Copilot Training by Team, and the AI Literacy Record

What the AI Act asks for

Article 4 of the EU AI Act has applied since 2 February 2025. Regulation (EU) 2026/1744, the Digital Omnibus on AI, rewrote it, and the new text has been in force since 27 July 2026. It now says that providers and deployers "shall take measures to support the development of AI literacy of their staff", and adds that it does not oblige anyone to guarantee a specific level of AI literacy for any individual, as Germany's market surveillance authority, the Bundesnetzagentur, quotes it. In plain terms, the AI Act requires measures that support AI literacy, sized to the role and the risk.

The European Commission's AI literacy questions and answers, updated on 20 October 2026, fill in the practical side. There is "no need for a certificate", and there are "no strict requirements or mandatory trainings". Organizations "can keep an internal record of trainings and/or other guiding initiatives", and supervision and enforcement apply from 2 August 2026. Measures should fit what staff already know and the context and risk of the system they use. The Bundesnetzagentur adds that measures should be documented, including their type, content, duration and participants.

For a company rolling out Microsoft Copilot (formerly Microsoft 365 Copilot), that means two things. Everyone who uses it needs some measure fitted to their role, including contractors and others who use the systems on the company's behalf, and the company should be able to show what it did. A one-hour webinar for all staff is a measure, but it is hard to argue that it is sized to the role of a contracts manager and a sales rep alike.

The evidence on training, such as it is

No public study compares role-based Copilot training with generic sessions, and what exists is observational. The UK government's cross-government Copilot experiment, with 20,000 staff in 12 organizations from September to December 2024, concluded that "training was essential to achieve benefits of the tool", and found that professions less familiar with AI saved less time. HM Revenue and Customs, in its Copilot evaluation published in July 2026, recorded users asking for "more practical and tailored training and time to learn", and 46 percent of non-users citing security and data privacy concerns. BCG's AI at Work 2025 survey of more than 10,600 employees found regular use sharply higher among people with at least five hours of training, a correlation that does not show the training caused the use.

Staff in these studies asked for training on their own work, and the people who got more of it used the tool more. Our earlier paper Past the stall makes the adoption case at length, so this post sticks to the structure of the training and the record. The paper Copilot after rollout treats training as one of the controls on agents.

Four layers of training

AI basics for everyone. Every employee who can open Microsoft Copilot Chat, included with Microsoft 365 business and enterprise plans, needs the same short grounding: what the tool does with company data, what the AI policy allows, where answers go wrong and how to check them. Microsoft's Copilot Academy in Viva Learning is open to all Microsoft 365 users through the Viva Learning plan included with Microsoft 365, and covers the product side well. The company's own part is the policy and its examples of what not to paste.

Copilot training per team, on that team's work. Finance learns on its own month-end files and sales on its own account plans. Each session uses the team's real documents and recurring tasks, is built with someone from the team, and ends with each person having done one piece of their actual work with Copilot. Executives get a shorter version on preparing for meetings and reading long documents. Because the content differs by role and by the data each team handles, this layer does most of the work of fitting measures to role and risk.

Worked example. A finance team's session could start with last month's variance commentary. Each person asks Copilot to draft the commentary for one cost center from the actual workbook, then checks every number against the source before anything is kept. The trainer collects the prompts that worked into a short team guide, which becomes the starting material for the next person who joins the team.

Maker training. People who build agents beyond their own use need training on the guardrails that apply at their level: the data they may connect, the review before publication, the owner's duties and the retirement rule. Tie it to the maker levels in the AI policy, as set out in our guide to citizen-built agents, so that passing the course is what moves someone up a level.

IT handover. The people who will run the controls after the rollout, from DLP alerts to agent requests, need training on the Microsoft 365 setup as it was actually configured, with the runbook in hand. Skip this layer and the controls drift once the project team leaves, because nobody left in the building knows why a setting is the way it is.

The literacy record

The record does not need to be elaborate. For each layer, keep the type of measure, its content, how long it took, who attended and the date, which matches what the Bundesnetzagentur says to document. Store it where HR already keeps training records and link it to the AI tool register, so you can show which tools each group was trained on. For contractors, record how they receive your guidance and what their own employer covers. Update it when a tool or a role changes. Our recommended evidence, which goes beyond what the law strictly asks, is a completion entry for each user before their first access to Copilot.

Our guide for insurance brokers on the AI literacy duty shows what a small firm's record looks like. The other AI Act dates, including the high-risk obligations from 2 December 2027, are in our guide to the EU AI Act and AI agents, and training's place in the wider operating model is in our page on the agentic AI operating model.

Usage data is a separate matter and needs care. Copilot usage reports show who uses the tool and how much. In Germany, using them to judge individual performance engages the works council's co-determination rights, so settle in the works agreement whether and how they may be used. Our post on Copilot and the works council in Germany covers the agreement.

The case for generic training

Generic training has real advantages. Copilot Academy comes at no extra cost and stays current with the product, while per-team sessions take time from a senior person in each team to build. For a small company with a handful of similar roles, Copilot Academy plus a policy briefing and a named champion per team may be all it needs, and the literacy record works the same way. The case for per-team training grows with the number of distinct roles and with how sensitive the data is, which is also how the AI Act sizes the duty.

Where QueryNow fits

QueryNow builds and runs this training as part of our Copilot AI Foundation service, starting with the basics layer and your AI policy. We build sessions around each team's own documents and train makers on your agent rules. IT receives the configured controls and the literacy record at handover. Our Microsoft 365 work includes the digital workplace for Rockwell Automation, which serves more than 28,000 employees.