GOVERNANCE SERIES — VOL. 8

AI Training Delivery Log

Records all AI training sessions delivered — who attended, which modules were covered, the delivery method, and the date. Paired with AUP acknowledgements, this document closes the training delivery evidence gap for SOC 2 CC1.4 and CC2.1.

SOC 2 CC1.4 SOC 2 CC2.1 TRAINING EVIDENCE ONGOING LOG ALL STAFF
DOCUMENT OWNER
IT / Security · Governance Lead
LOG STARTED
LAST UPDATED
VERSION
1.0
RETENTION
3 years minimum
01 Purpose

Having training materials is not the same as having delivered training. SOC 2 assessors will ask for evidence that staff were trained — not just that training documents exist. This log records every training session as it happens, building the evidence trail that confirms the program is running, not just written.

This document works alongside the AUP Acknowledgement (Vol. 5). The AUP records that each person agreed to the policy. This log records that they were trained on how to apply it. Together they satisfy CC1.4 (commitment to competence) and CC2.1 (information and communication about internal controls).

WHAT COUNTS AS EVIDENCE A dated log entry with the session format, module covered, facilitator, and attendee list — or individual completion records for async modules. You do not need a learning management system. A consistently maintained log in this format, backed by the AUP acknowledgement signatures, is sufficient for SOC 2 purposes.
02 Training Modules in Scope

The following modules are defined as part of the AI training program. Required modules must be completed by all staff before using any AI tool. Recommended modules are expected within 30 days of AI tool access being granted. Role-based modules apply to specific departments.

REQUIRED — ALL STAFF
AI Prompt Writing Guide
How to write effective prompts, the four-part formula, before-and-after examples, refinement techniques, and what not to include. Vol. 1 of the AI Foundations Series.
⏱ ~20 min 📄 Self-directed reading + tool ✓ Before first AI tool use
REQUIRED — ALL STAFF
What NOT to Put Into AI
Data safety guide covering off-limits data types, safe alternatives, real-world scenarios, and the PII Sanitizer tool. Vol. 2 of the AI Foundations Series.
⏱ ~15 min 📄 Self-directed reading + scenarios ✓ Before first AI tool use
REQUIRED — ALL STAFF
AI Acceptable Use Policy
Full policy review covering approved uses, prohibited uses, data handling rules, human review requirements, tool approval process, and incident reporting obligations.
⏱ ~25 min 📋 Policy read + acknowledgement ✓ Annual renewal
REQUIRED — ALL STAFF
AI Incident Response Overview
Overview of the four incident scenarios, how to report, and who to contact. Staff-level understanding — full playbook detail is for IT / Security. Vol. 2 summary.
⏱ ~15 min 👥 Team session or async video ✓ Annual renewal
ROLE-BASED — IT / SECURITY
AI Automation Oversight Standard
Full review of action tiers, human gate definitions, approval authority, exception logging requirements, and quarterly review responsibilities. Vol. 6.
⏱ ~30 min 📄 Document review + walkthrough ✓ Before overseeing any automation
ROLE-BASED — COPILOT USERS
Microsoft Copilot Safe Use Guide
Copilot-specific guidance: what it can access, how sensitivity labels affect results, safe prompting patterns, and when not to share Copilot output externally.
⏱ ~20 min 👥 Live session recommended ✓ Before Copilot license activation
03 Delivery Summary
0
SESSIONS LOGGED
0
STAFF COMPLETED REQ.
0
PARTIALLY COMPLETE
0
NOT YET TRAINED
TARGET — BEFORE COPILOT EXPANSION 100% of staff complete the four required modules before AI tool access is expanded beyond the pilot group. Required module completion is a gate on the rollout plan — Phase 2 does not begin until Phase 1 staff are fully trained and acknowledged.
04 Staff Completion Tracker

One row per staff member. Check off each required module as it is completed. The completion date column records when all required modules were finished — this is the date that counts for compliance reporting. Link to AUP acknowledgement record where applicable.

NAME ROLE / DEPT PROMPT GUIDE DATA SAFETY AUP IR OVERVIEW ALL REQ. COMPLETE DATE AUP ACK DATE STATUS
05 Session Log

Every training session — live, recorded, or self-directed — gets a log entry here. A session can cover multiple modules. The log entry is the auditable record: what was delivered, who delivered it, who attended, and when.

PROGRAM LAUNCH — REQUIRED MODULES
— · Facilitator: TBD
LIVE SESSION
Modules: Prompt Writing Guide · Data Safety Guide · AUP Overview · IR Overview Attendees: Full pilot group — names in Staff Completion Tracker Duration: ~90 minutes Materials: AI Resource Hub Vol. 1, 2, 5 + incident scenario walkthrough
06 Log a Training Session

Complete this form after each training session. Submissions are appended to the session log above. For async or self-directed modules, log when staff report completion or when the resource is distributed with a documented expectation of completion.

SESSION LOG ENTRY
New Training Session Record
✓ SESSION LOGGED — Entry added to the session log above. Wire to SharePoint AI Training Log list in Phase 1 for persistent storage and Power BI reporting.