AI officer: is it mandatory?

If you search for "AI officer" in German, you mostly end up with course providers. Some ads speak of an "AI officer obligation" and threaten fines in the millions. The Federal Network Agency (Bundesnetzagentur), as a rule Germany's supervisory authority for the AI Act, takes a more sober view: on its page on AI literacy, introducing an AI officer is explicitly on the list of things that are not required. You still cannot do without any responsibility at all. Here is what really applies, and how to set up the role leanly for a small team.

The key points in brief

• No obligation: Neither the EU AI Act nor the German implementing act (KI-MIG) requires you to appoint an AI officer. The Bundesnetzagentur and the European Commission say so explicitly.
• What applies is Article 4: Since the Digital Omnibus, you have to take measures that support the development of your team's AI literacy. You do not have to guarantee a specific level, and there is no fine for it in Germany.
• Not a second data protection officer: An AI officer has no statutory position, which means no freedom from instructions, no special protection against dismissal and no notification to an authority.
• A contact person is usually enough: Set out in your AI policy who approves new tools, organises training and keeps the records. That can also be the management itself.
• From December 2027 it can become more specific: If you use high-risk AI, for example to filter job applications, you have to assign human oversight to people with the necessary competence, training and authority.
• Certificates are voluntary. A course can help the person who takes on the role. It is not required, and it does not replace training for the rest of the team.

Is there an obligation to appoint an AI officer?

No. The EU AI Act (Regulation (EU) 2024/1689) contains no provision under which a company has to appoint an internal person for AI. The appointments the AI Act requires are mainly made by authorities and Member States, for example their supervisory authorities. For companies there is exactly one case: providers established outside the EU that place high-risk AI or general-purpose AI models on the EU market have to appoint an authorised representative in the EU (Art. 22 and Art. 54). That is a representative towards the authorities, not an internal officer, and it does not affect your company as a user of common AI tools.

The German AI Market Surveillance and Innovation Promotion Act (KI-MIG), in force since 29 July 2026, likewise only regulates which authorities are responsible and what they may do. It contains no obligation for companies to appoint anyone. What the supervisory authority can actually check is explained in our article on the Bundesnetzagentur as AI regulator.

Two bodies have answered the question explicitly:

• The Bundesnetzagentur lists on its page on AI literacy what is not required for Article 4: guaranteed levels of competence of individual persons, formalised or standardised training, external certification and "introducing an AI officer" (our translation).
• The European Commission answers in its questions and answers on AI literacy whether an AI officer is necessary as under the GDPR, whether a data protection officer and an AI officer can be the same person and whether an AI governance board is needed. Its answer: "No, no specific governance structure is mandated to comply with article 4 of the AI Act." (Page last updated: 20 October 2026.)

And the question "from when"? 2 August 2026, the date some ads mention, is the day the AI Act became largely applicable, including the transparency obligations. No obligation to appoint an AI officer was added at that point, and none is in the law for a later date either.

What Article 4 actually requires

Behind almost every offer for AI officers is Article 4 of the AI Act, the AI literacy obligation. It has applied since 2 February 2025 to everyone who provides or uses AI professionally. With the Digital Omnibus (Regulation (EU) 2026/1744), the EU reworded it with effect from 27 July 2026. Since then, Article 4(1) reads:

Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf […]. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

Before that, companies had to take measures "to ensure, to their best extent, a sufficient level of AI literacy" of their staff. The new wording is milder, but it is no all-clear. For the question about an AI officer, this means:

• The obligation applies to the company. It is addressed to "providers and deployers", in other words your company. If you appoint someone, you are distributing work. The responsibility stays with the company and therefore with its management.
• The obligation covers everyone who works with AI, not just one central person. Freelancers who use AI on your behalf count too.
• There is no fine in Germany. Article 4 is neither in the AI Act's catalogue of fines (Art. 99(3) to (5)) nor in the fine provisions of the KI-MIG (Section 15).
• Doing nothing remains risky. The Bundesnetzagentur writes: "A lack of AI literacy can be regarded as a breach of the duty of care, especially if it causes damage" (our translation). The authority recommends documenting the measures: their type, content and scope, and who took part.

One detail in the Bundesnetzagentur's recommendations is worth noting: when building AI literacy, organisations should define "goals and responsibilities" (our translation). That is the sensible core behind the idea of an AI officer. Someone should take care of it. That does not need a title, a certificate or a staff unit. What lean training looks like is explained in the article on AI literacy training.

AI officer and data protection officer compared

The name suggests that an AI officer is something like a data protection officer for AI. Legally, the two roles have little in common:

The obligation to appoint a DPO continues to apply unchanged in Germany (as of October 2026). Whether the 20-person rule will be dropped and what applies until then is explained by Dieter Datenschutz in the article DPO requirement: will the 20-person rule be scrapped?.

Can the data protection officer take on the AI role?

In principle, yes. A data protection officer may take on other tasks as long as this does not result in a conflict of interests (Art. 38(6) GDPR). With AI, it depends on what the role involves.

In 2023, the Court of Justice of the European Union ruled that a conflict of interests can exist if the data protection officer is entrusted with tasks that result in them "determining the objectives and methods of processing personal data" (judgment of 9 February 2023, C-453/21). Whether that is the case is assessed individually. But that is exactly what often happens when someone decides on AI tools: which tool is introduced, which data may go into it, what it is used for? Anyone who decides this and is at the same time supposed to monitor, as data protection officer, whether it complies with data protection law ends up checking themselves.

A workable split for small teams:

• Data protection officer: advises on new tools, reviews contracts and data flows, provides data protection training. This fits their statutory tasks.
• Management or AI contact person: decides on approval and enters the tool in the AI inventory.

This also applies to external data protection officers. They can provide valuable advice on AI. The decision on use should still stay within the company.

When a fixed role makes sense

No obligation does not mean that every solution is equally good. How much structure you need depends on how you use AI:

The last row is the closest the AI Act comes to an obligation to designate specific persons. It applies to high-risk AI under Annex III, which includes AI for recruiting or selecting applicants, from 2 December 2027. It refers to the people who oversee the system in use, for example the HR staff who work with such a tool. Here too, the law does not require a central staff unit: Art. 26(3) expressly leaves you free to organise your own resources. Which systems count as high-risk is explained in the article on the EU AI Act risk categories. For professionals bound by secrecy, AI in law firms is also worth a look.

What an AI contact person actually does

Whether you call them AI officer, AI lead or simply contact person: in small companies, the tasks are manageable.

1. Keep the AI inventory: Which tools do you use, for what and with which data? If you do not know, you quickly end up with shadow AI.
2. Approve or reject new tools: check data protection, the contract and the server location, with the data protection officer if needed, then decide and document the decision.
3. Keep the AI policy up to date: permitted tools, data rules, labelling. What this looks like is shown in the guide to the AI policy.
4. Organise and document training: who, when, what and to what extent. This is your proof for Article 4.
5. Keep an eye on transparency obligations: for example the notice that customers are talking to a chatbot, or the labelling of deepfakes (Art. 50).
6. Be the point of contact: for questions from the team and in case the Bundesnetzagentur requests documents.

Put the role in writing, with the name, the powers and a deputy. A role that exists only on paper, without time and without decision-making authority, helps nobody.

Courses and certificates: what they offer and what they do not

Courses for AI officers are offered by testing organisations, chambers and private academies, usually with a final exam and a certificate. One example: the course of a large testing organisation comprises 24 teaching units, costs a little over 2,500 euros net and ends with an exam; the certificate is valid for three years (as of October 2026).

Legally, the point is: none of these certificates is required. The Bundesnetzagentur makes clear that the AI Act does not provide for any certification requirement for training. The European Commission writes: "There is no need for a certificate." Organisations can keep an internal record of their training and other measures.

A course can still make sense if one person is really meant to fill the role and wants to acquire the knowledge in a structured way. In that case, look out for three things:

• Up to date: Does the course cover Article 4 as amended by the Omnibus and the new deadlines for high-risk AI (2 December 2027 and 2 August 2028)?
• Practical relevance: Is it about your tools and processes, or about corporate governance?
• Honest marketing: A provider that advertises with an obligation to appoint an AI officer is not taking the facts very seriously.

And one point that is often overlooked: one certified person in the company does not fulfil Article 4 for everyone else. The obligation covers every person who works with AI on your behalf.

The most common mistakes

• Booking a course because an ad claims there is an obligation. Ask for the legal provision first, then decide.
• Confusing a certificate with Article 4. The obligation concerns the whole team, not just one person.
• Letting the data protection officer decide on AI tools. Advising, yes; deciding, better not.
• Making nobody responsible. Then everyone uses whatever they like, and if the supervisory authority makes a request, nobody can provide records.
• Assigning the role only on paper. Without time, authority and a deputy, it has no effect.

How Klaus keeps the role lean

Klaus takes the legwork off the AI contact person's hands. In the free AI check-up, Klaus records your AI applications, assigns them to the AI Act's risk categories and shows you after about 20 minutes what needs to be done. From this, Klaus creates your AI policy, with your inventory, your tool rules and your responsibilities. For each AI system there is a checklist of obligations: what needs to be done, by when and how you prove it.

For Article 4, Klaus comes with ready-made learning units that take about 20 minutes. In the free plan (one person, one AI system), you create the policy and train yourself. From Klaus Basic, you train your team, and Klaus also checks your AI systems in the 6-phase check. When the law changes, as with the Omnibus, Klaus keeps track and tells you what changes.

Conclusion

You do not have to appoint an AI officer. The legal text, the Bundesnetzagentur and the European Commission all agree on that. What applies is Article 4: since the Omnibus, you have to actively support your team's AI literacy and, sensibly, document it, without having to guarantee a specific level. That needs a person who takes care of it, but neither a title nor an expensive certificate. For most small companies, a named contact person in the AI policy is enough. Things only become more specific if you use high-risk AI from December 2027 or provide AI yourself.