Is an AI Act training certificate required? The European Commission answers directly

No, an AI Act training certificate is not required. The European Commission was asked this directly and answered in its Q&A on AI literacy in a single sentence: there is no need for a certificate, an organisation may keep an internal record of training and other measures. The law asks for action and a trace of it, not for a document with a particular name.

The legal position described here is current as of 21 August 2026. It concerns Article 4 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, which entered into force on 27 July 2026.

Article 4 binds both providers and deployers of AI systems. If you buy off-the-shelf tools and simply use them, you are a deployer, not a provider. On the certificate question the answer is identical in both roles. What you have to do next is not, and we come back to that below.

What the Commission actually wrote

The question in the Q&A runs roughly like this: how are organisations supposed to document their measures, and are specific certificates needed. The answer takes two sentences. A certificate is not needed. An internal record of training or other measures is enough.

“There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives.”

European Commission, AI literacy questions and answers, answer on documenting actions and certificates

The same material contains two more points you can base a purchasing decision on. No form of training is mandated, and there is no single format that suits everyone. And Article 4 introduces no obligation to measure employees' level of knowledge. Nobody forbids a test, it is often convenient, it simply is not what the law demands.

Supervision of Article 4 does not sit with the AI Office but with national market surveillance authorities. In Poland that is KRiBSI, and we wrote separately about when it gains real inspection powers.

What changed in Article 4 on 27 July 2026

Article 4 used to speak about ensuring a sufficient level of AI literacy. Regulation 2026/1744, known as the Digital Omnibus on AI, rewrote the article. It now has three paragraphs and distributes the weight differently.

Paragraph 1 obliges providers and deployers to take measures supporting the development of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. The Commission sums up the effect briefly: AI literacy remains an obligation, but no specific or sufficient level is required of any individual.

Paragraph 2 shifts part of the work to the public side. The Commission and the Member States are to support providers and deployers, in particular SMEs, and the Commission itself is to publish practical examples of how the obligation can be met on a single information platform. That passage is missing from Polish commentary on Article 4, and it matters concretely when you choose a training course. The benchmark for the question “is this enough” is meant to come from the Commission's platform, not from a course vendor's leaflet.

Paragraph 3 requires the AI Board to adopt recommendations, taking into account European competence frameworks and with common objectives. The recommendations do not exist yet. Anyone promising a programme “aligned with the guidelines” today is promising something nobody has published.

The Commission adds one point that saves you from a convenient shortcut: copying a practice from the living repository of AI literacy practices does not automatically create a presumption of conformity with Article 4. The repository is there so you can learn from others.

Before you check this yourself, a warning about the source

Open Article 4 in the AI Act Service Desk, the explorer run by the Commission itself, and the English page carries a clear note above the text saying the provision was amended by the Digital Omnibus and that the content has not been updated yet. The Polish version of the same page has no such note, so it reads as the law in force while showing the pre-amendment wording.

This is not a dig at the Commission, it is a practical warning. The current wording is in the amending regulation on EUR-Lex, and the description of its effects is in the Q&A on AI literacy. If you check the article itself in the explorer and stop there, you may be reading the legal position from before 27 July.

So why would anyone want a certificate

The answer is not “for nothing”. A certificate conveniently holds three pieces of information in one place: who, when, in what scope. You have to record that data anyway, so if you get it ready-made, you save yourself work.

The trouble starts when the certificate is the only thing you have. Then it says no more than that somebody clicked “complete”. It does not say why that particular scope went to that particular person. And that is the question that comes up both in an inspection and in a vendor questionnaire from a corporate client.

A separate matter: search results mix two different meanings of the word “certificate”. Certificates under Article 44 of the AI Act are issued by notified bodies, concern high-risk AI systems and are valid for at most five years for systems under Annex I and four years for systems under Annex III. They relate to a system, not to a person. They have nothing to do with a course completion record.

What actually goes in the file

In the same Q&A the Commission lists the minimum an organisation should think through before building an AI literacy programme. It is four questions. Their strength is that the written answers form a document almost nobody keeps, and one that weighs more than a stack of completion certificates.

The last row decides the value of the whole file. The typical failure looks like this: a company runs the entire team through one module, collects a hundred certificates and considers the topic closed. Six months later somebody asks how the scope for marketing differed from the scope for HR. There is no answer, because nobody recorded the basis on which the scope was chosen. A hundred certificates will not replace one table of assignments.

The second forgotten element is the date and version of the training material. With a provision that changed wording at the end of July, a course from June teaches a state of the law that no longer exists. If your record does not show when the material was produced, you do not know whether your documentation describes the current law.

You can run this in a spreadsheet and many organisations do. We built a platform for it, where the tool register, training assignments and policy acknowledgements sit side by side, because at several dozen people a spreadsheet starts to drift. From ten licences the platform is included in the price of the training, so the question comes down to whether you would rather keep it by hand.

Is an AI Act training certificate required for high-risk systems

The answer does not change, the bar does. The Commission recalls that where an organisation deploys a high-risk AI system, the obligation to ensure staff are adequately trained to exercise human oversight of that system remains in force regardless of the changes to Article 4. Still nobody demands a certificate. Pointing people to the instructions for use, however, no longer does the job.

What this does not mean

It does not mean you can do nothing. The obligation under Article 4 has applied since 2 February 2025 and has not been postponed. What changed is what the provision demands, not whether it applies.

Nor does it mean that because a certificate is not required, training is not either. The Commission writes that in many situations merely pointing people to the instructions for use is ineffective, and that Article 4 should lead to training and guidance tailored to the specific audience.

Finally, it does not mean you have to test people's knowledge or keep a record validating learning outcomes. That element circulates in guidance as a mandatory part of the documentation. The Commission states plainly that Article 4 introduces no obligation to measure employees' level of knowledge. An exam can be useful, it organises the evidence and suits many organisations, it simply is not a legal requirement and is not worth paying extra for on that basis.

One sentence on the consequences, so as not to leave a gap here. Penalties for infringements of Article 4 are imposed by national market surveillance authorities under national law, and the Commission notes that enforcement of the AI Act rests on proportionality: a penalty is to be proportionate, assessed case by case, taking into account the nature and gravity of the infringement. For micro, small and medium-sized entities the regulation provides for a lower cap, not a higher one. A more practical frame than fear is due diligence and the evidence you can put on the table when the board or a client asks.

What to do this week

One step, if you are going to take only one. Sit down for an hour and list the AI tools people in your organisation use, together with the names of those who have access to them. Do not start from the HR list of job titles, because it answers a different question. Start from the tools, and the list of participants will build itself, along with the reasoning behind the scope.

Got time for a second step? Next to each tool, write one sentence about what can go wrong when somebody uses it unprepared. That is the seed of the training scope and at the same time a record of your risk assessment.

A third step only once the first two are done: check whether the materials you train from reflect the wording of Article 4 after 27 July 2026. If they talk about ensuring a sufficient level of AI literacy, they predate the change.

If you would rather first understand what AI literacy is and where the obligation came from, start with our piece on AI literacy as the first line of defence.

Frequently asked questions

Is an AI Act training certificate useful for anything?

The law does not require one. It is convenient, because it records the name, the date and the scope of the training in one place, and you need that data anyway. Treat it as a carrier of information, not as evidence in itself.

What should you show instead of a certificate?

An internal record of what you did: who, when, what scope and why that scope. The European Commission states explicitly that an internal record of training or other measures is enough. The strongest element is the link between a person and the system that person uses.

Does the obligation apply to a sole trader?

Article 4 sets no threshold based on the size of the organisation. It binds providers and deployers, including the smallest ones using off-the-shelf tools. The scope of the measures is proportionate to how many systems you use and how.

Does the training have to be repeated every year?

The law gives no frequency. It gives a criterion: the measures must take account of the context in which the AI systems are used. Since both the wording of Article 4 and the set of tools in most companies have changed, a one-off exercise from a year ago describes a different reality.

Do universities and public authorities fall under this obligation too?

Yes. Article 4 does not distinguish between organisations by legal form or sector. What counts is the role: whether you provide an AI system or deploy it. A public body using off-the-shelf tools is a deployer.

This material is for information purposes. It is not legal advice or a guarantee of compliance with the AI Act. For a specific organisation, consult a lawyer.

Not sure where to start? Check your AI Act readiness and see in about three minutes which obligations apply to your organisation.

✦ This article was written with the help of artificial intelligence and reviewed before publication by the author, who takes editorial responsibility for it.