AI Training for Companies

On July 27, 2026, the Digital Omnibus Regulation on artificial intelligence entered into force. It reworded Article 4 of the EU AI Act (Regulation (EU) 2024/1689) — on one point that makes the difference in practice: ensure became foster.

Since then, providers and deployers of AI systems have had to take measures to foster the AI literacy of their staff and of other persons acting on their behalf. What they no longer have to do: guarantee that every single person reaches a particular level of competence. The Commission had originally proposed deleting the obligation for companies altogether; in the final text it remained, only worded more softly.

Three things that are easily mixed up and that you should keep apart:

• The obligation is neither new nor postponed. Article 4 has applied since February 2, 2025. The Digital Omnibus created no new deadline for it — unlike for high-risk AI, whose obligations were postponed.
• Softer does not mean ineffective. “Foster” is a duty to act. Anyone who does nothing at all does not fulfil it.
• The obligation is the competence, not the certificate. The EU AI Act prescribes neither a particular training nor a certification body. Proof still makes sense — but as your own evidence, not as a legal requirement.

The rule affects providers (those who develop AI systems or offer them under their own name) and deployers (those who use them under their own responsibility). The second case is the common one: as soon as someone in your company uses ChatGPT for quote texts, Microsoft Copilot for presentations or an AI tool in the CRM, you are a deployer within the meaning of the regulation.

There is no lower threshold by company size. Even a trade business with eight employees falls under it if AI tools are in use there in everyday work. What the regulation does take into account is proportionality: the scope and depth of the measures depend on the context in which the systems are used and on the people who work with them.

In practice, this means: a company that uses AI exclusively for text drafts owes something different from one that uses AI in personnel selection or lending — there, the high-risk rules apply in addition anyway.

You are not affected if no AI systems are demonstrably used in your company. That is rarer than many assume, however: AI features are built into office suites, translation tools and customer service software today without being called that.

The regulation names no number of hours, no curriculum and no exam format. It describes a goal and leaves the path to you. In supervisory practice, four building blocks have established themselves as what can reasonably be expected:

• Inventory. Which AI systems are actually used at your company — including those that nobody officially introduced?
• Teaching the fundamentals. All people who work with AI understand what the system can do, where it reliably errs and which data has no place there.
• Rules. An internal policy that makes the handling binding instead of leaving it to the individual.
• Documentation. Who learned what and when. Without this building block, you have done the other three but cannot show it.

The fourth point is where it fails in practice. A good training that everyone remembers but for which there is no participant list is hard to distinguish from no training at all in the event of an inspection.

Since August 2, 2026, the EU AI Act has applied in general — except for the postponed obligations for high-risk AI, which begin on December 2, 2027 and August 2, 2028 respectively.

This changes nothing about the obligation under Article 4: it has applied since February 2, 2025.

For an honest classification of the figures currently circulating in the market: the much-cited €35 million or seven percent of worldwide annual turnover is the maximum framework for prohibited AI practices under Article 5 — social scoring, manipulative systems, remote biometric identification. It is not the sanction for omitted training. How violations of Article 4 are penalized in detail is regulated by the member states nationally; the regulation expressly requires that the size of SMEs and startups be taken into account. Anyone who holds out the prospect of a fine in the millions for missing AI training is selling you fear instead of information.

The real risk lies elsewhere and is more concrete: liability and breach of duty of care if damage results from untrained AI use — a data protection violation through a careless input, a wrong decision based on a fabricated source, a discriminatory selection result.

There is no official checklist. What an authority or an auditor typically wants to see can be predicted well, however, because they are the same questions as for any other instruction obligation:

• Who was trained? A list by name, not “all employees”.
• When? One date per person, not a period.
• With what? Content overview or curriculum of the measure.
• With what result? Proof that the content got through — a passed final test is the simplest.
• And for new employees? A procedure that works without anyone having to remember it.

Our training is designed for exactly this: each person finishes with a dated certificate of participation that can be verified via QR code, and in the team area you see at a glance who is still missing. The certificate is valid for one year — not because the law requires it, but because the state of the art changes faster in this field than in most others.

The most common implementation mistake is to treat everyone the same — either too little for some or too much for others. Three levels make sense:

General users — by far the largest part of the workforce. They use AI tools in everyday work: texts, research, summaries, translations. They need the fundamentals, a reliable feel for hallucinations and bias, and above all clarity about which data does not belong in an AI tool. This is the area our training covers.

Subject-matter owners — those who select, introduce or configure AI systems. Additionally needed: understanding of risk classes, vendor assessment, data processing agreements, labeling obligations.

Roles with elevated risk — those who use AI in personnel selection, lending, access decisions or safety-relevant processes. The high-risk requirements of the AI Act apply here, and the training must be system- and task-specific. A fundamentals training does not replace that — ours does not either.

For individual professions, we have adapted the case examples, because the questions differ there: tax advisors work with client data, law firms additionally with attorney-client confidentiality, care facilities with health data under Article 9 GDPR, trade businesses without their own IT department and municipalities with administrative law on top.

No curriculum can be derived from Article 4. One can be derived from the risks it is aimed against, however. Five topics belong in every serious AI training for general users:

• How the technology works — and where it reliably errs. Anyone who does not understand that a language model produces plausibility and not truth will not check the output.
• Evaluating results. Recognizing hallucinations, cross-checking sources, noticing bias. This is the competence with the greatest practical value.
• Data protection. Which data may be entered, which never, what a data processing agreement achieves and what it does not.
• The legal framework. Risk classes, labeling obligations, who in the company is responsible for what.
• Application. Without the practical part, the training remains theory and the rules are circumvented instead of followed.

The training runs entirely online, at your own pace, and can be completed in 60 to 90 minutes. Five mandatory chapters with 46 learning cards, plus 18 exam questions from real work situations instead of from the textbook; five optional additional modules are included. Each chapter must be passed with at least 70 percent, progress is saved, and interrupting is possible at any time.

At the end comes a certificate of participation as a PDF, verifiable via QR code, with date and name. For teams, there is an area where you can see the status of all employees, send invitations and download a compliance report as a PDF. The prices: €19.90 for individuals, €14.90 per person from two, €9.90 per person from twenty — each net plus VAT, one-time, no subscription.

And the limit, because it belongs here: this training covers the fundamentals for general users. For role-specific requirements and for high-risk applications, you as the employer remain responsible for providing additional system- and task-specific training. We issue the verifiable proof for the fundamentals part — not for everything.

View the offer and prices · View chapter 1 for free

• Training only IT. Data protection violations arise in sales and marketing, where customer data is copied into a text tool — not in development.
• Training once and ticking it off. New employees join, tools change. Without a procedure for latecomers, the list is incomplete after six months.
• Training but not documenting. The most common and most expensive mistake. What you cannot prove, you have not done in the event of an inspection.
• Waiting for an “official” certificate. There is no certification body provided for by the EU AI Act. Anyone who advertises with one claims more than exists.
• Forgetting the policy. Training without a binding rule means that each person decides for themselves what may go into an AI tool. That is exactly what the literacy obligation is meant to prevent.

If you want to approach the topic more broadly than mere compliance, you will find the entry point via personnel development under AI continuing education. If you are looking for the legal text in detail, you will find it prepared under EU AI Act training. And if you need data protection as a topic of its own: the DSGVO-Schulung stands alongside and does not replace this training.