Your obligations

Three layers of rules apply to you

When you use AI at work, three sets of rules stack up. Each sits inside the one above it and gets more specific as it gets closer to your desk. Understanding the stack is most of the battle.

Layer one: the law

The most developed AI law in the world right now is the EU AI Act. It matters even outside Europe, because it reaches any organisation whose AI use touches the EU market or people, and because other countries are modelling their own rules on it.

The Act takes a risk-based approach. A small number of uses are banned outright. A set of "high-risk" uses, such as AI in hiring or credit decisions, carry heavy obligations that phase in over several years. And one duty is broad and already in force:

In plain terms: if your organisation operates in or sells into the EU, someone is now responsible for making sure staff who use AI actually understand it. A course like this one, plus a record of who completed it, is a straightforward way to meet that.

Layer two: government and sector policy

In Australia, the Policy for the responsible use of AI in government sets the standard for public-sector bodies, and it is moving from principles to hard requirements:

• Mandatory responsible-AI training for all staff, due by 15 December 2026, alongside accountable use-case owners, a register of AI use cases and impact assessments.
• Accountable officials and transparency statements, so each agency names who is responsible and explains publicly how it uses AI.

For the private sector, Australia has published voluntary guidance rather than binding rules: the Guidance for AI Adoption (October 2025) updated the 2024 Voluntary AI Safety Standard into six essential practices, and the National AI Plan relies on existing laws and sector regulators, with targeted new laws only where needed. Two things follow for most workplaces: if you supply government, these expectations flow down to you through contracts, and the voluntary guidance is widely treated as the sensible baseline to adopt early.

Layer three: your organisation's AI policy

This is the layer that governs your actual day, and the one to read first. A good workplace AI policy answers four questions:

• Which tools are approved? Use those. This is the shadow-AI point from module two.
• What data is allowed? The green, amber, red split, made specific to your organisation.
• When must you disclose AI use? Many policies require you to be transparent when AI materially shaped something a customer, colleague, or the public relies on.
• What must be recorded? Some work needs a trail of what AI did and who approved it. Module five is about exactly that.

If your organisation does not have an AI policy yet, do not treat that as permission. Act as if the strictest of the rules above applies: approved tools only, sensitive data out, be transparent, keep a record.

What good looks like for you

You do not carry the whole legal weight. Most of it sits with your organisation. Your part is simple and consistent:

• Use approved tools, and keep sensitive data out of general ones.
• Be transparent that AI was involved where it genuinely matters.
• Keep the human judgement, and be able to explain decisions in your own words.
• Complete the training your organisation asks for, and keep the record.

Sources: European Commission, AI literacy questions and answers; EU AI Act Article 4; Australian Government, Policy for the responsible use of AI in government and Guidance for staff training on AI. This module is general information, not legal advice. Dates and requirements change, so check the primary sources for your situation.