AI and GDPR training for SMEs
Train employees on AI and GDPR, check their understanding and keep a dated record. Then inventory your AI systems, classify their risks and follow a clear action plan.
For HR, legal and DPO leads at European SMEs that use AI.
Each pass creates a dated attestation. The campaign can then be added to your training register.
Run AI-literacy and GDPR-awareness training from the same workspace. Each course gives employees a shared practical foundation, checks understanding and records what was completed.
AI Act · supports Article 4 measures
Identify AI systems, verify outputs, protect data, keep human control and report problems.
12 lessons · 22 questions · about 30 minutes
A common foundation. Article 4 measures must still reflect people's technical knowledge, experience, education and training, the use context, and the people or groups affected.
Data protection awareness
Recognise personal data, use it for a defined purpose, respect people’s rights, keep records and settings current, and report incidents.
12 lessons · 21 questions · about 40 minutes
Supports your privacy programme. It does not replace policies, processing records, rights handling or technical controls.
Targeted alignment · DigComp 3.0
Our two courses cover selected elements from seven DigComp 3.0 competences relevant to work: evaluating information, sharing and creating responsibly, protecting data and access, responding to risks, and thinking critically about AI.
This is partial, documented alignment, not certification or Commission endorsement. It does not cover those seven competences in full, the complete set of 21, or a DigComp proficiency level. Programming, general collaboration, digital wellbeing, environmental impact and technical troubleshooting remain out of scope.
View the official DigComp 3.0 frameworkAdd the relevant employees and choose the course language.
Each employee receives a private email link. No account is required.
Employees learn practical rules for using AI or handling personal data at work.
The quiz records the score. Employees can try again if they do not reach the pass mark.
Each pass identifies the employee, course, version, date and recorded score.
A simple record to retrieve when management, a client, an auditor or an authority asks what was done.
An attestation documents course completion and the recorded result; it does not certify compliance. AI-literacy measures still need role and context tailoring. GDPR compliance still requires the organisation's policies, records and controls.
Choose the problem already sitting on your desk. Both paths lead to the same compliance workspace.
Run the AI-literacy or GDPR-awareness course, track participation, check understanding, retain each employee's attestation and add the campaign to your training register.
Train my team →Take the free diagnostic and receive an initial view of your position, the gaps identified and the next actions to address.
Take the free diagnostic →The same workspace turns broad legal duties into a clear, dated and manageable record.
Record the systems your company uses, their purpose, their owner and the information needed to track them.
A guided assessment helps determine the risk level and preserves each classification as a dated decision.
The duties raised by your classifications feed into a plan showing what needs attention and when.
When a classification remains uncertain, submit the case and request an expert opinion.
For many SMEs, the first issues are staff AI literacy, avoiding prohibited practices and, depending on the use, chatbot transparency, applicable since 2 August.
No prohibited practices, AI literacy measures for staff
Check that people are informed when they interact with a chatbot
Duties for deployers of high-risk systems, depending on the use
You do not need to become an engineer or work through hundreds of pages of regulation alone. normward.com helps you start with the people, uses and evidence that matter.
Are employees using AI or handling personal data? Launch the relevant course and create a useful first record without setting up a complex training project.
The diagnostic, register and classification workflow separate your actual duties from the surrounding regulatory noise.
Sensitive employment uses, biometrics, provider roles and uncertain classifications may warrant specialist review.
The AI Act is dense. These are the answers an SME needs to get started.
