I sold prompt workshops, and I was wrong about what they did
For a while I ran prompt-writing sessions, and they went well. Good scores, good room, people leaving with a card of patterns. Four weeks later almost nothing had changed in the work. I stopped selling them as a standalone thing, which cost me a tidy product, because they were treating the least difficult part of the problem.
Writing a decent instruction is a small skill. Most adults acquire it in about twenty minutes of use, and they acquire it better by using the tool on their own work than by watching someone use it on a fictional case study. What people were actually getting wrong was elsewhere: they could not tell a good answer from a plausible one, they had no idea what the system could and could not see, and nobody had told them which tasks to keep away from it entirely.
Those three are the skills. Prompting is the entry fee.
Judging the output is the job now
The verification is the work. If the draft arrives in ninety seconds and you cannot tell whether it is right, you have moved the effort, not removed it, and for some tasks you have made it worse. A wrong answer that reads well is more expensive than no answer.
Teaching this is unglamorous and specific to the trade. For a bid team it means knowing which claims need a source and which numbers a client will check. For a finance team it means knowing which figures must tie back to the ledger and never to a summary. For anyone writing to a regulator it means knowing that plausible register is not the same as accurate content. None of that is a prompt pattern. It is domain judgement, applied faster than before, and the training has to be built inside the work rather than beside it.
The regulator is heading to the same place from the other direction. The ICO’s draft guidance on automated decision-making and profiling went to consultation between 31 March and 29 May 2026, and the final version is not out yet, so treat it as direction and not as law. It says human involvement must be “active rather than tokenistic”, carried out by trained, qualified reviewers who understand the system’s logic and its limitations. Read that as a training specification, because that is what it is. Somebody signing off machine output has to know how the thing fails, not just how to ask it nicely.
Knowing what it can see is the second skill, and it is taught badly or not at all
Almost every “Copilot is useless” conversation I have had ends up here. The user assumed the tool could see something it cannot, or was surprised that it could see something it can. No amount of rewording rescues a question about a document the system was never given access to, and no prompt technique stops it retrieving the salary spreadsheet somebody shared with the whole organisation in 2019.
So the useful lesson is not a syntax lesson. It is a map: what sits in your tenant, what the tool retrieves under your permissions, what it never sees because it lives in a line-of-business system, and what happens to your question when you ask it in one product rather than another. People who hold that map write short, blunt prompts and get good results. People who do not write beautiful ones and get confidently wrong answers about data that was never in the room.
Third skill, shortest to state and hardest to enforce: knowing when not to use it. Anything where the reasoning must be yours because you will have to defend it. Anything where the source material should not be in the system in the first place. Anything where the value of the output is that a person spent time on it, which covers more of management than managers like to admit.
The law asked for less, and that is not a reason to teach less
AI literacy has been a legal obligation in the EU since 2 February 2025, under Article 4 of the AI Act, and it was watered down this summer. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was adopted on 8 July 2026 and entered into force on 27 July 2026. It changed the wording from taking measures “to ensure” a sufficient level of AI literacy to taking measures “to support the development” of it, and added text confirming that providers and deployers are not required to guarantee any specific level.
That is softer. It is not gone, and it did not stop applying. For a UK organisation the reach question is Article 2, which is unchanged by the omnibus: the Act applies to providers and deployers in third countries where the output produced by the AI system is used in the Union. If your output lands in the EU, the question is live for you.
The compliance-minded reading of the change is to do less and record that you did it. The change is real and the obligation is now easier to satisfy on paper. It has no bearing on whether your people can tell a good answer from a bad one, and that is the thing that will actually cost you money. A course that exists to be evidenced is a course nobody remembers, and I have built a few of those under duress. They pass audits. They do not survive contact with a Tuesday.
What I put in place now is duller than a prompt workshop and works better: short pieces of learning attached to a specific task, using the team’s own material, with a worked example of the tool getting it wrong and someone catching it. The failure case teaches more than five successes. It also gives people permission to say the output was poor, which is the first honest conversation most organisations have not had yet.