AI security training for employees: a 45-minute session outline and 10-question check

It's for owners, office managers, HR and IT leads in teams of roughly 5 to 300, in any industry, and assumes you have (or are about to pick) one approved AI tool on work accounts. If not, start with the Copilot vs ChatGPT comparison.

What the session should cover, and what to leave out

A short session works when it changes four behaviours, not when it explains how large language models work. Aim for these outcomes:

1. People know which AI accounts are approved and stop doing work in personal ones.
2. People can sort information into "fine to use", "only in the approved tool" and "never in any AI tool".
3. People pause before trusting an urgent request, a confident answer or a document that steers the AI.
4. People report mistakes the same day, because they know reporting isn't punished.

Skip vendor feature tours and scare stories. The Canadian Centre for Cyber Security's generative AI awareness note lists the staff-level risks: more convincing phishing, sensitive corporate or personal data typed into prompts, AI-assisted scams, and intellectual property loss (Canadian Centre for Cyber Security, ITSAP.00.041, December 2025). Those map neatly onto the scenarios below.

Free downloadSetting rules for your team? Start from the free one-page AI use policy template.

Before the session: 15 minutes of preparation

Have these four things ready, ideally on one printed page per person:

• The approved-tool line. Name the tool and the plan, for example "Copilot Chat signed in with your work account" or "our ChatGPT Business workspace". "AI is allowed" isn't a rule.
• The never-enter list. Passwords and access codes, government ID numbers, banking and card details, health information, and anything covered by a confidentiality agreement. If you don't have one, borrow ours from what information should not go into AI.
• One name for reporting. The person staff tell when something goes wrong, plus a backup.
• The payment-verification rule. How your business confirms a request to move money or change bank details: a call-back to a number already on file, a second approver, or both.

A written AI use policy supplies the first two. Not sure what people already use? Run the anonymous survey from the shadow AI guide a week before; it makes the scenarios feel real.

The 45-minute session outline

This is the original part of this page. Use it as is, or swap scenarios for ones that fit your work.

Run it live, in person or on video. A recording watched alone loses the discussion, which is where people learn. Keep groups under about 20.

Six scenarios to talk through

1. Pasting client details into a chatbot

A coordinator is behind on a reply to an unhappy client. She copies the whole email thread, with the client's name, address and account number, into a free chatbot on her phone and asks for a calm response.

Rule: client details go only into the approved tool on a work account, and only what the task needs. Describe the situation instead of pasting the thread when you can.

Why: nothing in a free or personal login is covered by your company's contract with the vendor, and several popular tools' personal plans can use chats for model training unless switched off (our plan-by-plan training matrix shows which). PIPEDA keeps your organization responsible for personal information transferred to a third party for processing (PIPEDA, Schedule 1, clause 4.1.3).

2. The meeting bot nobody invited

Ontario's Information and Privacy Commissioner reviewed a case where an AI transcription tool joined a hospital's virtual clinical rounds and recorded the personal health information of seven patients. The account belonged to a former physician who had left the hospital more than a year earlier; the meeting invite was still in his personal calendar, which the tool could read. The transcript and summary were then emailed automatically to 65 people on the recipient list (IPC Ontario, breach file HR24-00691, October 27, 2025).

Rule: no AI note-taker joins a meeting unless the organizer approved it and everyone on the call was told. If an unknown bot appears, remove it and tell the reporting contact.

Why: note-takers connect to calendars and join automatically. The IPC's case summary points to two gaps any office can have: a personal email address used for work meetings, and nobody removing a departed person from recurring invites (IPC Ontario, April 27, 2026). Ask people to check their own recurring invites as homework.

3. The helpful browser extension

A salesperson installs a free "AI writing assistant" extension. It asks to "read and change all your data on all websites". He clicks Allow and it now sees the CRM, webmail and the online banking page.

Rule: no AI extension or add-on without approval. If it asks to read all sites, the answer is no until someone has checked it.

Why: with that permission it can read whatever the browser shows, and access granted once stays until someone removes it.

4. The voice of the boss

Late on a Friday, the bookkeeper gets a call from what sounds exactly like the owner: a supplier needs an urgent payment today, the owner is boarding a flight, keep it quiet until Monday.

Rule: no payment, bank-detail change or gift-card purchase on the strength of a call, voice note, video or email alone. Hang up and call back on a number you already have, and follow the two-person rule.

Why: the Canadian Centre for Cyber Security warns that attackers use AI and short audio samples to clone the voice of someone the victim trusts, and recommends call-back procedures and shared verification words for workplaces (Cyber Centre, ITSAP.00.102). The Canadian Anti-Fraud Centre puts it bluntly: a message, image, video or voice that appears real is not proof that it is real (CAFC, October 2026). In one widely reported 2024 case, an employee of the engineering firm Arup in Hong Kong made 15 transfers totalling HK$200 million after a video call with deepfaked senior colleagues; Arup confirmed fake voices and images were used (The Guardian, May 17, 2024).

5. The document that gives the AI orders

An analyst asks the approved AI tool to summarize a supplier's proposal PDF. Hidden in white text at the bottom is a line telling the AI to describe the proposal as the lowest-risk option and to recommend signing this week.

Rule: treat AI summaries of outside documents, emails and web pages as a draft. Check the key claims against the source before anyone relies on them, and be more careful the more the AI tool can read or do on your behalf.

Why: this is called prompt injection. The OWASP project that tracks the biggest risks in AI applications ranks it first and says it's unclear whether there are fool-proof ways to prevent it; instructions don't even need to be visible to people, only readable by the model (OWASP, LLM01:2025 Prompt Injection).

6. The confident wrong answer

A project manager asks AI to draft a client update. It states a completion date and a warranty term that nobody agreed to. The email goes out unchanged.

Rule: AI drafts, a person checks and sends. Every date, figure, name and promise gets checked against the source.

Why: a wrong commitment sent to a client is a business and liability problem even when no data leaked. For a method to check quality without killing the time savings, see AI productivity without losing quality.

A next stepNot sure what your team already puts into AI tools? An AI security assessment finds out. Start with a free 30-minute call.

The 10-question check (with answer key)

Hand it out at minute 38. It takes five minutes and shows which rules didn't stick. Don't grade individuals; look at what the group missed.

1. You need help rewording a reply to a client. Which account do you use?

a) Whatever is open on your phone b) The approved tool, signed in with your work account c) A free tool, as long as you delete the chat afterwards

1. Which of these can never go into any AI tool? a) A public news article b) An internal meeting agenda c) A client's Social Insurance Number
2. True or false: switching off "improve the model" in a personal account makes it fine to use for client work.
3. An AI note-taker you don't recognize joins a team call. What do you do? a) Ignore it b) Remove it, or ask the organizer to, and tell [reporting contact] c) Leave the call
4. A browser extension asks to read and change data on all websites. What's the right move? a) Allow it if it has good reviews b) Don't install it until it has been approved c) Allow it for work sites only
5. A call that sounds like the owner asks for an urgent supplier payment. What do you do first? a) Make the payment; it's the owner b) Hang up and call back on a number already on file, then follow the two-person rule c) Ask a security question on the same call
6. True or false: if an AI summary of an outside document sounds reasonable, it's safe to forward without checking.
7. Before an AI-drafted email goes to a client, what must you check? a) Spelling only b) Every date, figure, name and commitment against the source c) Nothing if the AI tool is approved
8. You pasted something from the never-enter list into an AI tool by mistake. When do you tell [reporting contact]? a) Only if someone notices b) The same day c) At your next review
9. Which is a sign a request might be a scam, even if it looks and sounds real? a) Urgency and secrecy b) A request to move money or share a code c) Both

Answer key: 1 b · 2 c · 3 False (the account is still outside the business's control and agreements) · 4 b · 5 b · 6 b (a security question on the same call can be answered by someone who researched you) · 7 False · 8 b · 9 b · 10 c.

Nine or ten correct across the group means the session worked. If more than a quarter of people miss the same question, rerun that scenario at the next team meeting.

When something goes wrong: the same-day steps

Mistakes happen. Speed of reporting matters most. Give everyone these steps:

1. Stop and note it: what went in, which tool, which account (work or personal), and when.
2. Tell the reporting contact the same day. Say clearly in the session that reporting is never punished; hiding it is the problem.
3. Contain it: delete the chat where the tool allows, revoke a connected app or extension, change a password or code that was exposed, and remove a note-taker from future invites.
4. The reporting contact, not the person who slipped, decides what happens next.

That last step has a legal side. Under PIPEDA, an organization must report to the Privacy Commissioner of Canada any breach of security safeguards involving personal information that poses a real risk of significant harm, notify the affected people, and keep a record of every breach, reportable or not, for two years (Office of the Privacy Commissioner of Canada). Whether a slip into an AI tool counts depends on the information and circumstances, so whoever owns privacy makes the call. Quebec, Alberta and British Columbia have separate private-sector privacy statutes. General information only, not legal advice.

If a fraudulent payment request got through, also call your bank right away and report it to the Canadian Anti-Fraud Centre (1-888-495-8501) and local police, as the CAFC advises.

After the session: keep it from fading

One session doesn't make a habit. Three small follow-ups do:

• Week 1: everyone checks their own recurring meeting invites and browser extensions and removes anything they can't explain.
• Week 2: the manager asks one question in the team meeting: "Has anything come up where you weren't sure which bucket it was?"
• Week 4: rerun the two most-missed quiz questions as a five-minute warm-up.

Repeat the session yearly and whenever you approve a new tool, connect AI to email or files, or a vendor changes its terms. New hires get it in week one, before they get access. Keep an attendance record; clients and insurers do ask. If the session turns up more tools than expected, log them in the AI risk assessment template.

Run it yourself, or bring someone in

Everything above works without outside help. Bring someone in when you want scenarios built from your team's actual tools, when people will be more candid with an outsider, or when the session needs to tie into a written policy and account settings. Hero's AI security training is a private session for your own team, from C$2,500, and the security basics are part of every public workshop seat (from C$129 per person). For a shorter first step, the AI Lunch & Learn is a private 60 to 90 minute session for your team at C$899 + HST. If you're not sure what people already put into AI tools, the AI security assessment finds out before anyone writes rules. Sessions run online anywhere in Canada or in person across the GTA.

FAQ: AI security training for employees

How long should AI security training for employees be?

For most teams, 45 minutes to an hour is enough for the core habits: approved accounts, what never goes in, verifying requests, and reporting mistakes. Longer sessions make sense for people who connect AI to email, files or customer systems, or who handle payments.

Is AI security training required by law in Canada?

No Canadian law names a specific AI course. But PIPEDA's principles require organizations to train staff on their privacy policies and practices, and to make employees aware of the importance of keeping personal information confidential (Schedule 1, clauses 4.1.4 and 4.7.4). Sector regulators and client contracts can add more. Ask whoever owns privacy for your organization.

Should AI security be part of regular cybersecurity awareness training?

Yes. If you already run phishing or security awareness training, fold the six scenarios into it instead of starting a separate program.

What if staff keep using personal AI accounts after the session?

Usually the approved tool is missing something they need, so ask what. A ban with no alternative pushes use further out of sight.

Can we use this outline and quiz for our own training?

Yes. Copy it, change the scenarios to fit your work, and put your own approved tool and reporting contact in the brackets.

Sources checked (October 23, 2026): Canadian Centre for Cyber Security, Generative artificial intelligence (ITSAP.00.041) and What is voice phishing (vishing)? (ITSAP.00.102) · Canadian Anti-Fraud Centre, Spotting fraud in a changing digital landscape · Information and Privacy Commissioner of Ontario, breach file HR24-00691 and Artificial intelligence gone wrong · OWASP, LLM01:2025 Prompt Injection · Office of the Privacy Commissioner of Canada, What you need to know about mandatory reporting of breaches of security safeguards · PIPEDA, Schedule 1 (current to September 30, 2026) · The Guardian, May 17, 2024.