Copilot and ChatGPT Training for Staff: A UK Guide

Copilot training for staff should teach four things: what Microsoft Copilot or ChatGPT can and cannot do, how to prompt it for the work people actually do, how to check what it produces, and what information must never go into it. Give everyone the same safe foundation before or as they get access, then add short lessons for each role. Without that, you risk paying for licences people rarely open while others carry on using personal AI accounts with work data.

This guide is for operations, HR and IT leads whose organisation has rolled out Copilot or ChatGPT, or is about to.

A note on names: Microsoft has renamed its Copilot products more than once, so you may see different names in your licences and apps. Here, Copilot means the work version inside apps such as Word, Excel, PowerPoint and Outlook.

Why Copilot and ChatGPT rollouts stall without training

The tools look simple, a chat box and a button in Word, so it is tempting to switch them on and let people explore. Without training, these problems tend to follow:

• People ask the wrong way. A one-line request gets a generic answer, the user decides AI is no use for their job, and the licence sits idle.
• People trust it too much. Generative AI writes fluently even when it is wrong, and a summary with a wrong figure can go out under someone’s name.
• Data goes where it should not. Staff paste customer emails into a personal account because nobody told them not to. Copilot adds a second risk: it can draw on any content the user already has permission to view, so files shared too widely across SharePoint or Teams become much easier to find.
• Shadow AI carries on. If staff do not know which tool is approved, they go back to whatever they used before.

Training is the part of the rollout that changes what people do. It works best alongside two other pieces of work: tidying up who can see what in Microsoft 365, and writing a short AI policy.

What good Copilot training for staff covers

What the tools can and cannot do

Staff need a plain explanation of how generative AI produces an answer. It predicts likely text from its training and from whatever context it is given, which is why it can sound certain and still be wrong. It does not know your policies unless someone has given them to it.

They also need to know what their version can see. Microsoft says Copilot works with content in Microsoft Graph, such as emails, chats, meetings and documents the user has permission to access. For ChatGPT, ask your administrators which features are switched on in your workspace, and tell staff.

Prompting for real work tasks

Generic prompts get generic answers. In our courses we teach a four-part prompt:

1. Context: who you are and what is going on.
2. Audience: who the output is for.
3. Task: exactly what you want done.
4. Format: length, structure and tone.

“Write an email about the price increase” produces something bland. Add the context (prices are rising because of wage costs), the audience (a long-standing client), the task (explain the increase and offer a call) and the format (under 150 words, UK English), and the first draft is close to usable. Then get people practising on tasks from their own job, including giving the tool the source document instead of asking it to work from memory.

Checking outputs and spotting hallucinations

Microsoft’s own documentation says generative AI responses are not guaranteed to be 100% factual, and that users should use their judgement before sending output to others. Teach a simple routine:

• Check every figure against the source.
• Open every reference and link, because invented sources are a common failure.
• Read summaries of important documents and meetings against the original.
• Take most care where the output affects a person, money, a legal position or safety.

The rule underneath is that the person who sends it owns it.

What not to paste

We teach a quick check before pasting as a traffic light rule:

• Green is public or non-sensitive information, such as published material or a general question. It can go into any AI tool your organisation has approved.
• Amber is internal information, such as project plans and anonymised data. It goes only into approved tools, signed in with a work account.
• Red is personal, confidential or secret information: details about customers or colleagues, HR and health records, client material under NDA, unreleased financial results, passwords and keys. It never goes into AI unless that specific tool and use have been approved for it.

Before pasting anything, staff should strip out names, round the figures and share only what the task needs.

Using your approved tools and settings

Generic courses cannot cover this, because it depends on your setup. Staff need to know which tools are approved and for what, and that work goes through their work account. With Copilot, that includes what your administrators have enabled: Microsoft explains that admins choose which agents are allowed, that web search sends a generated query to Bing, and that admins can set retention policies for Copilot chats in Microsoft Purview. With ChatGPT, it means using the workspace your organisation manages.

Role-specific use cases

After a shared foundation, people learn fastest from examples drawn from their own work:

Team	Good places to start	Take extra care with
HR	Job advert drafts, policy summaries, interview questions	Anything about an identifiable employee or candidate
Finance	Commentary from anonymised figures, spreadsheet formulas	Every number, and unreleased results
Operations	Procedures from notes, meeting actions, supplier emails	Safety instructions without expert review
Customer service	Reply drafts and knowledge articles	Customer personal data
IT	Explaining scripts, drafting documentation	Passwords, keys and security settings

What UK GDPR means for Copilot and ChatGPT prompts

The guidance on AI and data protection from the ICO (now formally the Information Commission) works through how UK GDPR applies to AI, with chapters on accountability (including data protection impact assessments), transparency, lawfulness, accuracy, fairness, security and data minimisation. The ICO says it is under review following the Data (Use and Access) Act 2025, so watch for updates.

In its response to its generative AI consultations, the ICO says plainly: “There is no ‘AI exemption’ to data protection law.” The law applies to personal data even when processing it is incidental or unintentional, and personal data is a broader idea than “personally identifiable information”. A pasted email thread with a customer’s name in the signature counts.

So training needs to help staff recognise personal data, including special category data such as health information, remove details the task does not need, and check anything AI writes about a real person before it is used.

On the supplier side, Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models behind Copilot. That does not cover access inside your own organisation, which is why Microsoft stresses getting permissions right. If you use ChatGPT, check which plan your staff are on and what your agreement says about data use and retention, and keep work out of personal accounts.

Does the EU AI Act require Copilot training?

If your organisation has an EU connection, such as an EU subsidiary or branch, or AI output used in the EU, Article 4 of the EU AI Act applies. Since 27 July 2026 it requires providers and deployers of AI systems to “take measures to support” the AI literacy of their staff. It sets no specific level, an internal record of training is enough, and everyday use of tools like ChatGPT is covered.

Our guide to AI literacy training for employees explains the scope, the July 2026 changes and the UK position in detail.

A five-step plan for rolling out Copilot or ChatGPT training

1. Start with a pilot group. Pick people from several teams, including a few sceptics. Give them some weeks with the tool and the core training, and collect what helped, what did not and every question they asked.
2. Write a short AI policy. Cover the approved tools, what information can go into each, what always needs human review and how to report a mistake. Keep it to a page or two, using our AI policy for employees outline as a starting point.
3. Train everyone before or as they get access. Start with the safe-use foundation, then the guide for your licensed tool, then role-specific lessons. Record who has completed what. For Microsoft Copilot, our Microsoft Copilot training plan sets out what staff learn at each stage, and for ChatGPT, our guide to using ChatGPT safely at work covers the settings and rules.
4. Appoint champions. One person per team who shares prompts that work, answers everyday questions and feeds problems back to IT.
5. Measure use and results. Track weekly use (ask IT what usage reporting your licence includes), training completion, real examples of time saved, and the incidents people report. Review every quarter, because the tools keep changing.

How the Capytech AI Academy fits

The Capytech AI Academy was built for this kind of rollout. Lessons take 5 to 10 minutes. Everyone starts with the AI Licence, about an hour in eight short lessons covering the traffic light rule, approved tools and shadow AI, personal data and UK GDPR, and checking AI output. The Licence is renewed every year. After that come the stages of the core journey, seven role tracks and short guides for Copilot, ChatGPT, Claude and Gemini.

The Academy is model-agnostic: you choose your AI provider and the core lessons work with it, so the training still holds if you use both Copilot and ChatGPT or switch between them. We can build your own AI policy into the Licence and add lessons on your approved settings. The Academy can be translated, with examples localised for each country. Ask us about the languages you need.

It runs on the Capytech LMS, where the dashboard shows who has completed what and when, which gives you a record of training for Article 4 and for your auditors. Pricing is per person, so cost depends mainly on how many people you train, the plan you choose and any add-ons, such as your own policy lesson. A taster with a small group fits step 1 of the plan above.

Frequently asked questions