Module 01 · 7 min read · Free sample
Purpose of the course.
One paste. One unchecked answer. One video call. Each has already cost a business its money, its clients or its name, and each began with an ordinary person doing an ordinary job. None of these companies built AI. They just used it.
- Spot the three main ways AI can cause trouble at work
- See why "I was just trying to save time" can be a very costly thing to say
- Work out how risky your own AI use is right now
What one mistake costs
Nothing below needed a hacker. Each began with a normal worker, a normal tool and a deadline.
Sent by one finance worker after a video call in which every other face was an AI fake. Fifteen payments, and nobody checked until it was too late.
Or 4% of worldwide turnover if that is higher: the legal maximum fine for a UK business that mishandles personal data.
How long a business has to tell the regulator about a serious personal data breach once it knows. The clock does not wait while you work out which AI tool was involved.
Invented by a chatbot and filed in a real court by real lawyers, who were fined and named in a judgment anyone can read.
The firm that lost the $25 million has thousands of staff and its own security team. It still lost the money. A firm of twenty has no such cushion: one lost client, one fine or one payment to a fraudster can be the difference between a good year and no business at all.
What did you paste into an AI tool last week? Who else can read it now, and for how long?
If your biggest client asked today how your firm controls its use of AI, what would you show them?
If your finance director appeared on a video call right now and asked for an urgent payment, how would you know it was really them?
Most people cannot answer all four. That is the gap this course closes, and the three stories below are what the gap looks like when it opens. Story three is told as it was reported. Stories one and two are composites of documented incidents, with the details changed: staff pasting confidential data into ChatGPT (as at Samsung in 2023) and lawyers filing cases an AI invented (as in Mata v. Avianca).
Story one: the helpful intern
An intern at a delivery company has a messy list of customers to tidy up. The list has 40,000 rows: names, home addresses, and what each person ordered. The intern pastes the whole thing into ChatGPT and asks it to clean and sort the list. It comes back neat. Their boss is pleased.
Six months later, a security researcher spots a problem. Chats that are shared by link have been picked up by search engines before. The company's customer list turns up on Google.
Now the company has to pay. A letter from the regulator. A warning to every customer. A year of free ID-theft protection to say sorry. And one big client walks away. The intern keeps their job. The manager who said "just figure it out" does not.
The intern was not being careless. They used a tool that sits on every laptop in the office. People talk about it at lunch. No rule said not to. The real mistake happened higher up: nobody had decided which information was safe to put into which tool.
Story two: the lawyer who didn't check
It is Tuesday afternoon at a small law firm. A lawyer is running late on a court document. They ask ChatGPT for past cases about a contract argument. ChatGPT gives back six cases that look perfect: names, years, courts, rulings. The lawyer puts all six in the document.
The judge checks them. Not one is real. The AI made up six cases that only sounded true.
The cost comes fast. A public telling-off. The firm's name in the news for the wrong reason. Two clients leave. And a big dent in the lawyer's career.
This has happened in the US, the UK, Canada and Brazil. The first famous one was a case called Mata v. Avianca. Many have followed.
Story three: the fake boss on the video call
A worker who handles payments at a Hong Kong company joins a video call. On the call are the finance boss and several other senior people. The worker has been told a confidential deal is under way. On the call, the finance boss tells them to send some urgent payments. They add up to 25 million dollars.
Every face on that call was fake. AI made the finance boss's voice and face. It made the other people too. The worker sent the money. It vanished.
This really happened, in early 2024, to a real engineering firm called Arup. The trick is now cheap and quick, and it shows up more every few months. The worker did everything the old training said: they were wary of the first message, joined a video call to be sure, and saw faces they knew. The training was built for a world that has changed.
What these stories share
Each time, good staff used normal tools in normal ways. No hackers. No viruses. Nothing most people would call an attack. The safety rules around those tools were years out of date.
AI risk comes in three main shapes. This course covers all three:
The three shapes of AI risk. Select a shape above, each one maps to later modules in the course.
"But I only use AI to write emails"
Most people on this course use AI. They do not build it. They write emails, draft proposals, sum up meetings, fix wording, translate, code, plan, and think out loud.
That is exactly who these rules are for. The rules and standards behind this course (the EU AI Act, ISO/IEC 42001 and the NIST AI RMF) cover any company that uses AI to do its work. The duty lands on the people doing the work, not only the IT team.
Personal data must be handled in a way that is lawful, fair and open. Paste it into a tool whose rules you have not read, and you break all three. A company must protect personal data the whole time it uses it. The EU AI Act (Article 4) says employers must take measures to support their staff developing enough know-how to use AI safely. Since the Digital Omnibus on AI came into force on 27 July 2026 it is an obligation of effort, not of result: it does not require any individual to reach a set standard. This course is one of those measures.
What this course will not do
This course helps you spot AI risk and dodge the common mistakes. It will not turn you into a compliance officer. It will not certify anything. It will not tell you which AI tools to buy. And it will not pretend the rules are simpler than they are.
Finish it, and workmates start asking what you think before they hit send. That is what the rules look like on a normal Tuesday.
- Open the AI tool you use most. Find its privacy settings: the part about "data controls" or "data sharing". Just find them. You do not have to read it all yet. Module 2 comes back to this.
- Think of one time last month when you pasted something into an AI and a small voice asked "should I be doing this?". Keep that moment. Modules 3 and 11 turn that voice into good judgement, not worry.