AI training in procurement: how to meet the AI literacy duty
What Article 4 of the EU AI Act requires since its 2026 rewrite, what AI training for procurement staff can look like and how to record it, with a template.
This article is also available in Deutsch.
The EU AI Act does not literally require AI training, but training is the obvious way to meet the AI literacy duty: Article 4 requires organisations that use AI systems to take measures that support AI literacy. In our view, procurement teams are best served by role-based AI training, clear usage rules and a short written record. Neither certificates nor a set level of skill for each individual are required.
Is AI training for procurement staff mandatory?
Article 4 of the AI Act has applied since 2 February 2025. As first adopted, it told providers and deployers to take measures to ensure a sufficient level of AI literacy among their staff. Regulation (EU) 2026/1744, in force since 27 July 2026, softened that: they now take measures that support the development of AI literacy. These must take into account people’s technical knowledge, experience, education and training, the context of use, and the people or groups the systems are used on. Organisations do not have to guarantee any specific level for any individual.
So the duty is lighter, but it has not gone away. The European Commission’s AI literacy Q&A, updated on 20 October 2026, makes that point too. Guides that still talk about a “sufficient level” of AI literacy reflect the old wording. This article reflects the position on 5 November 2026.
Any deployer is covered, which means your company or public body if procurement uses an AI system under its authority in a professional context. Size and sector make no difference, as Germany’s Federal Network Agency (in German) points out. In short:
| Question | Answer | Basis |
|---|---|---|
| Does it have to be a training course? | No. The format is open: self-study, workshop or a multi-stage programme, in-house or external. | Federal Network Agency |
| Do we need a certificate? | No. | Commission, Federal Network Agency |
| Must everyone reach a set level? | No. Measures depend on role, prior knowledge and use. | Art. 4(1) |
| Can we just hand out the instructions for use? | In many cases, no. The Commission says this is often ineffective. | Commission |
| Does this only mean employees? | No. It also covers people dealing with operation or use on your behalf, such as contractors or service providers. | Art. 4(1), Federal Network Agency |
| Do we have to prove anything? | No form is prescribed. The Agency advises good documentation, and the Commission mentions internal records. | Federal Network Agency, Commission |
What happens if you do nothing?
Supervision sits with national market surveillance authorities, not the EU AI Office. According to the Commission, they began supervising on 2 August 2026 and could impose penalties and other measures, which must be proportionate to the nature and gravity of the infringement. Our article on the EU AI Act in procurement explains the Federal Network Agency’s role in Germany.
We cannot see a specific fine for Article 4 at present: it is not listed in Article 99(4), and section 15 of the German KI-MIG (in German) does not mention it. The more likely exposure comes when something goes wrong. The Federal Network Agency writes that a lack of AI literacy can be seen as a breach of the duty of care, especially where harm results. The Commission adds that the provider of an AI system can be sued under national law if harm occurs, although the Regulation itself creates no right to compensation.
Why does procurement need AI literacy even without a fine?
Because the profession itself reports a gap. In the Einkaufsbarometer Mittelstand 2026 (in German), a survey of 521 procurement and finance professionals by Onventis, the German procurement association BME and ESB Business School, 66.7 per cent named a lack of AI skills as a challenge. Another finding: 58.5 per cent saw a training need in critically assessing and interpreting AI output. Only 3.0 per cent felt no further skills were needed.
Training alone does not automatically close the gap, though. According to the German digital association Bitkom (in German), 70 per cent of German companies with at least 20 employees train at least some staff on AI (only 11 per cent train everyone), yet 66 per cent rate their employees’ AI skills as low. For us, that is an argument for tying training closely to real tasks.
How do you structure AI literacy training for procurement?
The Federal Network Agency recommends three steps that translate well to a buying team:
- Work out what is needed: Who uses which AI system, for what, with which opportunities and risks? Your AI inventory is the starting point.
- Design the measures: Establish your organisation’s role, consider prior knowledge, tasks, context and risk, and set goals and responsibilities.
- Record, review, refresh: Write the measures down, check them regularly and renew them when needed.
On content, the Agency suggests three levels, which are neither mandatory nor exhaustive: basic understanding, advanced skills and role-specific training. For procurement we would split it as follows. This is our recommendation, not a legal requirement.
| Audience | Typical use | Training focus |
|---|---|---|
| Everyone in procurement | Drafting, research and summaries with an assistant | Basics, hallucinations, data rules, checking output |
| Operational buyers | Capturing order data, invoices and quotes | Clear instructions, spot checks, handling errors |
| Strategic buyers, category managers | Spend analysis, market research, comparing quotes, negotiation prep | Checking sources, model limits, confidentiality of terms |
| Head of procurement | Approvals, rules, accountability | Roles and risk classes, governance, handling borderline cases |
| Buyers of AI systems | Reviewing requests from other departments | Intended purpose, questions for vendors, role changes under Art. 25 |
| External parties acting for you | Service providers using AI on your behalf | Whether and how Art. 4 applies; the Commission says whether a contract clause is needed depends on system and risk |
If you later deploy high-risk systems under Annex III, Article 26(2) requires you, from 2 December 2027, to assign human oversight to people with the necessary competence, training and authority. That goes beyond the general duty in Article 4.
If you have a works council, involve it early. The German law firm CMS (in German) takes the view that its rights on vocational training can extend to training on the use of AI.
What should AI training for buyers cover?
In our view, seven topics cover the core. Practise them on your team’s own tools and tasks.
The rules in points 2 and 5 should be in writing before training starts. Our overview of the prerequisites for AI in procurement shows what else you need.
How do you record AI training?
The Regulation prescribes no template. The Federal Network Agency mentions, among other things, the type of measure, its scope in content and time, and the participants. The decision on measures should also be plausible and traceable. The template below builds on that; points 4 to 8 are our own additions.
A simple table per person or group, linked to your AI inventory, works well. When a tool or purpose changes, you can see at once who needs a refresher.
Which resources can help you start?
You do not have to buy in the basics. The Federal Network Agency points to sources including the Mittelstand-Digital centres, the European Digital Innovation Hubs and the free online offers from KI-Campus and the appliedAI Institute for Europe. The Commission also runs a public repository of practices, although copying them does not automatically create a presumption of compliance with Article 4. Such resources are generally not specific to procurement, so you will need to add your own data rules and exercises based on your own tasks.
Your next step
You can set up the basics yourself. If you would like support, our AI enablement and training runs as a half-day or full-day format using examples from your own procurement. Your team receives a tailored prompt library and a short usage guide, and internal champions stay on as go-to contacts. The training helps you with Article 4, but it does not replace legal advice.
For a no-obligation initial call, please use the contact form.
Sources
- Regulation (EU) 2024/1689 (AI Act), consolidated version of 27 July 2026, EUR-Lex
- Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), Official Journal of the EU, 24 July 2026
- European Commission: AI Literacy – Questions & Answers, updated 20 October 2026
- Bundesnetzagentur: KI-Kompetenz (in German), accessed 5 November 2026
- KI-MIG, German Act on market surveillance and innovation support for AI (in German), BGBl. 2026 I No. 223
- TECHNIK+EINKAUF: KI im Einkauf: Automatisierung zeigt erste Wirkung (in German), 9 June 2026, on the Einkaufsbarometer Mittelstand 2026 (survey January to March 2026)
- Bitkom e. V.: Erstmals nutzt die Mehrheit der Unternehmen KI (in German), press release, 14 September 2026 (603 companies with at least 20 employees)
- CMS Germany: Einführung von KI im Unternehmen – Einbindung des Betriebsrats (in German), 18 July 2024
Frequently asked questions
Is AI training for employees legally required?
Not as such. Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures that support AI literacy. It does not prescribe a format, but training is the obvious way to do it.
Do we need a certificate for AI literacy training?
No. The European Commission and the German Federal Network Agency both say no certificate is needed. The Commission mentions internal records as an option, and the Agency recommends documenting the type, scope and participants of each measure.
Do staff who only use ChatGPT or Copilot need training?
They are covered if the organisation uses these tools in a professional context. The Commission says explicitly that staff in this situation should be told about specific risks such as hallucinations. How much is needed depends on the use and on what people already know.
How often should AI training be repeated?
There is no fixed interval. The Federal Network Agency recommends reviewing measures regularly and refreshing them as needed. Sensible triggers include a new tool, a new use case or new tasks in the team.
Can we be fined for not running AI training?
Article 4 is not listed in Article 99(4) of the AI Act, and section 15 of Germany’s KI-MIG does not mention it either. The duty still applies. The Commission notes that national market surveillance authorities could impose penalties and other measures, and according to the Federal Network Agency a lack of AI literacy may count as a breach of the duty of care, especially if harm results.