"Teams use AI without rules or training"
Lemur Media · author: Dominik Dębski · updated 28.10.2026
AI tools reach companies faster than the rules for using them. Since 2 February 2025, the EU AI Act has required companies to take measures to support their employees' AI literacy. The basis is a tool register, a usage policy and a role-based training programme.
What are the symptoms?
- Employees enter customer data into public AI tools.
- Departments use different tools, often on private accounts.
- It is unclear who is responsible for selecting tools and for their security.
- The company has no written AI usage policy.
What are the causes?
- 01Bottom-up adoptionThe tools are cheap and instantly available, so they appear in the company before procedures do.
- 02No policyThere is no list of approved tools and no rules for handling data.
- 03No competency programmeTraining is ad hoc, even though the obligation under Article 4 of the EU AI Act has applied since 2.02.2025.
| Headcount | Typical picture |
|---|---|
| 1–49 employees | A short policy and a Workshop for the whole team are enough. |
| 50–249 employees | An owner for the topic and a role-based training programme are needed. |
| 250–999 employees | A tool register, security department approval and competency measurement are needed. |
What questions should the board ask?
- Which AI tools are used in the company, and on which accounts?
- What data goes into these tools?
- Who approves new tools?
Which metrics should you check?
- Share of employees who have received training
- Number of tools outside the approved list
- Number of reported data-related incidents
Which mistakes should you avoid?
- A total ban on AI, which shifts usage to private devices.
- One training course for all roles.
How does the solution work?
Methods: LEMUR AI Readiness Index. The Lemur Compass sets the sequence of actions based on the company's development phase, scale, business model and profitability.
- 01Tool inventoryWho uses which tools, and with what data.
- 02Usage policyApproved tools, data rules, accountability.
- 03Competency programmeRole-based training.
- 04MeasurementAssessment of dimension E in the LEMUR AI Readiness Index every six months.
Where should you start?
AI competency Workshop for the team (1 day).