the work
training
Three rules ask for training, and the AI Act adds its own. One small programme with one attendance record answers them all. The failure that shows up is having no record.
the reality
A weak slide is a smaller problem than no record. Keep the programme small, repeat it yearly and keep the sheet.
The AI literacy duty changed in July 2026 and now says it does not require guaranteeing a specific level for any individual. So a short session about your actual tools is a reasonable measure for a company of this size. The AI Act page has the rest.
basis NIS2 Art. 21(2)(g); AI Act Art. 4 as replaced by Regulation 2026/1744 Art. 1
what to decide
- Which AI tools are allowed, for what, and who to askboard, on a proposal from IT
- Who owns the programmeHR, with the head of IT
- When management trainschair
basis AI Act Art. 4 as replaced by Regulation 2026/1744 Art. 1; NIS2 Art. 20(2)
three audiences, one programme
basis NIS2 Art. 20(2), 21(2)(g); DORA Art. 13(6); AI Act Art. 4; KSC Art. 8e. The split by topic is practice.
what to build
- For everyone, 30 minutes a year (your choice): spotting phishing, reporting something odd, what data may go into an AI tool, who to call.
- For management, one session on their duties: approving, overseeing, what to ask.
- For admins, one session on what your own incidents and risk assessment turned up.
- Add your AI rules to the session. That is the core of your AI literacy measures.
- Keep the attendance list and the slides together, and chase people who missed it.
basis NIS2 Art. 21(2)(g); DORA Art. 13(6); GDPR Art. 39(1)(b); IR 2024/2690 Annex 8.1, 8.2 as a reference. Length and topics are practice.
the evidence it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| attendance record: name, date, session | HR | each session |
| the material as delivered, with version | head of IT | yearly |
| management training record | company secretary | yearly |
| written AI use rules | board | yearly |
basis KSC Art. 8e(3). The rest is practice.
one session, one sheet
- 1run the sessionshort, about your own tools and incidents
- 2take attendancename, date, session
- 3keep the materialwith its version
that sheet helps answer
- NIS2training, and management's own
- DORAcompulsory modules
- GDPRawareness of staff
- AI Actliteracy measures
basis NIS2 Art. 20(2), 21(2)(g); DORA Art. 13(6); GDPR Art. 39(1)(b); AI Act Art. 4
what goes wrong
training with no record
If there is no sheet, there is nothing to show. Keep it from the first session.
the board skips it
NIS2 names management specifically, and Poland makes it yearly and documented.
AI rules nobody wrote
Staff are already using these tools. Silence is a decision too.
basis NIS2 Art. 20(2); KSC Art. 8e(1), 8e(3)
what the texts leave open
- What counts as enough. No text sets hours or a syllabus, though DORA requires the modules to be compulsory, for all staff and senior management.
- Whether phishing test results belong in your evidence. They are useful for you, and they do not replace a record that training happened.
basis DORA Art. 13(6)
check it yourself
what each text says, for whoever checks this page
| text | says |
|---|---|
| NIS2 Art. 21(2)(g) | Basic cyber hygiene practices and cybersecurity training. |
| NIS2 Art. 20(2) | Management must follow training. Similar training for staff is encouraged. |
| IR 2024/2690 Annex 8.1 | Listed digital providers: awareness and hygiene. Annex 8.2 covers security training. |
| DORA Art. 13(6) | Awareness and resilience training are compulsory modules, for all employees and senior management. |
| GDPR Art. 39(1)(b) | The DPO monitors compliance, including awareness-raising and training of staff. |
| AI Act Art. 4 | Providers and deployers take measures to support AI literacy of staff using these systems. Wording replaced by Regulation 2026/1744 Art. 1. |
| KSC Art. 8e(1) | Poland: the head of the entity, and anyone given those duties, trains once a calendar year. |
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Regulation (EU) 2024/1689 (AI Act), original text (EUR-Lex)
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending the AI Act (EUR-Lex)
- Poland: Act of 23 January 2026 amending the national cybersecurity system act, Dz.U. 2026 poz. 252 (Dziennik Ustaw)
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Put a 30-minute session in the calendar for next month and create the attendance sheet today.