How to measure AI training when the law prescribes no content.
Art. 4 of the EU AI Act demands literacy and says not a word about what a training course must contain. That is convenient as long as nobody asks — and uncomfortable as soon as somebody does. There is, however, a usable yardstick: the German federal government has written down for its own authorities what a training concept under Art. 4 should contain. This page places our course next to it point by point — including the places where we deliver nothing.
Important: The paper is addressed to the federal administration and is not binding for companies. It is not a certification, not a recognition and not a recommendation for us — we cite it as what it is: currently the most concrete publicly available yardstick for what “sufficient AI literacy” means in practice.
What the law requires — and what it does not
Two things are expressly not in it: a list of contents and a level that would have to be reached. On its wording, the provision does not oblige providers and deployers to guarantee any particular level of AI literacy for any person. What has to be done depends on purpose, prior knowledge and risk.
What AI literacy is supposed to be, on the other hand, the Regulation does define — in Art. 3(56):
From this the federal government derives eight points for its authorities. They are the structure of this page.
The eight model requirements, our course alongside
| What the paper requires | What our course delivers | Coverage | |
|---|---|---|---|
| 1 | Objectives Informed use, responsible handling, understanding of how it works, risks and limits, ability to react to AI misbehaviour, risk assessment, knowledge of in-house rules |
Basic modules 1 (why this training), 2 (how AI works and where it errs), 3 (what never belongs in an AI), 6 (working with AI safely and effectively) and 7 (practice check). The in-house rules come from your dashboard: what you enter there as policy and labelling rule appears in module 5 of your staff's course. | complete |
| 2 | Target groups Everyone dealing with the system, including commissioned service providers. Differentiation by users, technical staff, managers, and legal and compliance |
Users: basic course. Managers, legal and compliance: advanced course (nine modules) with role, legal framework, liability and governance. | partial — technical deep dive missing |
| 3 | Contents Basic knowledge, role-related classification (provider or deployer), risk classification of the system, differentiation appropriate to the target group |
Basics: basic 2 and 4. Provider or deployer: advanced 101 and 105 (including Art. 25 — when a deployer itself becomes a provider). Risk classification: advanced 103 with Annex III as the working basis. | complete |
| 4 | Methodology Interactive e-learning modules, in-person workshops or webinars, case studies and simulations, blended learning, final quiz or certification as a knowledge check |
Interactive e-learning with check questions per module and a final quiz; practice scenarios in basic module 7 and in the assignments of the advanced course. | partial — no in-person formats |
| 5 | Timing and repetition Introductory training before first use, regular refreshers (e.g. annually), training on system changes, updates or regulatory changes, deeper training for high-risk AI |
New staff are invited at onboarding. Certificates are valid for one year, after which retraining follows. When the legal position changes we deliver a notice whose acknowledgement is logged. High-risk deep dive: advanced 103. | complete |
| 6 | Documentation and evidence Proof of participation and contents, documentation of competence levels, traceability in audits and external reviews, integration into compliance management systems |
That is exactly our product: a certificate per person with a publicly verifiable ID, participation status of the whole team, logged acknowledgements and a printable evidence file that brings together inventory, policy, responsibility and training status. | complete |
| 7 | Integration into organisational processes Onboarding and further training, link to IT security and data protection training, cooperation with HR development, feedback channels |
Onboarding via invitations, feedback via support. Data protection, trade secrets and protection against deepfake and AI-phishing fraud are covered in terms of content (basic 3 and 6, advanced 107) — we do not deliver a separate data protection or IT security training. | partial |
| 8 | Consequences of non-compliance Legal consequences of incidents attributable to insufficient AI literacy |
Advanced 102 (the sanctions catalogue of Art. 99 in the original — with the note that Art. 4 is not in it) and 107 (management liability, trade secrets, product liability from 9 Dec 2026). | complete |
Three sentences from the paper worth knowing
A certificate is not prescribed — a register is the recommendation
“In principle a certificate is not required; however, a register for keeping track of the training carried out can be useful: proof of participation and contents of the training, documentation of competence levels (e.g. training passports), traceability in audits / external reviews, integration into compliance management systems.”
Whoever sells you a certificate as a legal obligation is overstating it. What counts is the register behind it — and that it is complete when the occasion arises.
An AI officer is not prescribed
“No specific governance structure, e.g. the appointment of an AI officer, is prescribed in order to meet the requirements of Art. 4 AI Act.” The paper nevertheless considers the role helpful and points out that it can be taken on by existing officers.
We have therefore sharpened our own quick check: a missing named person now appears there as a recommendation, not as a breach of duty.
No expert level — but no user manual either
“Overall, no expert level is demanded of the training (‘sufficient literacy’).” At the same time: “Merely following a user manual of the AI system is unlikely to be sufficient as a rule.”
That describes the corridor in which a defensible training course moves: more than the manual, less than a degree. Half an hour of structured basics plus documented check questions lies within it — a click-through without a knowledge check does not.
“Doesn't a certificate from TÜV or the Chamber of Commerce carry more weight?”
For the obligation under Art. 4 AI Act neither carries more weight — because the Regulation requires no certificate at all. The paper by BeKI and BAköV expressly states that a certificate is in principle not required; the recommendation is a register of the training carried out. That proves who learned what and when — not which logo is on the paper.
A TÜV or Chamber of Commerce certificate carries more weight exactly where someone expressly asks for it:
- A tender or a corporate customer requires an accredited personal certificate. That takes a certification body under ISO/IEC 17024 — and we are not one.
- A job profile or an internal role description names a specific qualification. Then the description decides, not the learning content.
If that is your case, we will tell you so and name the providers. Our course does not replace an accredited personal certificate — it comes before it.
In all other cases the difference is not the weight of the certificate but the bill behind it: chamber and seminar offers are paid per person, our plans per company. Whoever has to train fifty employees pays fifty times on the seminar route.
Where we deliver nothing
Four points from the paper our course does not cover. If one of them applies to you, you need something else for it — and you should know that before you buy from us.
- Technical deep dive for development and IT. Architecture, security and monitoring of AI systems are not course content. If you develop or operate AI yourself, your technical people need more than our modules.
- In-person formats. We offer no workshops, no webinars and no live sessions — deliberately, because otherwise the product would not scale and would become more expensive.
- Data protection and IT security training. We touch on both in terms of content but do not replace a dedicated GDPR or information security training.
- Authority-specific matters. The paper refers to guiding principles of the federal administration, the federal learning platform and its AI literacy pass. For federal authorities that is the closer route — the BAköV offers its own basic course, and it costs you nothing.
Frequently asked questions
What content must a training course under Art. 4 AI Act cover?
The Regulation prescribes no content. A paper by the Advisory Centre for Artificial Intelligence at the German Federal Ministry for Digital Affairs and State Modernisation and the Federal Academy of Public Administration names as model requirements: objectives, target groups, contents (basic knowledge, role assignment provider or deployer, risk classification, differentiation appropriate to the target group), methodology, timing and repetition, documentation and evidence duties, integration into organisational processes and consequences of non-compliance. The paper is addressed to federal authorities and is not binding for companies.
Does AI training need a certificate?
No. The paper by BeKI and BAköV expressly states that a certificate is in principle not required, but that a register for keeping track of the training carried out can be useful: proof of participation and contents, documentation of competence levels, traceability in audits and external reviews.
How often must training take place under Art. 4 AI Act?
The Regulation names no frequency. The model requirements by BeKI and BAköV recommend an introductory training before the first use of an AI system, regular refresher training roughly annually, training on system changes, updates or regulatory changes, and deeper training for high-risk AI.
Must an AI officer be appointed?
No. The paper expressly clarifies that no specific governance structure is prescribed in order to meet the requirements of Art. 4 AI Act. An AI officer as a multiplier can, however, support management in ensuring a sufficient level of training; the role can also be performed by existing officers.
Does a certificate from TÜV or the Chamber of Commerce carry more weight than yours?
For the obligation under Art. 4 AI Act neither carries more weight, because the Regulation requires no certificate at all. The paper by BeKI and BAköV expressly states that a certificate is in principle not required; the recommendation is a register of the training carried out. A TÜV or Chamber of Commerce certificate carries more weight where someone expressly asks for it: in a tender, with a corporate customer or for a job profile. If that is your case, we will tell you so and name the providers — our course does not replace an accredited personal certificate, it comes before it.
What follows from this for your company
The federal government writes down for its own authorities what it considers sufficient — and lands at a register with participation, contents, competence levels and traceability in reviews. That is exactly the thing nobody wants to maintain by hand and that is the first thing missing when the occasion arises.
KlarComply delivers the training and the register behind it: a certificate per person with a verifiable ID, annual refresher, logged acknowledgements of legal changes, evidence file at the press of a button. No recognition by the federal government, no certification, no claim in that direction — just the same yardstick, applied traceably.
Getting started takes two minutes: ten points about your use of AI, no sign-up, with an honest result.
To the free quick checkThe course in detail: plans and contents · the advanced course: certificate course
Legal notice: This page provides general guidance on implementing Art. 4 of Regulation (EU) 2024/1689 and does not constitute legal advice. The cited paper by BeKI and BAköV is addressed to the federal administration; it is not binding for companies and creates no obligations. Whether your measures are sufficient in an individual case depends on purpose, prior knowledge and risk and should be checked by a lawyer in case of doubt. The comparison implies no recognition, certification or recommendation by the bodies named.
Sources: Art. 4 AI Act · Art. 3(56) (AI literacy) · Full text on EUR-Lex · EU Commission: AI literacy — questions and answers on Art. 4 · BAköV — learning path on building AI competence