Guide
Do you have to train employees on AI?
Yes. The AI literacy duty has applied to every provider and deployer, regardless of size or risk tier, since 2 February 2025. The Omnibus of 27 July 2026 softened the wording, not the duty.
What the law asks
A deployer is anyone using an AI system under their own authority in a professional context. A firm whose staff use ChatGPT, Claude or Microsoft 365 Copilot for work is a deployer, not a provider. The vendor is the provider.
The Omnibus rewrote the key sentence on 27 July 2026. The duty is now to take measures to support the development of AI literacy of staff and other persons dealing with the operation and use of AI systems. Before, it was an obligation to ensure, to the best extent, a sufficient level of AI literacy.
The standard softened from a result toward an effort. It remains a binding legal obligation on providers and deployers, neither shifted away nor made optional. The Omnibus also clarified that no individual guarantee is required.
What counts as a measure
The wording asks for measures. So the question an authority will ask is: can you show one? Build it like this:
- Scope: everyone who operates or uses AI systems in the course of their work. If only the sales team touches Copilot, start there.
- Tiering: heavy users get a deeper session, occasional users get the basics, leadership gets a thirty-minute briefing.
- Content: which tools are approved, the data rules, the disclosure rules for anything customer-facing, whom to ask. One page.
- Format: one 60-minute session plus a one-page rules card, repeated at onboarding.
- Evidence: the training log. No log means no evidence.
Seven columns are enough for the log:
| Column | What gets recorded |
|---|---|
| Date | the day of the session |
| Format | for instance a 60-minute session plus rules card |
| Material used | for instance Bundesnetzagentur Service Desk resources |
| Participants | roles and count |
| Content covered | approved tools, data rules, disclosure duties |
| Evidence | attendance list, slides |
| Next refresher | for instance onboarding plus a yearly date |
The Bundesnetzagentur's AI Service Desk publishes AI literacy resources aimed at organisations and SMEs. Free help is available.
Done in 30 days
- Week 1, inventory: record which AI tools actually run, who uses them and which data categories they touch. The scope of the training follows the inventory, not job titles.
- Week 2, roles and rules: fix the role for each row and write the approved-tools list, including the GDPR legal basis for every tool that touches personal data.
- Week 3, train: tier the audience, hold one 60-minute session plus rules card, brief leadership for thirty minutes.
- Week 3, log: record date, format, participants, content and evidence. Measures, plus proof of measures.
- Days 21 to 30, set the cadence: put the artifacts in one folder, brief the leadership team for fifteen minutes, set the rhythm. Re-run the inventory every quarter and on every new tool.
Related: If personal data flows into AI tools, the GDPR is usually the closer risk. The four checks are in the guide AI and data privacy. How an introduction works without an IT department of your own is in AI without an IT department.
Frequently asked questions
Does a small firm need AI training?
Yes. The AI literacy duty has applied to every provider and deployer, regardless of size or risk tier, since 2 February 2025. Free support exists at the Bundesnetzagentur's AI Service Desk and through the BMWK-funded Mittelstand-Digital centres.
Does it need a certificate?
No. The duty is to take measures to support AI literacy, not to obtain a certificate. The Omnibus clarified that no individual guarantee is required. The artifact that satisfies the duty is proof of measures, which means the training log.
Who enforces the duty in Germany?
The Bundesnetzagentur. It is the central market surveillance authority for the AI Act in Germany, the single point of contact and the central complaints body. The legal basis is the KI-MIG, in force since 29 July 2026.
What happens without training?
Article 99 of the AI Act sets fine tiers for named duties, such as the deployer duties in Article 26 and the transparency duties in Article 50. It does not spell out a fine for a missing literacy measure. Germany's KI-MIG adds national fines of up to EUR 50,000 for certain infringements. What protects you either way is the training log: proof that you took measures.
Free, 20 minutes, no sales pitch.
Last updated:
This guide is not legal advice.