A policy can sit on the intranet while the real rule is whatever loads fastest. It names the approved tools and sets out what staff must keep out of them. Then a deadline arrives, the approved tool is slow, and a client file goes into a window nobody has vetted.
That gap is what a staff session has to close. Leaders can spend a day on an operating model. The person at the keyboard needs a shorter brief they can remember when they're tired and the work is late.
What the session has to make plain
NIST gives organisations a voluntary way to manage AI risk, and it now covers the risks that come with generative tools. I use that as the test for a staff booking. If the room never opens a generative tool someone already has on their desk, you have paid for a briefing about a document.
Our AI governance workshop runs a staff tier for this. It's a half day on everyday use. People practise what may go into a tool, what confidentiality requires and when an output should be distrusted. We build the session around your acceptable-use policy, the tools you have approved and the risk appetite you have already set. A generic slide on responsible use that never names your tools will leave the paste exactly where it was.
Rules staff can hold
A short list of questions covers most of the damage I see. What information is allowed in the tool. What must stay out, including client data, personal data and anything your policy already marks as sensitive. Who checks the output before it leaves the team. Write the answers in the language of the job. A claims handler and a recruiter need examples from their own files, or the rule stays abstract and the exception becomes the habit.
Shadow use is the point of the session, and it deserves a straight conversation. People reach for an unapproved tool when the approved one fails the task, or when they're unsure the approved one is allowed to see the work. A ban that leaves the path broken sends the work underground. The session should show the approved path on a real task, and it should name who to ask when the rule doesn't cover the case in front of them.
How this sits with the leadership day
Staff literacy and leadership governance are different jobs, and most large organisations need both. Leaders who classify risk, assign an owner and approve use cases need AI governance training for leaders. A board choosing its own session should read how a board chooses an AI governance workshop. A squad about to let a system send or decide needs AI governance for non-lawyers.
Buying the staff half day and treating it as the whole programme leaves the approval question open. Buying only the leadership day leaves the paste untouched. We can run either tier on its own. The useful booking names which gap you're closing this month.
What to check afterwards
Once the session has had time to meet a real deadline, ask a sample of the people who attended to walk you through the last time they used a tool. What did they put in. What did they refuse to put in. Who looked at the output. If they can answer from a real piece of work, the training landed. If they can only recite the policy headings, it didn't.
If you want the staff tier, tell me which tools are approved, what your current policy already says and which teams are using AI whether you have blessed it or not. We will shape the half day around those facts.
