Why your AI policy needs a training clause with teeth

Most AI policies contain a training clause that commits to nothing: "staff will receive appropriate training". A clause with teeth names who must be trained, to what level, how competence is tested, when it lapses and what happens to approval rights if it does. Without those five things, the clause cannot be breached, so it controls nothing.

Why do most training clauses fail?

They are written to be agreeable. "Appropriate training" offends nobody and binds nobody. "All staff using AI will complete awareness training" sounds firmer but measures the wrong thing: attendance, not competence. Neither tells a manager what to do on the day a reviewer approves a held payment without the knowledge to judge it.

An AI policy is meant to govern behaviour. For most of its clauses that is obvious: data handling, acceptable use, escalation. The training clause gets treated as a hygiene item, written by HR or learning teams in the language of development, not control. But once people approve what AI agents prepare, training is a control. It decides whether the human check on an agent's work is real.

What does a clause with teeth contain?

Five elements, each of which can be tested.

1. Scope by activity, not job title. Who the clause applies to, defined by what they do: everyone who works alongside agents; everyone who approves held actions at a given depth; everyone who sets the business's limits; everyone who designs or certifies agents.
2. Level for each group. Literacy for the first, certification with observed practice for approvers and supervisors, deeper certification for builders. The guidance on who needs AI literacy under the EU AI Act helps define the groups if you operate in the EU.
3. How competence is shown. A test result for literacy; a current certificate, checkable at source, for approvers.
4. Expiry and renewal. How long each level lasts and how it is renewed.
5. Consequence of lapse or failure. What happens to approval rights when a certificate lapses or a test is failed, and how retakes work.

A sixth element, ownership, makes the rest enforceable: a named role responsible for keeping the list of who holds what, and for reporting it.

What does the consequence clause look like?

This is the part most policies leave out, and it is what gives the clause teeth. A workable version reads something like this:

A person may approve held actions at depth 3 or above only while they hold a current certificate for that role. If their certificate lapses, their approval rights at that level pause on the day of lapse, and held items route to a certified colleague. Rights resume when the certificate is renewed. A person who fails an assessment may retake it in line with the retake rules; their rights remain paused until they pass.

Notice what it does not say. It does not discipline anyone, and it does not stop them working. It removes one specific authority until the evidence supports it again. That makes it proportionate, which makes it usable.

The detail of retakes deserves its own rule. How soon can someone retry? Is there a limit? What support do they get? The guide on what a retake policy is covers the options.

Where do you start if you have no clause today?

With a needs assessment. Before you can say who needs what, you need to know which roles touch agent work and how deeply. An AI literacy needs assessment template gives a structure for mapping roles to activities to levels. Then draft the clause from the result, using an AI literacy policy template as a starting point and adding the consequence section above.

What is the trade-off?

A clause with teeth bites people. Some will lose approval rights temporarily because they missed a renewal. Managers will have to reroute work. HR will need to think about how this interacts with performance processes and contracts. Unions or staff representatives may want to be consulted, and should be.

It can also feel punitive, especially if introduced after something has gone wrong. People may read it as a statement that they are not trusted.

There is a risk of rigidity too. A clause that is too detailed becomes hard to change when the product, the agents or the regulations move.

The answers are in the design. Keep the consequence narrow, limited to approval rights rather than employment. Explain the reason: the agent's own authority is earned and lapses, so the people approving its work are held to a parallel standard. Put the detail, such as specific levels and durations, in a schedule that can be updated without rewriting the policy. And introduce it before go-live, not after an incident.

What should you do differently?

Read your current training clause and ask: could anyone breach it? If not, it is not a control. Rewrite it around the five elements. Add a consequence clause that pauses approval rights on lapse. Name an owner. Put the levels and durations in a schedule. And report against it, so leadership can see coverage of certified approvers separately from overall literacy. The guide to AI literacy and certification for people who work with agents sets out the levels your schedule can refer to.

Where the Academy fits

Pryme Intelligence Academy gives a policy something concrete to point to. The Foundations badge covers broad literacy. Certified Pryme Operator, with its exam and practicum, suits the approver tier and is valid for 12 months, with renewal by update module and short quiz. A team admin view shows progress, results, certificates and expiry dates, which makes the owner's reporting duty practical.