AI as without it, and report suspicious assistant behaviour just as you would a suspicious email.

Deepfakes and AI-written phishing

AI also helps attackers: phishing without language errors and a cloned voice of a manager are real scenarios today. We write more about recognising such attacks in our article what is a deepfake, and about the mechanisms of manipulation in our article on social engineering.

Company AI policy: what to include

An AI policy should fit on one or two pages. Employees should read it and remember it, not file it away in a binder. Include:

• a list of approved AI tools and the requirement to log in with a company account,
• categories of data that must not be pasted (you can use the table in this article),
• required settings, for example for chat history and model training,
• the verification rule: who is responsible for content prepared with the help of AI,
• when the recipient must be told that a text was produced with the help of AI,
• how to request a new tool and who approves it,
• how to report an incident, such as accidentally pasting customer data,
• how the company trains employees and how it documents this.

For public entities, this topic also has a statutory dimension. In Annex 4, which concerns important entities that are public entities, the amended Polish National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, KSC; Dz.U. 2026 poz. 252) lists, among the additional measures, setting rules for the use of publicly available large generative AI models. You can read more about training obligations in our articles on NIS2 and KSC training and on training for local government.

How to practise safe use of AI with your team

In our article on cyber hygiene at work we suggest an exercise sorting prompts into "allowed" and "not allowed". Below are four more that go a step further.

1. Slimming down a prompt

Give the team three realistic tasks involving data, such as "summarise this customer complaint", "fix the formula in this payroll spreadsheet", "translate this extract from a contract". The task is to rewrite each prompt so that the AI can still help, but without data that should not leave the company. Compare the versions: it usually turns out that most of the details were not needed.

2. Find the hallucination

Prepare a text generated by AI, such as a note on regulations or a report summary, and introduce three errors into it: a wrong article number, a made-up figure, a non-existent source. The team has 15 minutes to check the text against the sources. At the end, discuss which errors were hardest to catch and why.

3. The hidden instruction

An exercise for IT together with the team. In a safe test environment, prepare a document with an invisible sentence addressed to the model, for example an instruction to add a link to the summary. Ask the AI assistant for a summary and show the result on screen. Those five minutes stay in people's memory longer than a definition of prompt injection.

4. Check your account

A short task to start the meeting: everyone opens the AI tool they use at work and checks which account they are logged in with and how their chat history is set. Collect the results anonymously. You will get a quick picture of the scale of shadow AI in the team and a starting point for discussion.

It is a good idea to repeat these exercises after a few months, because the tools and their features change quickly.

How it works in Akademia ZeroLayer

"Safe use of AI" is one of the training topics in Akademia ZeroLayer. Employees complete it in the form of video microlessons, games and quizzes, and automatic reminders help the knowledge stick. New starters get the basics in an onboarding path, and role-based paths let you tailor the material to each department. On completion, the employee receives a numbered certificate.

The manager dashboard shows team progress and generates training reports. Such training and its documentation can be part of how a company demonstrates that it has taken measures to support AI literacy. You will find the full list of topics in the training topics section, and the option of a free 30-day pilot for one department in the Options section.

FAQ

Is AI training for employees mandatory?

Art. 4 of the AI Act requires providers and deployers of AI systems to take measures that support AI literacy among their staff. The provision does not impose a specific form, and since the amendment introduced by Regulation (EU) 2026/1744 it states explicitly that a specific level of literacy does not have to be ensured for each person. Training is the simplest way to take such measures and document them.

Is ChatGPT safe to use at work?

It depends on the type of account, the settings and what you paste in. Use the tool and account approved by the company, apply the required settings and do not paste personal data, passwords, contracts, code or internal information. Check every answer that goes any further against the sources.

Is a certificate needed to comply with Art. 4 of the AI Act?

No. In its answers to questions about AI literacy, the European Commission states that a certificate is not required, and the organisation can keep an internal record of training and other activities. A course completion certificate can be one element of that documentation.

What should a company AI policy contain?

A list of approved tools, the requirement to use a company account, prohibited data categories, required settings, the rule for verifying output, how to request new tools and report incidents, and a description of training. Ideally it should fit on one or two pages.

What is shadow AI?

Shadow AI is employees' use of AI tools the company has not approved, often through private accounts. According to the Verizon DBIR 2026, it is the third most common non-malicious employee action detected by DLP systems.

Sources

• Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act) — Official Journal of the EU, 12 July 2024
• Regulation (EU) 2026/1744 of the European Parliament and of the Council (Digital Omnibus on AI) — Official Journal of the EU, 24 July 2026
• AI Literacy: Questions & Answers — European Commission, updated 20 October 2026
• 2026 Data Breach Investigations Report: Executive Summary — Verizon Business, 2026
• Breach entry point, 2026 DBIR finds (press release) — Verizon, 19 May 2026
• LLM01:2025 Prompt Injection — OWASP GenAI Security Project, 2025
• Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts (Ustawa z dnia 23 stycznia 2026 r. o zmianie ustawy o krajowym systemie cyberbezpieczeństwa oraz niektórych innych ustaw, Dz.U. 2026 poz. 252) — Journal of Laws of the Republic of Poland (Dziennik Ustaw), 2 March 2026 (in Polish)