You probably don’t need to buy an AI curriculum. The AI training for employees your people actually need is the part only you can write: your approved tools, your data rules, your approval chain. “Am I allowed to put this in there?” is the question they’re really asking. No purchased course can answer it.
This guide gives you the buy-versus-build rule, the six questions your course has to cover, how to reissue it when the policy changes, and a four-week plan that fits the quarter.
You can build this course from a document you already have instead of shopping for one.
Key Takeaways
- “Get everyone up to speed on AI” is three different requests in one sentence. Ask your executive which one they meant before you pick a format.
- The rule: buy what’s true at every company and will still be true next year, build what depends on your own tools, your own data and your own approvals.
- Buying is right in one case only, when a customer, an insurer or a tender needs an externally-branded certificate.
- Your first deliverable isn’t a course. It’s a one-page rules document signed by legal, security or IT, and L&D shouldn’t be the one writing it.
- Split it into two courses by data exposure, not seniority: fifteen minutes for everyone, longer for the roles that touch customer data, code, money or published claims.
- You can report completion and on-time completion cleanly. You can’t attribute a change in AI adoption to the course, so don’t promise it.
What Your Executive Actually Asked For
“Get everyone up to speed on AI” is three requests wearing one sentence, and they don’t want the same course.
| What they meant | What it is | Who gets it | How long |
|---|---|---|---|
| Make sure nobody does something reckless with a chatbot | A rules course | Everyone | 15 minutes, deliverable in 3 weeks |
| Make the people whose jobs are changing better at the tools they’ve been given | A practice course | A few hundred people at most | Hours, spread across a quarter |
| Be able to show the board that we did something | A completion record with a date on it | Everyone | As long as the first one takes |
Most people in your seat hear the third, deliver the second, and get asked about the first when something goes wrong.
They differ on ownership too. The rules course is yours. The practice course belongs to the function whose work is changing, and it stalls if you try to own it alone.
So go back and ask. One sentence will do it: “When you said AI training, did you mean everyone knows the rules, or the teams using it get better at it?”
The answer decides the format, the headcount, and whether the deadline you were given is realistic. Asking looks like diligence. Guessing looks like a rollout nobody finishes.
What’s Actually for Sale Under This Name
Most of what’s sold as AI training for employees is a finished course, and “finished course” covers four different products. If a quote has landed on your desk, naming which one changes what you do next.
| What’s being sold | What you get | What it can’t do |
|---|---|---|
| A compliance-style course, priced per seat. NAVEX sells one under the name AI at Work. | A polished, assignable module on responsible AI use, with tracking built for an audit trail. | Name your approved tools, your data rules, or who signs off on what. |
| An education-benefit marketplace. Guild is the best-known. | A catalog your employees choose from, funded as a benefit. | Deliver one thing everyone has done by a date you set. |
| A skills program or bootcamp. Correlation One runs these for workforces. | Cohort training for a selected group, usually technical, usually months. | Reach the whole company this quarter. |
| A course-library subscription. Udemy Business sells one that even includes a course on building your own employee AI training program. | Thousands of courses, including good ones on this exact problem. | Decide anything. A library is an input, not a rollout. |
All four are real products, and most are worth the money in the right situation. None knows which assistant your company pays for, which one legal has said no to, or what happens when a customer contract gets pasted into the wrong box. That isn’t a flaw in the products. It’s the boundary of what a general course can be.
The Buy-Versus-Build Rule, in One Sentence
Here’s the line to put in front of your director.
Buy what’s true at every company and will still be true next year. Build what depends on your own tools, your own data, and your own approvals.
“What a large language model is, and why it makes things up” is true everywhere and will still be true in a year. Buy that, or link to a free explainer, and stop thinking about it. “Which assistant you may paste a customer contract into” can’t be bought at any price, because the answer is a fact about your company that changes when procurement signs something.
Run any sample course through that line and it sorts itself in 10 minutes. The concept material is fine and cheap. The operational material, the part your employees use on Tuesday, is either missing or written so loosely that it means nothing.
There’s one clean exception. It will come up, so know it now.
Buy when you need an externally-branded certificate. If a customer’s security questionnaire, an insurer, or a tender asks for AI training from a named third party, buy the named third party.
That’s a credential purchase, not a training purchase, and the two are unrelated. It doesn’t replace the internal course, and the internal course doesn’t satisfy the tender. Budget for both.
You Don’t Have a Training Problem Yet. You Have an Unwritten Rule Problem
This is where these projects die, so it goes early.
Someone in your seat gets the request, spends two weeks comparing AI courses, picks one, opens it, and realizes it can’t say anything specific. Then they go looking for a better one. Six weeks later there’s still nothing assigned.
The missing thing was never content. It’s a one-page document that says which AI tools are approved, what may never go into them, and who to ask. Nobody has written it, and it’s probably not yours to write: those calls belong to legal, security, or IT.
Here’s the part that makes it your problem anyway. Nobody else will start it.
- Legal isn’t tracking the COO’s training deadline.
- Security has a backlog.
- IT thinks the tool list is obvious, because they maintain it.
So the first action of this project isn’t a vendor call. It’s an email, today, that says:
I’ve been asked to deliver AI training to all staff by [date]. To do that I need one page from you covering approved tools, prohibited data, and the escalation path. I’ll draft it from what you tell me and send it back for sign-off. Can I have your input by [date minus three weeks]?
That email does three things. It moves the deadline risk into a shared one. It offers to do the writing, which is what usually unblocks a busy stakeholder. And it creates the artifact you need anyway, because a rules course without a signed rules document behind it is your opinion with a completion rate attached.
The Six Questions Your Course Has to Answer
Once the rules document exists, the course writes itself, and it’s shorter than you think. Six questions, in this order, because this is the order employees ask them.
-
Which tools am I allowed to use? Name them: the approved list, the ones under review, and the ones that are a no. Include the tier if it matters, because the free and business tiers of the same assistant often carry different data terms.
-
What may I never paste into one? Be concrete: customer contracts, personal data, unreleased financials, source code from the private repo, anything under NDA. A list of categories beats a principle every time.
-
What has to be checked by a person before it leaves the building? Anything a customer reads, anything a regulator reads, anything that goes into a product, anything with a number in it.
-
Do I have to say when something was AI-assisted? Yes, no, or “in these cases”. Pick one. This is the question people are most embarrassed to ask out loud.
-
Who do I ask when it isn’t covered? A name or a channel, not “your manager”. An employee with an edge case needs somewhere to go that isn’t a guess.
-
What happens if I get it wrong? Say it plainly. If self-reporting a mistake is safe, say that too, because it’s the sentence that makes the other five work.
Anything past those six is a second course. Prompt technique, tool walkthroughs, what a model does under the hood: all interesting, none of it belongs in the 15 minutes where someone learns whether they can paste a contract into a chatbot.
Write one screen per question, with your own examples. That’s a complete course, and it’s the only version of it that couldn’t have been bought.
Where a Bought Course Goes Vague, and What to Write Instead
Here’s a test you can run on any sample course in ten minutes. Look for the sentences that describe a process, and ask whose process it is.
A bought course says: always check AI output for accuracy before using it. Read it twice and it teaches nothing.
“Check” is the whole job, and checking is the part that’s different at every company. Check against what? Before which step?
Your version names the chain instead.
| The generic sentence | What yours has to say instead |
|---|---|
| Always check AI output for accuracy | Marketing copy drafted with AI goes to the brand lead before it’s scheduled. Anything with a product claim in it goes to product marketing first. Pricing pages go to finance. |
| Be mindful of confidential information | Your own list of what counts as confidential, by category |
| Follow company policy | The two lines of the policy that apply here, quoted |
| Use AI responsibly | Nothing. It was never a sentence. |
Every vague line in a generic course is a hole where your own process should have been. That’s useful, actually. Take a sample course, highlight the vague sentences, and you’ve got the outline of what you have to write yourself.
Two Courses, Split by Exposure, Not Seniority
Don’t build one course for everybody. Build two, and split them by what people touch.
| Course one | Course two | |
|---|---|---|
| Who | Everyone, including the people who swear they’ll never use the tools | The roles that touch customer data, code, money or published claims: support, sales, engineering, finance, marketing, HR, legal |
| Length | 15 minutes | Up to an hour, better split into 3 pieces |
| What’s in it | The six questions, your own examples, a short check with a right answer | Scenarios and edge cases, drawn from real incidents |
| When | Week 3 | 3 weeks after that |
Course one is what people mean when they say AI literacy training: not a philosophy of machine learning, but knowing what’s allowed and what isn’t.
The obvious split is by seniority, and it’s the wrong one. A junior support agent handles more customer data before lunch than a VP of operations does in a month. Seniority tells you who approves things. Exposure tells you who can cause an incident.
The most common way to lose completion is running everyone through course two. Fifteen minutes for everyone finishes. An hour for everyone does not.
Record which group each person is in the same way you’d record any other requirement. If you keep a training matrix, the exposure list is one more column, the one you’ll need when someone changes jobs.
Build It From the Documents You Already Have
Let’s get the honest part out of the way. We don’t sell an AI curriculum, and there’s no off-the-shelf AI course for us to hand you here. What we sell is the way to build and reissue your own, which is the part nobody else can do for you anyway.
You’re not writing from a blank page. Four things already exist.
- The rules document, the one you asked for in week one. This is the course outline, and the six questions are its sections.
- The tool list from IT. Names, tiers, and what each one is approved for. Ask for it as a list, not a paragraph.
- Two or three real incidents. Your security lead has them: the contract that went into a public chatbot, the generated figure that reached a customer deck, the support reply that invented a refund policy. Anonymize them and use them. Nothing in a bought course lands like an example from your own building.
- The questions already in your help channel. Read the last three months of whatever channel people ask in. That’s your FAQ, pre-written, in your employees’ own words.
Turning that stack into a course is mostly mechanical. Mini Course Generator’s PDF to Course Creator builds a structured course straight from the policy document, and Hallucination-Proof generation works from your own resources rather than the open internet. That matters more here than on any other topic: a course about not trusting AI output can’t contain invented AI output. MCG’s own claim for it is 95% hallucination-free, generated from your own materials, and you should still read every screen before you assign it.
One interactive piece is worth building for this subject. An AI Role-play activity, where someone plays a colleague trying to talk the employee into pasting customer data into a chatbot, teaches the refusal better than a rule does. Mini Course Generator’s [AI Role-play Skill](/skills/role-play/) builds it against your rubric. The roleplay tool comparison covers where the completion record lands in each option.
Reissuing It When the Policy Changes, Because It Will
Your tool list will change within two quarters. Procurement signs something, a vendor changes its data terms, security bans a browser extension. Plan for the reissue now, because retrofitting it later is worse.
Three mechanics, none of which anybody writes down.
Put the approved-tool list inside the course, with its date visible to the learner. Not in an appendix, not in a linked wiki page. On the screen, dated: Approved tools, as of March 2026.
A learner who sees a date knows whether to trust it. A rules course with no visible date is unusable as evidence six months later, because nobody can tell which version of the rules a given completion refers to.
Version the course, not the memo. The temptation is to email an update and leave the course alone. Don’t.
Six months on you’ll have a course saying one thing, an email nobody kept saying another, and no way to show which a person was trained on. The course is the record. Change it.
Reassign rather than re-announce. When the tool list changes materially, push the course out again with a new due date. Now your completion report answers the question an auditor actually asks, which is “who has seen the current rules”, not “who has ever been trained”. Those are different questions, and only one of them is defensible.
If your company treats this as an attestation rather than training, the same mechanics apply with a certificate attached. Certificates & Badges and Micro-credentialing give each completion a dated artifact, which is what an attestation-style rollout needs.
One access setting matters too. Among MCG’s six Gateways, in-app authentication or a specific-learners list with magic links gives what the product calls seamless, password-less access. That removes a common reason internal courses stall short of full completion.
What You Can Report, and What You Can’t
Be careful what you promise here, because you’ll be held to it.
What you can report cleanly: completion, and on-time completion. Both groups, both courses, by department, by manager. Add certificate currency once the reissue cycle is running: how many people hold a completion against the current version of the rules, not any version. That third number survives a question from your board, and most teams don’t have it.
What you can’t report: that the course changed AI adoption, or reduced risk, or improved productivity. IT rolled out licenses the same month. A new assistant appeared in your office suite by update. Two teams ran their own experiments.
Nothing separates the training’s effect from any of that, and it isn’t a data problem you can fix with a better dashboard. We’ve made that argument in full elsewhere; this page is the operational half of it.
One better signal, and it’s free. Count the policy questions arriving in your internal channel in the month before the rollout, and in the month after. “Can I use X for Y?” arriving twelve times a week and then twice is a real result: people know the answer now. It isn’t causal proof, but you can collect it in twenty minutes on a Friday afternoon.
For the full version of what’s measurable and what isn’t, the training metrics guide sorts it into three tiers. For what your platform’s own reports will and won’t give you, LMS reporting covers where the platform’s data ends.
The First Four Weeks
A plan that fits the quarter, with the blocker named first because it’s the one that isn’t yours alone.
| Week | What happens | Who has to move |
|---|---|---|
| 1 | Send the rules-document request to legal, security, or IT with a date on it. Ask IT for the approved tool list. Ask your security lead for two or three real incidents. | Them, which is why it’s week one |
| 2 | Draft the one-pager from what comes back. Build the fifteen-minute awareness course from it. Send both for sign-off together. | You |
| 3 | Assign course one to everyone with a due date 2 weeks out. Start the applied course for the exposed roles, using the incidents and the help-channel questions. | You, plus managers chasing completion |
| 4 | Assign the applied course. Set a calendar reminder for the next tool-stack review, and decide now who tells you when it changes. | You |
Week one is the blocker, and it’s other people’s calendars. That’s why it goes first, and why the email goes out before you’ve looked at a single vendor. If the rules document slips, everything slips. Ask early enough that the slip is visible rather than yours.
If you need to hand your director something that looks like a plan, the employee training plan template is the document this schedule drops into.
Questions That Come Up
Should we just buy a course?
Faster to assign, yes. But you’ll assign something that can’t name your tools, and the first question in the chat afterward will be one it doesn’t answer. If the deadline really is three weeks out, buy a general course as a stopgap, say out loud that it’s a stopgap, and start the rules document the same day.
How long should the course be?
Fifteen minutes for the all-staff one. If it’s running past twenty, something in it belongs in course two. The applied course can take an hour, and three short pieces with separate due dates beat one long sitting.
Who has to sign off on the rules document?
Whoever owns the risk it describes: legal for contractual and confidentiality questions, security for data handling, IT for the tool list. In a smaller company that’s one person and an afternoon. Get it in writing, even if the writing is a reply in a thread, so the answer you teach is the company’s and not yours.
Do we need to issue a certificate?
For internal AI rules, usually not. Issue one when someone outside your company will ask for evidence, or when your own policy treats the course as an attestation. If you do, make sure the certificate carries the course version, or in six months you won’t be able to tell which rules a person agreed to.
Does Mini Course Generator have an AI curriculum we can use?
No. We don’t sell course content, so there’s no library of AI courses here to assign. What we do is turn documents you already have into courses, keep them current, and report on who finished. If you need a ready-made curriculum, buy one from someone who sells content, knowing it won’t cover the company-specific half.
Won’t building this ourselves make more work for our instructional designer?
If you have one, they should own course two, where scenario and assessment design actually matter, and hand you course one in an afternoon. Where AI drafting helps a designer and where it doesn’t is covered in AI for instructional design. If you don’t have one, the six questions and your own incidents are a good enough spine.
Start With the Rules, Not the Curriculum
Send the email. Today, before you open a single vendor site. Ask legal, security, or IT for one page covering approved tools, prohibited data, and who to ask, offer to draft it yourself, and put a date on it.
Everything else here is two weeks of work you can only start once that page exists. Then build the short course from the page, split off the longer one for the roles with real exposure, and date the tool list inside the course so the record still means something next quarter.
That’s AI training for employees that survives contact with your actual company. It’s roughly a month of part-time work rather than a procurement cycle.
Once you have the rules on paper, you can turn them into assigned training your managers can track without waiting on a content budget.
Sources
- NAVEX’s AI at Work employee training line, Guild’s education-benefit marketplace, Correlation One’s workforce AI programs, and Udemy Business’s course library, as examples of the four things sold under this name
- Mini Course Generator’s own product documentation for PDF to Course Creator, Hallucination-Proof generation, Gateways, Certificates & Badges, and the AI Role-play Agent Skill
