One company, many AI worlds

Even within a single medium-sized company, people with completely different points of contact with AI sit side by side. What is the central issue for one role simply does not arise in another. A training course that tells everyone the same thing therefore fails to address the issues relevant to most people.

Let’s look at just how different the issues actually are.

Just how different the questions really are

• Personnel and HR. Job applications, employee data and job advertisements. AI systems used to evaluate or shortlist applications may be classified as high-risk. What matters is the system’s intended purpose and what it actually does.
• Marketing. AI-generated text and images are part of everyday work. One important question is disclosure: specific transparency obligations apply to deepfakes and certain AI-generated texts intended to inform the public. Which obligation applies depends on the content and its use. Applicant data is usually less central here, but can play a role in recruitment marketing.
• Sales. Quotes, customer emails, data from the CRM. The key question is: which customer data can be used in which tool – and which is best avoided?
• Accounting and finance. Figures, contracts and confidential business data. Confidentiality is a central concern; image labelling plays a smaller part in typical day-to-day work.
• Customer service. Chatbots and draft responses. People should generally be told when they are interacting with an AI chatbot, unless this is already obvious. Transparency in direct customer contact is the central concern.
• IT. Manages tools, access and security. Its questions concern both technology and content: what may a tool process, how are outputs checked and who can access what?
• management. Uses AI for research, initial drafts and strategic work – often with the most confidential documents in the entire organisation.

Seven roles, seven priorities. What is central to one is not even a peripheral issue for another.

Why ‘a bit of everything for everyone’ helps no one

Generic training tries to cover every topic for everyone. People end up overloaded with irrelevant information while their real questions get lost. The accountant needs different priorities from the marketing colleague. Shared foundations remain important. But giving every role every detail can make it harder to focus on what each person needs in practice.

Department-specific training is therefore the opposite of information overload: everyone learns what actually happens in their own day-to-day work – concise, relevant, practical. This saves time and, at the same time, ensures that what has been learnt actually sticks, because it is linked to real tasks.

The role changes – the person remains

One point is particularly important to me here, especially in small and medium-sized enterprises: there, one person often wears several hats. The administrative assistant does the bookkeeping and Customer Service. The Managing Director takes care of Marketing on the side. The sales representative steps in to help with support.

A department-specific approach must therefore not mean pigeonholing someone. It means: everyone receives exactly the building blocks that match their actual tasks – including several, if someone fulfils multiple roles. It is not the job title that matters, but what the person actually does.

Industry and department together ensure precision

This brings us full circle to the industry. The industry determines what the company fundamentally deals with; the department determines what the individual does on a day-to-day basis. Only when both are right – the ‘what’ of the company and the ‘how’ of the role – does compulsory training become something that sticks in the mind and helps at the right moment.

Generic training is quickly completed. Targeted training is effective – because it meets each person exactly where they actually are.

That is why employees using the EU AI Act Academy are assigned modules that match their actual tasks, including several where someone has more than one role. Everyone learns what their daily work requires, rather than what is irrelevant to it.

The same action, completely different implications

Let’s take a very specific scenario: an employee copies a text into an AI tool to have it summarised. Harmless? That depends on the sector she works in.

In a tax consultancy, the same click could be sensitive: it may involve client data and professional confidentiality. A supplier’s quotation in the workshop next door might be less sensitive. That does not automatically make it unproblematic: it may contain confidential prices or personal information. The content and the tool approved for it are what matter. In a care setting, the information could be particularly sensitive, as health data is among the most strongly protected information.

One action. Three sectors. Three completely different risk scenarios. This is precisely where it becomes clear why training ‘for everyone’ so often comes to nothing in practice.

Where the sector decides on the actual issues

In my work with companies from a wide range of sectors, I see time and again that every sector has its own key issue when it comes to AI. Here are a few examples of just how different the priorities are:

• Law firms, tax consultancy firms, doctors’ practices. Here, everything revolves around professional secrecy. The crucial question is which confidential client or patient data is even permitted to come into contact with an AI tool – and which is never allowed to.
• Marketing and the creative industries. AI-generated text and images are part of everyday work. Disclosure is therefore an important question. Specific transparency obligations apply to deepfakes and certain AI-generated texts intended to inform the public. Not every AI-assisted draft automatically falls within these rules.
• Recruitment and staffing services. AI systems used to evaluate or shortlist applications may be classified as high-risk. Their purpose, operation and the allocation of responsibility need particular care.
• Financial services. The situation becomes similarly sensitive when AI is involved in credit checks. This, too, is a strictly regulated use case, not an everyday tool like any other.
• Skilled trades and production. AI can make quotations, materials lists and documentation easier to prepare. Confidential data still needs protection and results must be checked, especially where errors could affect safety.
• Retail and services. Where AI chatbots interact with customers, transparency and data protection matter. People should generally be told that they are communicating with AI, unless this is already obvious.

The message behind this is simple: training that says the same thing to everyone says too little to most people – and the wrong thing to some. A roofer isn’t interested in a law firm’s client confidentiality, and an agency’s image labelling is of no help to a care worker.

Why generic training fails to resonate

There is a simple pedagogical reason why industry-specific relevance makes such a difference: people learn from situations they are familiar with. If an example comes from an unfamiliar working environment, people nod politely – but do not apply it to their own everyday lives.

‘Industry-specific’ therefore means that the examples and borderline cases come from the learners’ own lived experience. The care worker hears a care-related case, the tradesperson one from their own trade, and the tax clerk one from the firm. Only then does the crucial moment arise: ‘Ah, that’s exactly my kind of case.’ And it is precisely this moment that sticks in the mind.

But the industry is only half the battle

As important as the sector is – it’s not enough on its own. Because even within the same company, not everyone uses AI in the same way. The colleague in Marketing faces completely different questions to the accountant in the next office, even though both work in the same sector.

Sector and department are therefore intertwined. The sector determines what a company fundamentally deals with. The department determines what the individual actually does in their day-to-day work. Only when both are combined does training become truly effective – but that’s a topic in its own right.

Industry-specific focus is not a luxury, but a prerequisite

Anyone who takes AI training seriously cannot ignore the industry. It determines whether the content is perceived as an abstract compulsory exercise or as something that is tangibly relevant to one’s own working day. Generic training is quick to deliver – but rarely understood.

That is precisely why the content of the EU AI Act Academy is tailored to specific sectors: everyone is given examples and borderline cases that actually occur in their own day-to-day work – rather than training that is supposed to suit everyone and therefore doesn’t quite suit anyone.

A policy is a start, not a solution

Of course, internal guidelines are important. Without them, there is no benchmark. But there is a greater gap than one might think between ‘there is a policy’ and ‘people act in accordance with it’.

For an AI policy to be effective in day-to-day practice, employees need to be able to do four things – and these build on one another:

• Know the rules. It sounds trivial, but it isn’t. A policy that was sent out once by email and then filed away on the intranet is hardly remembered by anyone after three months.
• Understand the rules. Knowing isn’t the same as understanding. ‘No personal data in public tools’ is easy enough to write. But is an email with the sender’s name already considered personal data? Is an anonymised customer quote acceptable? Anyone who has merely read the rule but hasn’t fully grasped it will be at a loss when faced with the first borderline case.
• Recognising typical borderline cases. Everyday life rarely consists of clear-cut cases. It consists of ‘it depends’. It is precisely these grey areas that determine whether a policy is helpful or merely a piece of paper.
• Remaining capable of taking action. Ultimately, someone has to make a decision at a specific moment – usually under time pressure, without having the policy to hand.

When policy and practice diverge, a scandal rarely ensues. Something quieter, but just as delicate, happens: uncertainty, evasive behaviour, unspoken habits. When in doubt, someone pulls out their private mobile phone with their private AI account – and suddenly, usage takes place entirely outside the scope of any rules.

That is why good AI governance is not just a matter of documents. It is just as much a matter of comprehensibility.

Many training courses fail not because of their content, but because of their format

This brings us to the crux of the matter. If understanding determines success or failure, then the way the material is delivered is not a side issue – it is the crux of the matter.

Most of us are familiar with this: compulsory training as a series of slides to click through. Forty slides you click through whilst your inbox flashes in the background. At the end, a test where you’re more likely to guess the answers than actually know them. Ticked off. What sticks isn’t knowledge, but a tick on a list.

When it comes to AI, this format is particularly disastrous. Because this isn’t about rigid rules that you learn once and then apply. It’s about exercising judgement in unclear situations.

What companies need instead is something different:

• Clear categorisation rather than an information overload – what’s really important, and what’s just detail.
• Plain language instead of legal jargon that nobody outside Legal / Compliance would voluntarily read.
• Everyday examples instead of abstract principles.
• Recognisable situations – scenarios in which someone recognises themselves: ‘Ah, I do that too.’
• Comprehensible standards, which you can remember because they make sense – not because you’ve learnt them by heart.

Because AI isn’t about memorising terms. Nobody needs to be able to recite the wording of a legal provision. It’s about making better decisions at the right moment – for example, the split second when someone is about to post a deceptively realistic AI image on LinkedIn and pauses briefly: “Should I actually label this?”

The real risk isn’t intent, but routine

This is the point that is most frequently underestimated in the discussion. When people talk about the risks of AI, many think of malicious behaviour. In fact, the risk is much more mundane – and precisely for that reason, greater: it is routine.

Employees turn to whatever helps them. The assistant uses the tool to quickly summarise the lengthy meeting minutes. The Sales team feeds the draft quotation into the tool. This is understandable – and in many cases, exactly what we want. Nobody wants employees who shy away from tools that make their work easier.

That is precisely why it is not enough to rely on reason alone. Reason is there. But reason does not make decisions in the heat of the moment – habit does. Companies need a framework that does not work against everyday life, but with it:

• Simple enough to actually be used – not a hurdle to be circumvented.
• Clear enough to provide guidance in a specific situation.
• Concrete enough, to reduce uncertainty rather than create new uncertainty.

The key point is this: when the safe route is unclear and the quick route is obvious, everyday life makes the decision for itself – and almost always in favour of the quick route. This is not a question of character or good will. It is a question of design. If you want people to take the safe route, you must make it the easy route.

Governance is not decided in a filing cabinet

This brings us full circle. An AI directive is a good start – but it does not take effect in a filing cabinet, but in the mind of the person currently faced with a decision. Whether this succeeds depends less on the document itself than on whether the rules have been understood, whether they can be applied to real-life situations, and whether the safe path is also the convenient one in everyday life.

Good governance is therefore, ultimately, not just a matter of paperwork. It is a question of clarity. And that is precisely where it is decided whether good intentions are turned into everyday practice.

This is what the EU AI Act Academy aims to achieve: clear training with everyday examples that helps employees act at the right moment and supports companies in keeping a clear record of their training measures.

The blind spot lies not in the content, but in the organisation

management and HR rarely underestimate the substance of AI. Word has got round that it is relevant. What is often missing is the transition from general understanding to robust internal practice – and this fails not because of a lack of knowledge, but because of unresolved organisational issues:

• Who sets the standards?
• How are employees trained?
• How are changes communicated?
• How is knowledge kept up to date?
• How can we track who has already completed what?

No tool can answer any of these questions. They concern responsibility, process and communication. A company may have the best AI tool and the smartest guidelines – but if no one is in charge, no one provides training and no one knows who is at what stage, it remains a patchwork affair.

This is precisely where a technological issue becomes a leadership task.

A first, clear version is better than the perfect solution

The good news for any manager who senses the effort involved here: there’s no need for a fundamental debate about AI. What’s needed is a first, clear version. Not perfect – but clear.

A good start often consists of just a few, but solid, building blocks:

• Internal guidelines – what applies in our organisation, in simple terms.
• Clear communication – explained in such a way that the message gets through, not just filed away.
• Practical training – based on real-life situations, not on legal clauses.
• Consistent standards – so that not every department does things differently.
• Transparent documentation – so that what has happened can be verified later.

The mistake is waiting for the perfect solution. Because whilst the ideal AI strategy is maturing in workshops and coordination loops, staff have long since carried on working as best they can – each in their own way. Every month without a framework is a month in which haphazard habits become entrenched. A perfect solution in twelve months is ultimately worse than a solid one in four weeks

It’s a bit like house rules: you don’t wait until you have a legally watertight version running to thirty pages. You put up the clear ground rules – and refine them over time.

Structure beats perfection – especially at the start.

Guidance works better than bans

A common mistake in AI communication: too many bans, too little guidance. When companies focus solely on setting boundaries when it comes to AI, good practice rarely emerges. Instead, uncertainty tends to arise.

People work better with clear dos and don’ts than with abstract warnings. What employees need are answers to specific questions: What’s okay? What’s sensitive? What internal procedures are in place? And what should I do if in doubt? A list of prohibitions alone answers none of these – it merely prompts the question: “What am I actually allowed to do then?”

This is the point that is often overlooked: A ban without a clearly indicated safe path either paralyses people or is circumvented. Anyone who only hears ‘Caution: dangerous’ will either do nothing at all – thereby squandering potential productivity gains – or carry on secretly, beyond any control. Nobody wants either of these outcomes. Permission with clear boundaries, on the other hand, sets people free: it shows the way forward and clears the mind so they can get on with their work.

Good compliance communication takes the pressure off. Poor communication complicates matters.

Evidence needs to be factored in from the outset

When it comes to AI, evidence is often considered too late. Many companies start by discussing usage, tools and rules. That’s understandable – but it’s not enough. Just as important is the question of how internal standards can be verified later on:

• Who has been trained?
• To what standard?
• Based on what content?
• How are changes addressed?

The moment when it really matters is rarely a quiet day in the office. It’s during an audit, a dispute or a claim. When the question then arises as to whether staff have been trained, a vague memory is worthless. What counts is the verifiable status: who, when, and on what basis.

AI brings an additional consideration: the field changes quickly. A record of earlier training remains evidence of what was taught at the time. It does not automatically show that later changes have been understood. When relevant content changes, suitable refresher training is needed, together with a separate record of that training. With fast-moving subjects, keeping knowledge current is part of good organisation.

AI does not organise itself – it is organised

All of this – setting standards, daring to launch an initial version, providing guidance rather than imposing bans, and planning how training will be documented – is not the IT department’s responsibility. It is a leadership task. AI within a company does not organise itself; it is organised. And that is the real good news: it is in the hands of leadership.

This does not require a major project, but rather the decision to get started – cleanly, clearly, and in the knowledge that the first version will not be the last. Three sentences to bear in mind: Structure beats perfection. Guidance beats prohibition. Verifiability beats memory.

This is what the EU AI Act Academy is designed for: practical training, understandable company rules and content updated when relevant things change. Companies manage their own tests and training records. Refresher training is documented separately, so it remains clear what each person completed and when.

The underestimated advantage: proximity to the practical side of things

When it comes to AI, SMEs have something that is in short supply in large corporations:

• Short decision-making paths.
• Direct coordination.
• Fewer corporate layers.
• Faster implementation.

A comparison illustrates what this means in practice. In a large corporation, an AI policy passes through several committees and rounds of consultation, often ending up as a lengthy document that hardly anyone reads. In an SME, the management and HR can clarify the rules in a single afternoon – and inform the workforce on Monday. This speed is worth a great deal.

But – and here’s the catch – it’s only an advantage if it results in clear standards and practical training. Short lines of communication that nobody uses remain untapped potential.

The key point is this: not every company needs a complex AI governance programme straight away. But every company benefits from clear internal rules that work in day-to-day operations. SMEs, in particular, do not need the cumbersome corporate machinery – but rather a lean, clear version. And that is precisely what they can build more quickly than any large corporation.

AI is not purely an IT issue

A common misconception stands in the way of this: AI in business is often treated as an IT issue. It then ends up with the IT department – which deals with tools, access and security. All of these are important. But none of the human questions are answered by this alone.

Because AI touches on far more than just technology: leadership, HR, communication, data protection, responsibilities and a culture of learning. Who is allowed to do what? How do we talk about it? What does the team learn, and who keeps them up to date? These questions aren’t found in the server room – they lie with leadership and HR. That’s why purely technical answers usually fall short.

The real challenge isn’t just which tools are used. It’s how a company creates a framework in which this use becomes transparent, understandable and internally sustainable.

Where AI becomes part of everyday life, organisation becomes the key issue.

Not noise, but clarity

When it comes to AI, companies don’t need noise. They need clarity.

Noise is the big kick-off event, the strategy paper full of buzzwords, the announcement ‘We’re now going AI-first’. That generates attention – but no direction. Clarity is quieter and more unassuming. It answers the questions that really arise in day-to-day life:

• What are our internal guidelines?
• How can staff make more confident decisions?
• Which standards provide guidance?
• And how can knowledge be not just shared, but truly understood?

That sounds unspectacular. Yet it is often precisely the difference between haphazard use and robust practice. Three straightforward rules that everyone knows, and a clear point of contact, are more effective in day-to-day life than any glossy initiative.

More than efficiency: a question of organisational responsibility

One final misconception remains: viewing AI solely as an efficiency issue. Of course, productivity is also a factor – efficiency is the reason why AI is spreading so rapidly in the first place. But that is not the whole story..

For as its use grows, so does the responsibility. It is equally about:

• Roles
• Responsibilities
• Communication channels
• Training
• transparent internal standards

These are not questions of efficiency, but of organisation. And they do not disappear if you ignore them – they simply resurface later and in a more uncontrolled manner. So anyone who views AI solely in terms of time saved is overlooking half the picture.

This is precisely why the use of AI in business is no longer just a short-term trend. It is part of modern organisational responsibility.

The advantage is there for the taking – you just have to make use of it

This brings us full circle. The topic begins with the realisation that AI has long since become part of everyday life – and ends with the recognition that its orderly use is part of responsible leadership. There is nothing spectacular in between. Just the willingness to create clarity before disorder takes hold.

SMEs are better positioned for precisely this approach than they often realise: short lines of communication, quick decisions, and a close connection to practical operations. The advantage is there for the taking. You just have to make use of it.

This is exactly what the EU AI Act Academy is designed for: not a corporate programme, but accessible training and clear standards that actually work in the day-to-day operations of SMEs – quickly implemented, transparently documented and kept up to date.