What should you decide before inviting anyone?

Decide the owner, the first group, the approved tools, the information rules, the first tasks and the reviewer before the first invitation goes out. A learner should never have to guess whether a document is allowed in a tool or whether a generated message can be sent without approval. Write the answers down on one page.

Use fictional or explicitly approved material in early practice, and explain what a good submission looks like before anyone starts. This preparation is part of the rollout. A subscription alone does not create the conditions in which a team learns.

Owner

One named person who answers policy questions and reviews progress weekly.

First group

A handful of people across two or three roles, including someone sceptical about AI.

Approved tools and plans

Which assistants and which accounts. Personal free accounts and company accounts can have different data terms.

Information rules

What may go in, what must never go in, and what to do after a mistake.

First tasks

Two or three repeatable, low-risk tasks from real roles, with fictional source material.

Reviewer and criteria

Who gives feedback, and the three or four things they will look for.

Protected time

A regular slot each week. Training squeezed around everything else gets dropped first.

What should the first week include?

The first week should establish a starting point and the review habit. Begin with a short conversation about confidence and concerns, then a small practical task. Keep those two signals separate. Ask each learner to summarise or draft from a supplied brief, identify one unsupported claim and explain one edit. Record the tool, the source and the criteria so the starting point is clear.

Protect time for a short review conversation with each person. A manager learns more from someone explaining why they removed a sentence than from a completion badge. Do not use the first attempt to rank people or draw broad conclusions about their ability.

What should the second week focus on?

Week two should repeat the same learning loop on a different but comparable task, and introduce one new habit: giving the tool better context. Ask learners to rewrite their week-one prompt with the audience, purpose, source and constraints spelled out, and to tell the tool what to do when information is missing. Compare the outputs of the two prompts in the review.

Collect every question the information rules did not answer. If people are unsure whether a client name can go into the tool, resolve that now, before tasks get more realistic.

What should the third week add?

Week three should add checking and role-specific work. Give each learner a task with a planted problem: a summary with a dropped qualifier, a draft with an invented figure, a formula with a wrong range. The guides to fact checking AI output and AI hallucinations have examples. Then let people choose one real, low-risk task from their own job, using approved material only.

Change the examples by role. Marketing briefs, account notes, interview questions, supplier updates and variance explanations each need different review decisions. The NIST AI RMF playbook's Govern material supports role-aware training and clear responsibilities; this schedule is our proposed operational sequence, not a NIST requirement.

Want to see how this connects to a role?

Explore the planned team trial ↗

What should you review at the end of the month?

Review work samples against the stated criteria, not attendance alone. For each learner, ask what they can now show, what remains uncertain and which task would be useful next. A repeat attempt benefits from familiarity, so use a fresh example before reading a change as a general improvement.

Then review the programme itself. Were the tasks relevant? Did reviewers have time? Which policy questions came up? Expand to a second group only when the practice and review routine is manageable. If it is not, revise the tasks, the time or the support before adding people. The plan does not promise that a team will reach a particular level within thirty days.

What does a 30-day plan look like for a small firm?

Here is a worked plan for a fictional 12-person bookkeeping firm, Pinecrest Accounts, rolling out to four people first: two bookkeepers, an office manager and a client manager. The approved tool is the company's business plan for one assistant. Client names and figures may not be entered; all practice uses a fictional client called Ridgeway Bakery.

WeekFocusPractice taskEvidence the reviewer keeps
1Starting pointSummarise a fictional client email asking about VAT deadlines into three action pointsThe summary, one edit explained, a note of anything the learner missed
2Context and briefingRedo the week-one task with a full brief; draft a reply to Ridgeway BakeryBoth prompts and outputs side by side, with the reviewer's comment
3Checking and role workFind three planted errors in an AI-written month-end note; one own-role taskErrors found and missed; the own-role output with the review note
4Fresh assessmentA new, comparable task not seen before, marked against the same criteriaThe result against week one, and the next task chosen for each person

How should you budget for the rollout?

Budget for four things separately: the training subscription, access to the AI tools themselves, learner time and reviewer time. Check the seat minimum and billing period before comparing offers. For Tosheo.ai, use the current pricing page rather than copying planned amounts into a spreadsheet that may go stale.

Decide in advance what evidence would justify continuing, such as reviewed work that improved on a fresh task and a routine people kept to. Do not turn an estimated time saving into a claimed financial return without measuring it in context. The first month tells you whether the programme fits the team; it is not a reason to declare success early.

What if people do not engage with the training?

If people are not engaging, look at time, relevance and trust before adding reminders. Did they have a protected slot, or were they expected to fit it in? Were the tasks recognisably from their job? Do they understand that the practice is not a hidden performance review? A short conversation usually reveals which one it is.

Fix the cause, not the symptom. A nudge helps someone who forgot; it does not help someone who thinks the task is pointless or worries about being judged. Visible manager interest, such as asking about the last task in a one-to-one, tends to do more than automated reminders.

When is a 30-day plan the wrong shape?

A 30-day plan is the wrong shape if the basics are not in place: no approved tool, no information rules or no one with time to review. Spend the month on those instead. It is also too short to judge a large or complex rollout, and too elaborate for a three-person team that can agree a routine over coffee.

If your organisation needs single sign-on, LMS integration or a formal procurement and security review before any rollout, note that Tosheo.ai's planned launch does not include SSO, SCIM, LMS integrations or enterprise contracts. Plan accordingly.

Sources and scope

NIST, AI RMF Playbook: Govern, accessed 16 October 2026 ↗