One company, many AI worlds

Even within a single medium-sized company, people with completely different points of contact with AI sit side by side. What is the central issue for one role simply does not arise in another. A training course that tells everyone the same thing therefore fails to address the issues relevant to most people.

Let’s look at just how different the issues actually are.

Just how different the questions really are

• Personnel and HR. The most sensitive area. This involves job applications, personnel data and job advertisements. As soon as AI influences the pre-selection of applications, this is considered a high-risk scenario – the utmost care is required here.
• Marketing. Runs on AI-generated text and AI-generated images. The dominant issue is labelling: from August 2026, AI-generated content must be identifiable. This department, however, never deals with applicant data.
• Sales. Quotes, customer emails, data from the CRM. The key question is: which customer data can be used in which tool – and which is best avoided?
• Accounting and Finance. Figures, contracts, confidential business data. Here, confidentiality takes precedence over everything else; image labelling is not an issue.
• Customer Service. Chatbots and draft responses. The chatbot must identify itself as AI – transparency in direct customer contact is key here.
• IT. Sits on the other side of the table: handles tools, access rights and security. Their questions are technical in nature, not content-related.
• Management / Executive. Uses AI for research, initial drafts and strategic work – often with the most confidential documents in the entire organisation.

Seven roles, seven priorities.. What is central to one is not even a peripheral issue for another.

Why ‘a bit of everything for everyone’ helps no one

Generic training attempts to cover all topics for everyone. The result: everyone is overloaded with irrelevant information, whilst their own genuine questions get lost. The accountant doesn’t need to learn how to tag AI images; the Marketing colleague doesn’t need to learn how to handle applicant data. If you try to teach both of them both things, you lose both of them.

Department-specific training is therefore the opposite of information overload: everyone learns what actually happens in their own day-to-day work – concise, relevant, practical. This saves time and, at the same time, ensures that what has been learnt actually sticks, because it is linked to real tasks.

The role changes – the person remains

One point is particularly important to me here, especially in small and medium-sized enterprises: there, one person often wears several hats. The administrative assistant does the bookkeeping and Customer Service. The Managing Director takes care of Marketing on the side. The sales representative steps in to help with support.

A department-specific approach must therefore not mean pigeonholing someone. It means: everyone receives exactly the building blocks that match their actual tasks – including several, if someone fulfils multiple roles. It is not the job title that matters, but what the person actually does.

Industry and department together ensure precision

This brings us full circle to the industry. The industry determines what the company fundamentally deals with; the department determines what the individual does on a day-to-day basis. Only when both are right – the ‘what’ of the company and the ‘how’ of the role – does compulsory training become something that sticks in the mind and helps at the right moment.

Generic training is quickly completed. Targeted training is effective – because it meets each person exactly where they actually are.

That is why employees at the EU AI Act Academy choose the modules that match their actual tasks – even several, if someone has multiple roles. Everyone learns what their own day-to-day work requires, rather than what is irrelevant to it

The same action, completely different implications

Let’s take a very specific scenario: an employee copies a text into an AI tool to have it summarised. Harmless? That depends on the sector she works in.

In a tax consultancy, that same click could be risky – it might involve client data, and thus breach professional confidentiality. At the tradesman’s workshop next door, it’s completely uncontroversial if it’s a supplier’s quotation. In a care home, it would be particularly sensitive, because health data is among the most strictly protected information of all.

One action. Three sectors. Three completely different risk scenarios. This is precisely where it becomes clear why training ‘for everyone’ so often comes to nothing in practice.

Where the sector decides on the actual issues

In my work with companies from a wide range of sectors, I see time and again that every sector has its own key issue when it comes to AI. Here are a few examples of just how different the priorities are

• Law firms, tax consultancy firms, doctors’ practices. Here, everything revolves around professional secrecy. The crucial question is which confidential client or patient data is even permitted to come into contact with an AI tool – and which is never allowed to.
• Marketing and the creative industries. AI-generated text and images have long been part of everyday life here. The dominant issue is therefore labelling: from August 2026, AI-generated content must be recognisable as such.
• Recruitment and staffing services. As soon as AI plays a part in the pre-selection of job applications, we enter an area that is actually considered high-risk. This is where training is most demanding – and most important.
• Financial services. The situation becomes similarly sensitive when AI is involved in credit checks. This, too, is a strictly regulated use case, not an everyday tool like any other.
• Skilled trades and Production. For quotations, bills of materials or documentation, AI is usually not a critical issue. Here, it is less about bans and more about the sensible handling of data and genuine efficiency gains.
• Retail and services.. Where chatbots interact with customers, labelling and data protection are the key issues – the customer should know that they are chatting with an AI.

The message behind this is simple: training that says the same thing to everyone says too little to most people – and the wrong thing to some. A roofer isn’t interested in a law firm’s client confidentiality, and an agency’s image labelling is of no help to a care worker.

Why generic training fails to resonate

There is a simple pedagogical reason why industry-specific relevance makes such a difference: people learn from situations they are familiar with. If an example comes from an unfamiliar working environment, people nod politely – but do not apply it to their own everyday lives.

‘Industry-specific’ therefore means that the examples and borderline cases come from the learners’ own lived experience. The care worker hears a care-related case, the tradesperson one from their own trade, and the tax clerk one from the firm. Only then does the crucial moment arise: ‘Ah, that’s exactly my kind of case.’ And it is precisely this moment that sticks in the mind.

But the industry is only half the battle

As important as the sector is – it’s not enough on its own. Because even within the same company, not everyone uses AI in the same way. The colleague in Marketing faces completely different questions to the accountant in the next office, even though both work in the same sector.

Sector and department are therefore intertwined. The sector determines what a company fundamentally deals with. The department determines what the individual actually does in their day-to-day work. Only when both are combined does training become truly effective – but that’s a topic in its own right.

Industry-specific focus is not a luxury, but a prerequisite

Anyone who takes AI training seriously cannot ignore the industry. It determines whether the content is perceived as an abstract compulsory exercise or as something that is tangibly relevant to one’s own working day. Generic training is quick to deliver – but rarely understood.

That is precisely why the content of the EU AI Act Academy is tailored to specific sectors: everyone is given examples and borderline cases that actually occur in their own day-to-day work – rather than training that is supposed to suit everyone and therefore doesn’t quite suit anyone.

A policy is a start, not a solution

Of course, internal guidelines are important. Without them, there is no benchmark. But there is a greater gap than one might think between ‘there is a policy’ and ‘people act in accordance with it’.

For an AI policy to be effective in day-to-day practice, employees need to be able to do four things – and these build on one another:

• Know the rules. It sounds trivial, but it isn’t. A policy that was sent out once by email and then filed away on the intranet is hardly remembered by anyone after three months.
• Understand the rules. Knowing isn’t the same as understanding. ‘No personal data in public tools’ is easy enough to write. But is an email with the sender’s name already considered personal data? Is an anonymised customer quote acceptable? Anyone who has merely read the rule but hasn’t fully grasped it will be at a loss when faced with the first borderline case.
• Recognising typical borderline cases. Everyday life rarely consists of clear-cut cases. It consists of ‘it depends’. It is precisely these grey areas that determine whether a policy is helpful or merely a piece of paper.
• Remaining capable of taking action. Ultimately, someone has to make a decision at a specific moment – usually under time pressure, without having the policy to hand.

When policy and practice diverge, a scandal rarely ensues. Something quieter, but just as delicate, happens: uncertainty, evasive behaviour, unspoken habits. When in doubt, someone pulls out their private mobile phone with their private AI account – and suddenly, usage takes place entirely outside the scope of any rules.

That is why good AI governance is not just a matter of documents. It is just as much a matter of comprehensibility.

Many training courses fail not because of their content, but because of their format

This brings us to the crux of the matter. If understanding determines success or failure, then the way the material is delivered is not a side issue – it is the crux of the matter.

Most of us are familiar with this: compulsory training as a series of slides to click through. Forty slides you click through whilst your inbox flashes in the background. At the end, a test where you’re more likely to guess the answers than actually know them. Ticked off. What sticks isn’t knowledge, but a tick on a list.

When it comes to AI, this format is particularly disastrous. Because this isn’t about rigid rules that you learn once and then apply. It’s about exercising judgement in unclear situations.

What companies need instead is something different:

• Clear categorisation rather than an information overload – what’s really important, and what’s just detail.
• Plain language instead of legal jargon that nobody outside Legal / Compliance would voluntarily read.
• Everyday examples instead of abstract principles.
• Recognisable situations – scenarios in which someone recognises themselves: ‘Ah, I do that too.’
• Comprehensible standards, which you can remember because they make sense – not because you’ve learnt them by heart.

Because AI isn’t about memorising terms. Nobody needs to be able to recite the wording of a legal provision. It’s about making better decisions at the right moment – for example, the split second when someone is about to post a deceptively realistic AI image on LinkedIn and pauses briefly: “Should I actually label this?”

The real risk isn’t intent, but routine

This is the point that is most frequently underestimated in the discussion. When people talk about the risks of AI, many think of malicious behaviour. In fact, the risk is much more mundane – and precisely for that reason, greater: it is routine.

Employees turn to whatever helps them. The assistant uses the tool to quickly summarise the lengthy meeting minutes. The Sales team feeds the draft quotation into the tool. This is understandable – and in many cases, exactly what we want. Nobody wants employees who shy away from tools that make their work easier.

That is precisely why it is not enough to rely on reason alone. Reason is there. But reason does not make decisions in the heat of the moment – habit does. Companies need a framework that does not work against everyday life, but with it:

• Simple enough to actually be used – not a hurdle to be circumvented.
• Clear enough to provide guidance in a specific situation.
• Concrete enough, to reduce uncertainty rather than create new uncertainty.

The key point is this: when the safe route is unclear and the quick route is obvious, everyday life makes the decision for itself – and almost always in favour of the quick route. This is not a question of character or good will. It is a question of design. If you want people to take the safe route, you must make it the easy route.

Governance is not decided in a filing cabinet

This brings us full circle. An AI directive is a good start – but it does not take effect in a filing cabinet, but in the mind of the person currently faced with a decision. Whether this succeeds depends less on the document itself than on whether the rules have been understood, whether they can be applied to real-life situations, and whether the safe path is also the convenient one in everyday life.

Good governance is therefore, ultimately, not just a matter of paperwork. It is a question of clarity. And that is precisely where it is decided whether good intentions are turned into everyday practice.

This is exactly what the EU AI Act Academy aims to achieve: not a series of clicks to tick off a list, but clear training with real-life examples that empowers staff to act at the right moment – and provides the evidence required by the EU AI Act.