Yes for one part of it, no for the other. Make the short safe-use module mandatory, because it is a control you can evidence and the legal floor under it is rising. Keep the fluency work invited, because the published evidence says a completion deadline buys you completions and not competence.
Most of the argument about this question goes nowhere because “AI training” names two unrelated things. One is a risk control: knowing what must never be pasted into a chat assistant, how to check output before it reaches a client, which tools are sanctioned, and who to call when something goes wrong. The other is a capability program: getting a controller or a marketing manager to the point where an assistant changes how their Tuesday goes. The first can be mandated and audited; the second cannot. Treat them as one block and you either mandate everything and get 97% completion with no change in behavior, or mandate nothing and end up with a policy nobody has read.
One definition first, because “mandatory” gets used loosely. A mandate has four parts: a named population, a deadline, a completion record, and a consequence for people who have not finished. Drop any one and you have a strong recommendation with a spreadsheet.
What a mandate actually buys you
Coverage, and nothing else, which is worth more than it sounds. Corporate learning benchmarks put mandatory compliance completion at roughly 95 to 100%, professional development at 60 to 80%, and optional content at 30 to 50%. The gap between 97% and 40% is the whole case for making something required, and it is real.
What it does not buy is learning. Survey work on compliance training found 49% of workers admit clicking through required modules to register completion. A high completion number and almost no retained knowledge coexist comfortably.
Coverage still has three honest uses:
- Evidence. A completion record is what an insurance renewal questionnaire, a client security review, and a regulator all ask for, and those questions are now routine. We went through the current wording in what your insurer and clients now ask about your AI controls.
- A shared vocabulary floor. After one session, “sanctioned tool” and “prohibited data” mean the same thing in a sales meeting and in a finance review.
- Removing one excuse. “Nobody told me the client contract barred it” stops being available.
None of the three is a behavior change, so do not build the case on one.
The evidence nobody in this debate cites
The closest test of this exact intervention is not about AI at all. Researchers at UC San Diego ran an eight-month randomized controlled trial across roughly 19,500 UC San Diego Health employees, testing annual mandatory cybersecurity awareness training and embedded phishing exercises over ten campaigns. Their paper, “Understanding the Efficacy of Phishing Training in Practice,” was presented at the IEEE Symposium on Security and Privacy in May 2025.
The results were blunt. There was no significant relationship between whether an employee had recently finished the mandated annual training and whether they fell for a phishing email. Embedded training cut the likelihood of clicking by 2%. In month one, 10% of participants clicked a malicious link; by month eight, more than half had clicked at least one.
The engagement data explains why. Three-quarters of employees spent a minute or less with the embedded material, and a third closed it without reviewing it at all.
Read those findings together and you have the design constraint for every mandate of this kind: a deadline produces completion, and completion is not attention. That is an argument for being precise about which job each session does, not for skipping training. We took the comparison apart in AI risk training vs traditional security awareness training, because inherited assumptions from the security-awareness world are the main reason AI programs get designed badly.
Where the choice has already been made for you
For a growing set of companies the question is settled and only the scope is live.
If you have any EU exposure. Article 4 of the EU AI Act requires that “providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf,” judged against their technical knowledge, experience, education, and the context of use. The duty applied from 2 February 2025, and national market surveillance authorities gained the power to supervise it on 2 August 2026.
Three details matter for a US company. “Deployer” is broad: it covers almost any organization using an AI system someone else built, and it reaches contractors operating that system for you. There is no standalone EU fine: Article 99, the penalty framework, does not list Article 4 as a fineable provision in its own right, and the headline figures circulating online attach to transparency and high-risk duties. The near-term exposure is a documented literacy gap treated as an aggravating factor when regulators investigate something else. And paperwork does not discharge it: the Commission has signaled that handing staff the instructions for use is unlikely to be enough, and the widely reported 2027 deferral covers high-risk obligations, not this one.
If you are a public-sector employer or sell to one. Since September 2025, Texas HB 3512 has required state and local government employees who use a computer for at least a quarter of their duties to take an annual certified AI awareness course, on top of the cybersecurity training already mandated. Washington, DC requires responsible AI training of its workforce: two self-paced courses under two hours, due within 90 days, contractors included.
If you are in a licensed profession. The American Bar Association’s 2024 Formal Opinion 512 reads the competence duty as requiring lawyers to grasp both the capabilities and the limits of the tools they use, and New Jersey approved a technology-related continuing legal education credit effective 1 January 2027.
If none of that applies, the pressure arrives through contracts: client security reviews, renewal questionnaires, and liability applications now ask whether staff have been trained, and your answer is on the record.
The split: one required module, one invited program
| Required safe-use module | Invited enablement program | |
|---|---|---|
| Job it does | Evidences a control | Moves capability |
| Who | Everyone with an account, plus contractors | Teams and roles that opt in |
| Length | 45 minutes once, 20 minutes a year after | 3 to 4 hours, plus follow-up |
| Content | Boundaries, verification, reporting | Their own documents and daily work |
| Measure | Completion rate and attestation record | Changes in the work product |
| If someone skips it | Sanctioned-tool access is paused | Nothing |
| Owner | Whoever owns the policy | Whoever owns the function’s output |
The asymmetry in the last two rows is the point. The required module carries a consequence because its only output is coverage, and coverage without a consequence is not coverage. The invited program carries none, because the moment attendance becomes a condition you have changed what the room is for.
What goes in the required forty-five minutes
Five items, in this order, and nothing else.
- The sanctioned tools, by name. Not “approved enterprise AI platforms” but the actual product names and login route.
- The prohibited-data list, written in your nouns. Not “confidential information.” The real field names: the client roster, the unredacted contract, the payroll export, the CRM field holding a patient identifier. This is the only part of the module that cannot be bought, and the part people remember.
- Verification. What has to be checked before AI-assisted output reaches a client, and by whom. Name the step and the owner.
- Disclosure. When a client, regulator, or counterparty has to be told that AI was involved.
- Reporting. One channel, one name, and an explicit statement that reporting a mistake is not punished. If people think reporting carries a cost, you lose your only early-warning system.
Leave out model architecture, the history of neural networks, and prompt frameworks; those belong in the invited track, where someone chose to be in the room. If you would rather buy the module than build it, the AI security and risk-awareness training options for employees compares the market and where generic catalog modules fall short.
Why mandating fluency suppresses it
Cisco studied this for 18 months. Chief People Officer Kelly Jones’ team ran company-wide surveys and focus groups, then reported in April 2026 that mandatory “watch this webinar, get this certification” did not produce real usage. Cisco reached 90% adoption by making AI secure, useful, and easy to try. Its strongest single finding: employees were twice as likely to use AI if their own leaders used it and talked about it.
The mood data points the same way. A LinkedIn survey reported in August 2025 found 51% of professionals saying AI training already feels like a second job, and 35% nervous about discussing AI at work. A required curriculum on top of that raises compliance and lowers the odds anyone admits confusion, which is backwards for a skill people learn by asking questions out loud.
Look closely at the mandates everyone quotes, too. Citi required 175,000 employees to complete a prompt-writing module within 60 days, and that module runs 10 to 30 minutes depending on the person’s starting level: short and single-purpose, not a curriculum. Accenture tied AI proficiency to promotion across more than 700,000 staff, an incentive structure backed by a billion-dollar learning function. Neither is a 50-to-500-person company mandating a half-day workshop, and the distance between buying licenses and building capability does not close by scheduling attendance, which is the argument we make at length in the AI enablement manifesto.
Who the mandate has to cover
| Group | Required module | Why |
|---|---|---|
| Anyone issued a seat | Yes | Tie the clock to provisioning and the rule maintains itself through hiring and reorganizations |
| The leadership team | Yes, first | An exempt leadership team is the clearest signal that the module is paperwork |
| Contractors and agencies | Yes, by contract | The EU duty names persons acting on your behalf; your contracts are the only instrument that reaches them |
| People who say they do not use AI | Yes | The exposure is a browser tab, not a license |
Only the third row takes real work, because the clause and the account arrangement have to be chosen rather than inherited, which we cover in extending your AI policy to contractors.
Making “mandatory” mean something
Pick an administrative consequence, not a disciplinary one. If the module is not finished by the deadline, the sanctioned-tool seat is paused until it is. That works because the administrator who issued the seat can apply it, no manager has to hold an awkward conversation, and it reverses in under a minute. Write-ups and performance plans are the usual alternative and are never used, which is how a mandate quietly becomes a suggestion.
Keep a plain attestation record: name, module version, completion date, and a score if there is one. Four fields answer most of what a client questionnaire asks.
Do not build monitoring to enforce a deadline. Completion is a fact you can record without watching anybody work, while usage monitoring is a separate decision with separate costs, and bundling the two is how a sensible safe-use program acquires a reputation it cannot shake. What a policy says versus what people do is the subject of the safe AI use playbook; surveillance is a poor substitute for a rule people can repeat from memory.
What it costs
The required module is the cheap half. Adding an AI risk module to a security-awareness subscription you already pay for is usually the lowest-cost route, and several platforms now bundle one. Recording your own, the only way to get your real field names into it, is mostly internal time: a few days from whoever owns the policy. Figure two weeks to write and a 90-day completion window.
The invited half is where the money goes. Market rates for hands-on workshop delivery run from about $2,000 to $15,000 depending on scope and group size. Against the licenses most companies this size already pay for, that is a rounding error, and the only line with a plausible return.
A thirty-day sequence
| Days | Action |
|---|---|
| 1–5 | Decide the two tracks and name one owner for each. Write both names down. |
| 6–10 | Draft the prohibited-data list in your own nouns, pulling field names from the systems rather than a template. |
| 11–15 | Choose the delivery route: bundle, buy, or record your own. |
| 16–20 | Put the deadline and the access consequence in writing, signed off by whoever can pause a seat. |
| 21–25 | Run the module with the leadership team first and fix what confused them. |
| 26–30 | Launch to everyone with an account, and put the first invited session on the calendar that same week. |
Frequently asked questions
Is AI training legally required in the United States?
Not broadly. No federal requirement binds private employers. Texas requires annual certified AI awareness training of state and local government employees, Washington, DC requires it of its workforce and contractors, and some licensed professions impose a competence duty. Private companies mostly face contractual pressure from clients and insurers instead.
Does the EU AI Act apply to a US company?
It can. Article 4 binds deployers, which covers an organization using a commercial assistant, where that use touches EU staff, customers, or operations. If you have an EU entity, EU employees, or EU customer data in scope, treat it as live rather than as a 2027 problem.
How long should the mandatory module be?
Under an hour for the first pass, about 20 minutes a year after that. Longer modules do not retain better, they just complete worse.
What should happen if someone misses the deadline?
Pause their sanctioned-tool access until they finish. It is administrative, reversible, and applied by whoever issued the seat. Disciplinary consequences sound firmer and get waived in practice.
Should executives be exempt?
No, and they should go first. Cisco’s study of its own workforce found employees twice as likely to use AI when their leaders used it and talked about it.
Will mandatory training reduce AI-related incidents?
On its own, probably not much. The UC San Diego trial found no significant relationship between recent completion of mandated annual security awareness training and phishing failure. Incidents fall when the sanctioned tools are configured correctly, the prohibited-data rule is short enough to recall, and reporting a mistake carries no penalty. The module supports those controls, it does not replace them.
Should we mandate AI use as well as AI training?
Avoid it at this size. Microsoft and Accenture tie AI use to reviews and promotions, backed by enormous learning functions. Cisco tried mandating adoption for engineers and reported it did not drive lasting usage. Make the tools good and let managers model them.
Do contractors have to complete it?
If they touch your material, yes, and the instrument is the contract rather than your learning system. Budget for their time; nobody reads your policy for free.
How often should it repeat?
Annually, with one exception: re-run it out of cycle when the sanctioned-tool list changes. People learn the list rather than the lesson, so a new tool invalidates the training faster than the calendar does.
Key takeaways
- Split the question. The safe-use module is a control and belongs on a mandate; the fluency program is a capability and belongs on an invitation.
- A mandate buys coverage, evidence, and a shared vocabulary. It does not buy behavior change, so do not promise that.
- Article 4 of the EU AI Act has applied since February 2025, and national authorities have been able to check compliance since August 2026. US companies with no EU exposure answer to clients and insurers instead.
- A mandate needs a named population, a deadline, a record, and a consequence. Make the consequence a paused seat, not a write-up.
- Write the prohibited-data list in your own field names, and run the leadership team through it first.
If you are deciding where the line between required and invited sits for your team, we will work through it on a free AI-readiness call. Book a time and bring your current policy, your tool list, and the questionnaire a client last sent you.
Dirk Jan van Veen, PhD
