When cyber, privacy and AI take centre stage, everyday compliance cannot slip

By Deborah Coram, CEO, Safetrac

Cybersecurity, privacy, and AI are dominating board discussions and keeping GRC teams busy for good reason. Organisations are making technology decisions that change faster than their policies, while trying to understand the risks and keep up with regulatory expectations.

The difficulty is finding time for everything else.

A harassment complaint still needs a response. A conflict of interest still needs to be declared. A new employee still needs to understand their responsibilities, even if the person managing induction has spent the week dealing with a privacy incident.

These obligations don’t become less important because something else has become more urgent. Yet in a stretched team, routine work often gets pushed back. Training is postponed, policy updates sit unfinished and overdue enrolments wait for someone to follow them up.

That is how gaps develop, often without anyone consciously deciding to accept the risk.

People need to recognise the risk before they create it

A good compliance training program is one of an organisation’s first lines of defence. It helps employees recognise when an apparently ordinary task needs more care.

Consider someone using an AI tool to summarise a client document. They may try to save half an hour without stopping to consider whether they are permitted to upload the information. A manager using AI to help assess job applicants may not question the assumptions behind its recommendations.

Both may believe they are doing their jobs well.

Clear policies and technical safeguards matter, but employees also need to understand the decisions those controls are intended to guide. They need to know what information they can share, which tools they can use and when to ask for advice.

That makes effective training central to managing cybersecurity, privacy, and AI risk. It also makes risk awareness relevant to everyone, not just the risk team.

The same judgement helps an employee recognise an undeclared conflict, question an unusual supplier request or raise a concern about workplace behaviour. Controlling conduct risk depends on people understanding their responsibilities well enough to apply them.

Clicking through is not enough

The days of accepting tick-and-flick training should be behind us. A course that employees rush through and promptly forget wastes their time and the organisation’s money.

Compliance training needs to hold people’s attention and give them something useful to take back to work. That means realistic situations, decisions to work through and feedback that explains why a response matters. It also means recognising that a manager recruiting staff needs different guidance from someone handling customer data or approving payments.

Interactivity should have a purpose. Asking someone to make a judgement and then explaining the consequences is more useful than asking them to click another button.

The test is what happens afterwards. An employee who pauses before uploading confidential information, checks a suspicious request, or raises a concern early puts their learning into practice.

Completion is important, but it is only part of the picture. Assessments can reveal misunderstandings that need attention. Managers need to reinforce learning through how they work, and employees need to feel able to ask questions without being made to feel foolish.

Investing in compliance training that works, and ensuring it reaches the right people and gets completed, should be front and centre of the organisation’s response to these risks.

Your code of conduct needs attention too. If you haven’t reviewed it to reflect AI-assisted work, now is the time. Expectations about confidentiality, accuracy, fairness, and accountability need to make sense in the situations employees face.

An employee remains responsible for checking their work when AI has helped produce it. That expectation should be clear, supported by practical policies and explained through training. Publishing a revised code and assuming everyone has absorbed it leaves too much to chance.

A strong program needs someone to keep it moving

Even good compliance training cannot help an employee who was never enrolled.

Managing a program involves a steady stream of work: adding new starters, assigning the right courses, arranging refreshers, following up on overdue learning, and preparing reports. None of it is particularly glamorous but all of it matters.

In many organisations, someone already has a full job. When a more pressing issue arrives, the administration waits. If that person leaves, the organisation can also lose the knowledge of how the process works.

Compliance should not depend on one employee’s availability or memory.

This is where Safetrac’s white-glove managed service can make a practical difference. Within an agreed scope, we can manage enrolments and training schedules, monitor completion, follow up on outstanding learning, and prepare reports. The work continues while your internal team handles issues that require its expertise.

It also reduces the need to hire someone specifically to administer the program or absorb that work into an already overloaded role.

The organisation still needs an accountable person. Leadership must approve priorities, provide the information needed to run the program and act when gaps are identified. But that person does not need to manage every enrolment or chase every completion.

With clear responsibilities and reliable employee information, a managed service provides continuity through leave, turnover and competing demands. Your team retains oversight and has more time to exercise judgement.

Keep the evidence as you go

After an incident, organisations are often asked to explain what guidance an employee received and what steps were taken to manage the risk.

Being able to locate the relevant training record, establish when it was completed and show how outstanding requirements were followed up puts the organisation in a better position to answer. It also helps leaders spot a problem before an incident occurs.

Records alone do not establish that an organisation has met every obligation. They support a defensible process when they sit alongside appropriate policies, supervision and action on concerns.

The practical point is to maintain that evidence as part of the normal running of the program. Searching old emails and rebuilding spreadsheets after something has gone wrong takes time and may still leave important questions unanswered.

Prevention deserves a place in the budget

When assessing the cost of a compliance training program, count the work already being done internally. Time spent correcting enrolments, chasing completions and assembling reports is paid time, even when it does not appear under a separate compliance budget.

Then consider what that time could be used for. A legal, HR or GRC professional who spends less time administering training has more capacity to review an AI proposal, resolve a workplace issue or strengthen a privacy process.

A managed service can reduce administration costs and make delivery more reliable. The value is particularly clear when the alternative is a program that becomes inconsistent whenever the business gets busy.

Effective compliance training is also a relatively modest investment compared with the disruption of an investigation, a data incident or a serious conduct failure. It cannot prevent every problem, but it gives employees a better chance of recognising one and responding before the damage grows.

There is no need to wait for the next annual review to check whether your program is doing its job. Look at who is being trained, what they are learning and whether anyone is falling through the gaps. Check that your code reflects how work is actually being done, and that enrolments and reporting would continue if the person managing them left tomorrow.

Cybersecurity, privacy and AI deserve your attention. A reliably managed compliance program helps ensure the rest of the business remains protected while you focus on these emerging risks taking centre stage.