Last reviewed 5 November 2026 against the sources linked in this post.
AI governance training starts with one question: who is responsible for each AI system your organisation uses? The European Commission's AI Act page says the AI Act became applicable on 2 August 2026, with some exceptions, including AI literacy obligations that applied from 2 February 2025 and a later date for high-risk use cases in sensitive areas. Organisations that use AI are expected to know which rules reach them.
This is a list of 8 ready-made courses for AI governance leads, data protection officers and product owners who deploy AI inside organisations. They cover AI Act roles, AI literacy, people decisions and AI security. Many searchers for this topic want a certification. This post does not sell one: it covers the courses your staff complete, which is what you can show an auditor. Each group ends with an Our pick.
All 8 courses at a glance
| Course | What it covers | Length | Legal duty on the organisation? |
|---|---|---|---|
| Who is responsible? AI Act roles, deployer duties and your organisation's AI governance | Provider and deployer roles and AI governance | 45 min | No duty to take this course cited here |
| EU: AI literacy (EU AI Act Article 4) | Article 4 basics | 35 min | Yes, in the EU (Article 4) |
| AI in hiring and people decisions | Fair, lawful, human-led decisions | 45 min | No duty to take this course cited here |
| AI security for everyone | Shadow AI, prompt injection and manipulated outputs | 30 min | No duty cited here |
| Social engineering, fraud and deepfakes | Impersonation and deepfake scams | 35 min | No duty cited here |
| Security awareness essentials | Baseline security expectations | 35 min | No duty cited here |
| Phishing & social engineering | Spotting and reporting phishing | 30 min | No duty cited here |
| Passwords, passkeys and multi-factor authentication | Strong sign-in for AI platforms and admin consoles | 30 min | No duty cited here |
AI Act duties and governance
Who is responsible? AI Act roles, deployer duties and your organisation's AI governance
This course explains provider and deployer roles and how to run governance across the organisation. The AI Act defines a deployer as a natural or legal person, public authority, agency or other body using an AI system under its authority, except for personal non-professional use, so many organisations that buy AI tools are deployers. In the session, use a Word Cloud: "Which AI systems does our organisation use?" Then ask the room which of them nobody can name an owner for.
EU: AI literacy (EU AI Act Article 4)
Governance leads have to be able to show what their organisation did about AI literacy. Article 4 says providers and deployers shall take measures to support the development of AI literacy of their staff and others operating or using AI systems on their behalf. The Commission's AI literacy Q&A adds that no certificate is needed and an internal record of trainings can be kept. In the session, run a Rating Scale: "How well do you understand where we use AI?" and keep the results as part of your record.
AI in hiring and people decisions
AI used in hiring is a sensitive use. The Commission's AI Act page lists AI tools for employment, management of workers and access to self-employment, such as CV-sorting software, among its high-risk use cases. This course covers fair, lawful, human-led decisions. In the session, show a ranked list of candidates and use Pick Answer to ask whether a manager should accept it, question it or ignore it, then discuss who is accountable for the choice.
Our pick: Who is responsible? AI Act roles, deployer duties and your organisation's AI governance. Every other duty depends on knowing which role you hold, and the "who owns this system" exercise exposes gaps quickly.
AI security and fraud risk
AI security for everyone
Shadow AI and prompt injection are the governance risks most teams meet first. Shadow AI means tools in use without approval; prompt injection means hidden instructions that steer an AI tool. This course covers both, plus manipulated outputs. In the session, run an Open Ended slide: "Which AI tool have you used that we have not approved?" Use the answers to start an inventory.
Social engineering, fraud and deepfakes
Deepfake fraud is both an AI risk and a governance training topic, because a cloned voice can trigger a payment or a data release. This course covers phone, payment and impersonation scams and the habit of checking on a second channel. In the session, play a short voice scenario and poll the room on whether they would approve the request.
Our pick: AI security for everyone. The shadow AI question produces a real list of tools, which is the first thing a governance programme needs.
Security fundamentals
Security awareness essentials
These are the baseline security expectations around AI systems and the data that feeds them. The course covers the everyday behaviours every employee should have. In the session, run a short quiz on a realistic day, such as a shared login for an AI tool or a laptop left unlocked, and ask what each person would do.
Phishing & social engineering
Phishing can compromise the accounts that administer AI systems, which gives an attacker the keys to the models and the data. This course teaches how to spot and report phishing and social engineering. In the session, show three messages and poll on which is fake, then ask which would reach an administrator.
Passwords, passkeys and multi-factor authentication
Strong authentication is a basic control for AI platforms and admin consoles. The course covers passwords, passkeys and multi-factor authentication for staff. In the session, ask on a Rating Scale how confident people are that every AI admin account uses multi-factor sign-in, and list the accounts that score lowest.
Our pick: Passwords, passkeys and multi-factor authentication. It is the cheapest control on the list and protects every AI platform your organisation runs.
How to roll the plan out
Start with the course that maps to a stated duty in the EU, AI literacy under Article 4, and the role-and-duty course, so your leads know which obligations are theirs. The Commission says the Act became applicable on 2 August 2026, with some exceptions, so do not wait for a year-end cycle. Then train the people who use AI in hiring and people decisions. Finish with the security refreshers each year.
The Act can reach beyond the EU: it covers providers and deployers in a third country where the output produced by the AI system is used in the Union. For deployers of high-risk systems, Article 26 says they shall assign human oversight to natural persons who have the necessary competence, training and authority, which is a good reason to keep a record of who trained for what. Add your country's rules where your teams work, and check dates with the Commission, since they have been amended.
For the wider staff rollout, see the guide to AI training for employees. Privacy leads will find the data protection officer course list useful, and boards can use the board of directors training list.
Ways to run these courses on AhaSlides
You can offer all 8 in three formats:
- Self-paced courses. Use the AhaSlides course creator to assign each owner a course to complete.
- A live Q&A deck. Collect questions about your real AI systems ahead of the session, then answer them in the room.
- Pre and post surveys. Measure what changed in the same session.
Four slide types do most of the work:
- Pick Answer. Ask: "A vendor adds an AI feature to a tool we already use. Who approves it?" Show the split before you reveal the answer.
- Word Cloud. Ask: "Which AI systems do we use?" The size of each word shows what people know about.
- Rating Scale. Ask, before and after: "How clear is it who owns each AI system?" Rate from 1 to 5 and compare the averages.
- Open Ended. Ask: "What AI use worries you most?" Answers can be anonymous, so people say what they think.
FAQ
What is AI governance training?
It teaches the roles, risks and legal duties that apply to organisations that build or use AI. The 8 courses above cover those, plus the security habits underneath.
Who must comply with the EU AI Act?
Per Article 2, providers placing AI systems on the EU market, deployers established or located in the EU, and organisations outside the EU where the output produced by the AI system is used in the Union. Check how it applies to you with a qualified lawyer.
What is a deployer under the AI Act?
An organisation that uses an AI system under its own authority, other than for personal non-professional activity. The definition is in Article 3.
Is there an AI governance certification?
Several exist, but this post cites no regulator that requires one. The Commission's AI literacy Q&A says no certificate is needed for Article 4, and organisations can keep an internal record of training, so role-based internal training is a practical way to show what you did.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
