Articles

Articles on workforce skills and obligations: why microlearning works, what the AI Act and NIS2 ask of your staff, and how competence is verified.

• The AI teacher in CoreSkills: practice and answers, no grades
  CoreSkills' AI teacher discusses and asks, and Ask the content answers from your own material with sources named. Neither records competence. Why the line is drawn there.
• Exam and certificate: how competence is verified, and why an AI assessment never makes a certificate
  A CoreSkills certificate rests on a multiple-choice exam whose questions a person has approved. The AI teacher does not affect it. How the exam and the certificate work.
• Training evidence for the regulator: a report you print, not compile
  When a regulator or auditor asks who has been trained and in what, the answer is printed, not compiled. How training evidence, completions and the pace report work.
• Six minutes a day: how training comes inside the working day
  CoreSkills brings the day's tasks to the employee: one lesson or exam part in full, short reviews beside it, a reminder by email or Teams. How the day is built, and why.
• What does the Cybersecurity Act require for staff training?
  The Finnish Cybersecurity Act requires risk-based cyber hygiene and staff training as part of cybersecurity risk management.
• Microlearning at work: why short and repeated beats the training day
  Microlearning means learning in a few minutes a day, inside the working day. Research explains why it is remembered better than one long course, and when it is not enough.
• Where your data is: CoreSkills' security and data protection through IT's eyes
  CoreSkills is its own cloud service in Finland. What data it processes, where it flows, which subprocessors see it, and how your own Azure OpenAI, Entra ID and Teams are connected.
• What is in the CoreSkills library: statutory training that knows its provisions
  The CoreSkills library covers data protection, cybersecurity and AI obligations for staff and responsible roles. Every course names its provision, and each path ends in an exam.
• Do NIS2 and the Finnish Cybersecurity Act apply to us?
  NIS2 and the Finnish Cybersecurity Act apply when your sector, size or critical service brings the organisation into scope.
• NIS2 and the Finnish Cybersecurity Act: management training and staff cyber hygiene
  The Finnish Cybersecurity Act (124/2025) transposed NIS2. Management must train and oversee risk management, and staff training is one of the mandatory measures.
• From your own material to training: onboarding, guidelines and policies as six-minute lessons
  Bring your onboarding folder, guidelines and policies to the Materials page, read the analysis and make a course in the Studio the same day. AI writes the draft, you check it.
• Skills mapping: how to find out what your work actually requires
  Skills mapping starts from job roles and the skills they require, not from a catalogue. How CoreSkills identifies the need, measures the current state and shows gaps by role.
• What must be reported after a cybersecurity incident, and when?
  The Finnish Cybersecurity Act requires 24-hour, 72-hour and one-month reports for significant cybersecurity incidents.
• What does the Client Data Act require from health and social care staff?
  The Client Data Act requires written instructions and sufficient competence for handling client and patient data.
• What may employees enter into an AI tool at work?
  AI tools should receive only information that is necessary, allowed for the task, and safe to process. Personal and confidential data need special care.
• Article 4 of the AI Act: what your staff must know about AI
  The EU AI Act requires measures that support staff AI literacy. The duty has applied since February 2025 and was reworded in July 2026. Who it covers and how to meet it.
• Who is responsible for AI use in an organisation?
  The AI Act does not require a named AI officer, but AI responsibilities must be assigned by role, risk and use case.
• What data protection skills does every employee need?
  The GDPR does not prescribe one course, but the controller must be able to show that staff handle personal data correctly.
• When must a Data Protection Officer be appointed?
  A Data Protection Officer is mandatory for certain public bodies and high-risk personal data processing under the General Data Protection Regulation.
• What must an information security officer know under the Cybersecurity Act?
  An information security officer must master risk management, incidents, continuity, supply chains, encryption and access control.
• What do NIS2 and the Cybersecurity Act require from a supplier?
  When a customer is covered by the Cybersecurity Act, supplier security becomes part of the customer’s risk management.