What AI training do managers need before they approve staff use cases?

2 October 2026

The minimum standard is decision competence, not technical expertise

A manager who approves an AI use case is accepting a business risk. They should therefore understand the proposed outcome, the information entering the tool, the people affected, the likely failure modes and who remains accountable. They do not need to explain transformer architecture or write code. They do need to ask: what happens when this output is wrong, biased, incomplete or sent to the wrong person?

A practical baseline is four to six hours of learning split across six topics: AI capability and limitations, data handling, output evaluation, risk classification, human oversight, and incident response. Add two or three supervised approval exercises using real examples from the manager's department. This matters because recognising a definition in a quiz is not the same as rejecting a dangerous workflow in a meeting.

The current Skills England AI Skills Framework treats managerial capability as cumulative. Managers are expected to retain core skills such as AI literacy, prompt writing and output evaluation while also making decisions about strategy, investment and governance. That is a useful standard for a small business: leaders should understand the tool well enough to challenge it, but their main job is to govern its use.

Do not make attendance the pass mark. A manager is ready only when they can review a sample use case, identify its data and operational risks, define an approval condition, and explain when to escalate it. If they cannot do that, they need more practice before they sign anything off.

Managers must understand what AI can and cannot reliably do

The first module should cover capability without hype. Managers need hands-on experience of generative AI producing a strong answer, a subtly wrong answer and a confident fabrication. They should learn why the same prompt can produce different results, why a polished response is not evidence, and why connecting a model to company documents does not guarantee accuracy.

Use examples from the real department. A sales manager can compare an AI-written follow-up against the actual call notes. An operations manager can test extraction from a messy supplier email. A finance manager can inspect a draft variance explanation while keeping the calculation itself in the accounting system. The objective is not better prompting for its own sake. It is learning where professional judgement must interrupt automation.

The need is immediate. The Office for National Statistics reported in July 2026 that AI use among UK businesses with 10 or more employees had risen from about 12% in late 2023 to about 35%. Yet only 10% of AI-using businesses said they used it extensively. That gap suggests many firms are still experimenting, which is exactly when managers form habits that later become informal policy.

Training should finish with a simple rule: AI can draft, classify, summarise, extract, suggest and flag. It should not silently become the final authority for a material decision. Where a use case affects money, employment, rights, safety, a binding promise or a valuable customer relationship, approval must name the qualified person who reviews the result.

Data protection training must be specific to the proposed workflow

Generic GDPR awareness is not enough. Managers need to trace the information through the use case: what enters the AI tool, which supplier receives it, where it is stored, whether it is used for model training, who can retrieve it, and what comes back into company systems. They should recognise personal data, special category data, confidential client material, passwords, contracts, commercial plans and intellectual property.

The Information Commissioner's Office AI governance toolkit says senior management should sign off AI risks, assign operational and technical responsibilities, document privacy measures, and support policies with procedures for staff. It also says a data protection impact assessment should be completed before higher-risk processing starts and kept current when the processing changes.

Give managers a one-page data test. If the use case includes personal data, ask for the purpose, lawful basis, minimum necessary fields, retention, supplier terms and access controls. If it includes special category data, employee monitoring, systematic profiling or decisions with significant effects, stop routine approval and escalate for a DPIA and specialist review. If the proposer cannot say where the data goes, the answer is not yet yes.

This module should include an actual vendor settings exercise. Managers should locate the enterprise privacy controls in an approved tool and compare them with a free personal account. Microsoft, Google and OpenAI publish product documentation, but supplier claims do not remove the employer's responsibility to configure accounts, restrict permissions and train users.

Teach a simple risk classification and approval method

Managers need a repeatable method, not a vague instruction to be careful. A practical approach is to score each use case across five questions: data sensitivity, effect on people, financial or legal consequence, level of autonomy, and ease of reversal. Each question can be marked low, medium or high.

A low-risk example might be drafting an internal meeting agenda from non-confidential notes. A medium-risk example might be suggesting replies to customer enquiries, where an employee checks every message before sending. A high-risk example might be ranking job applicants, changing customer credit terms or allowing an agent to send payments. Low-risk uses can follow a standard manager approval. Medium-risk uses need a written test, named reviewer, sample checking and a rollback route. High-risk uses need specialist review and senior sign-off, and some should simply be prohibited.

The manager should require a short use-case record covering purpose, owner, approved tool, data used, expected benefit, known risks, human review, test evidence, permissions, failure response and review date. A pilot should also have a measurable success condition. For example: reduce weekly triage time from five hours to three without increasing misrouted enquiries above 2% during a four-week test.

This is where training becomes commercially useful. It prevents every idea being sent to an expensive consultant while stopping a confident manager from approving a dangerous shortcut. The free Skills England framework is a sound starting point. A tailored internal workshop typically costs £1,500 to £4,000 for a small management team, while individual external courses commonly cost about £250 to £750 per manager. More expensive certification is rarely necessary for routine SME approvals unless the sector requires it.

Managers need to design human oversight that works in practice

Writing 'human in the loop' on an approval form does not create effective oversight. Training should teach managers to name the person, the evidence they will see, the decision they can change, the time available for review and what happens when they disagree with the AI. A reviewer who is processing 500 outputs an hour is not meaningfully reviewing them.

Managers should learn three levels of control. First, pre-approval: the AI prepares material but cannot act until a person accepts it. Second, exception review: low-risk routine cases proceed, while uncertain or unusual cases are held for a person. Third, post-event sampling: completed low-impact work is checked regularly to spot drift, recurring errors or poor user behaviour. The level should match the potential harm and reversibility.

Every approval also needs a stop control. For a customer reply assistant, that might be disabling the automation and returning the inbox to manual handling. For a reporting workflow, it might be retaining the original data and previous report template. The manager must know who can trigger the stop, how quickly it takes effect and how affected people will be told.

Training should include a deliberately failing scenario. Give the manager an automation that invents a customer refund rule, exposes confidential text in a prompt log or repeatedly misclassifies a vulnerable customer. Ask them to contain the problem, preserve evidence, identify affected records, notify the right owner and decide whether data protection advice is needed. Approval competence is shown most clearly when the happy path fails.

Use short training, observed practice and regular refreshers

A useful programme can be delivered without taking managers away for several days. Start with a 90-minute practical AI literacy session. Add 90 minutes on data, confidentiality and supplier controls, 90 minutes on risk classification and approval, and 60 minutes on oversight and incidents. Finish with two supervised case reviews and a short observed assessment. Spread the modules over two weeks so managers can test the ideas in their own work.

The 2026 Skills England employer guide drew on 23 workshops, 10 case studies and 536 survey responses. It found that more than 44% of organisations reported daily AI use. Although 97% reported providing some training, 51% identified gaps in flexibility, 34% in practical contextual learning, 29% in ethics and governance, and 22% in leadership or organisational support. The message is clear: access to a course is not the same as useful preparation.

Refresh training every 12 months, and earlier when the company introduces a materially different tool, connects AI to new business systems, changes supplier terms or experiences an incident. Review a sample of manager approvals quarterly. If records are incomplete, controls are routinely bypassed or benefits are never measured, the organisation has a governance problem, not merely a training problem.

Free guidance is a valid option for a very small firm if someone can turn it into role-specific exercises. Paid training earns its price when it uses your workflows, documents your approval standard and challenges managers on realistic cases. Avoid courses that focus mainly on prompt tricks, promise instant transformation or award a certificate without observed decision-making.

When this is NOT enough

Manager training is not a licence to approve every AI proposal. It is not enough where a system makes or strongly influences recruitment, dismissal, pay, credit, health, legal, safeguarding or other high-impact decisions. It is also insufficient where an AI agent can move money, delete records, publish externally, change access rights or make binding commitments without a meaningful approval step.

Do not rely on a short course when the business cannot identify a data owner, has no approved tool list, lacks basic access controls, or cannot turn an automation off. Fix those foundations first. Training people to approve use cases inside an uncontrolled environment creates paperwork without protection.

Some organisations will need a data protection officer, employment lawyer, cyber security specialist, regulated professional or experienced implementation partner. That is not an admission that management training failed. Good training helps managers recognise the boundary of their own authority and seek the right support before harm occurs.

If your business is only using AI to brainstorm public information or improve the wording of non-confidential internal material, a lightweight policy and short briefing may be proportionate. If staff are connecting AI to email, CRM, finance, HR or client files, use the full training and approval process. If you want an honest review of where that boundary sits, map one proposed workflow from input to outcome before buying more software. That exercise usually reveals the real training need.

Is This Right For You?

This guidance is right for owners, team leaders and department heads who are being asked to approve ChatGPT, Copilot, Gemini, AI assistants or employee-built automations. It is especially useful where a manager has operational authority but no dedicated IT, security or data protection team.

It is not enough on its own for high-risk deployments involving recruitment decisions, employee monitoring, credit, health, safeguarding, legal advice, regulated financial activity or large-scale profiling. In those cases, involve your data protection lead, HR or legal adviser, security specialist and the person accountable for the affected business process. A short manager course is a screening control, not a substitute for specialist assurance.

Frequently Asked Questions

Do managers need a formal AI qualification?

Usually not. For routine, low-risk use cases, practical role-based training and an observed approval exercise are more useful than a general certificate. Regulated sectors or high-impact decisions may require specialist qualifications or professional advice.

How long should manager AI approval training take?

Allow four to six hours for the core material, plus two or three supervised case reviews. A 30-minute awareness video is not enough for someone who will approve access to customer, employee or financial data.

How much should a UK small business budget for this training?

Budget about £250 to £750 per manager for a good external course, or £1,500 to £4,000 for a tailored workshop, approval checklist and real use-case exercises for a small management team. Free government and ICO resources can reduce the cost if you have time to adapt them.

Who should approve an AI use case if there is no IT department?

The manager who owns the business process should lead the review, with input from the person responsible for data protection, security or compliance. High-risk uses should also go to a director and an appropriate external specialist.

Should managers be allowed to approve their own AI ideas?

Only for clearly low-risk uses under a standard policy. Medium and high-risk proposals should have a second reviewer because the person who designed the idea may underestimate its weaknesses or be invested in the result.

How often should managers refresh their AI training?

Review it annually and whenever a major tool, integration, regulation or supplier term changes. An incident or repeated failure in approval records should trigger an earlier refresher.

What evidence should be kept after an AI use case is approved?

Keep the purpose, owner, tool, data, risk rating, test results, human controls, permissions, incident route, decision, conditions and review date. For personal data or higher-risk processing, retain the relevant DPIA and specialist sign-off.

Can a manager approve staff use of free AI tools?

Only for very limited uses involving public or non-confidential information and where the company policy allows it. Free personal accounts are usually unsuitable for client files, employee data, contracts, financial records or connected business systems.