What it means
- Everyone who uses, buys, builds or oversees AI knows enough to do it safely. Training is matched to role.
- All staff: what the AI policy says, approved tools, never paste customer or confidential data into unapproved tools, how to spot wrong AI output, how to report concerns.
- Builders and validators: bias, testing, drift, security risks such as prompt injection.
- Board and senior management: enough understanding to challenge AI proposals and risk reports.
- Staff who review AI decisions (human oversight): when and how to override.
Why it matters
- RBI FREE-AI asks for AI competence at board and C-suite level and ongoing training for staff who use AI.
- Most AI incidents in mid-size firms start with a well-meaning employee, not a hacker.
- Human oversight only works if the human understands what the AI can get wrong.
Checklist
- Build a training matrix: role, required modules, frequency.
- Add a short AI module to annual security awareness training for all staff.
- Run deeper sessions for developers, data scientists, model validators and AI system owners.
- Run at least one board or leadership AI briefing per year (risks, regulation, the company's AI inventory).
- Train reviewers of AI decisions on override criteria.
- Track completion in the LMS and chase non-completion.
- Refresh content when the AI policy or key regulations change.
Evidence examples
- AI training matrix approved by HR and the AI risk owner.
- LMS completion report for "Safe use of GenAI" module (for example 94% completion this year).
- Board briefing deck and attendance in board minutes.
- Training records for model validators and AI developers.
Common pitfalls
- One generic video for everyone, nothing for builders or the board.
- Training once at launch, never refreshed.
- No link between training and the approved tools list, so staff still do not know what is allowed.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- SupervisoryPRA SS1/23
- VoluntaryNIST AI RMF and GenAI Profile
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- SupervisoryOSFI E-23
- VoluntaryRBI FREE-AI
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 7.2 Competence
- 7.3 Awareness
- A.4.6 Human resources
ISO/IEC 27001
- A.6.3 Information security awareness, education and training
SOC 2
- CC1.4
- CC2.2
Key takeaways
- Train by role: all staff, builders, reviewers, and the board each need something different.
- Partial reuse from ISO 27001: your awareness programme and LMS tracking (A.6.3) carry over; the AI content and board-level competence are new.
- Refresh training when the AI policy or regulation changes.