Art. 4 EU AI Act obliges providers and deployers to take measures on their staff’s AI literacy (since the Digital Omnibus without guaranteeing a specific level). The duty has applied since 2 February 2025, with no transition period and no exemption for small organizations. The Academy provides six courses, certificates with an expiry date, and a competence score you can show to an authority or a customer.

At a glance

Included from: Enterprise
Where in the app: Left navigation → Academy
Output: Certificates per person, organization-wide competence score, Art. 4 evidence
Legal basis: Art. 4 EU AI Act
API: /api/v1/academy

The six courses

Course	For whom
AI Act basic training	All staff. The short entry point: what the AI Act is, which tools we use, what is allowed, what to do when unsure.
EU AI Act – fundamentals	Anyone going deeper: risk classes, prohibited practices, high-risk duties, provider vs deployer role, transparency duties, GPAI, penalties and deadlines.
GDPR for staff	Core principles, personal data, legal bases, data subject rights, breaches, processing agreements and TOMs – including AI tools at work.
Information security for staff	Passwords, phishing, mobile work, clean desk, reporting security incidents, and shadow IT through AI tools.
AI risk management in operations	For roles with responsibility in AI operations: why risk management is needed and how it works in practice.
Whistleblower protection	Reporting channels, protection from retaliation, and how this interacts with AI-related reports.

How a course works

Entry assessment (optional)

Anyone who already knows the material can prove it instead of repeating it. The pass mark is 80 percent – deliberately higher than the final test.

Lessons and quick checks

Short lessons with interim questions. Progress is stored per lesson, so training can span several sittings.

Scenarios

Decision situations from everyday work – "customer data in ChatGPT?" rather than multiple choice on legal text. This transfer into practice is exactly what Art. 4 expects.

Final test and certificate

The pass mark is usually 70 percent; individual courses set it higher. On passing, a certificate with its own code is issued.

Certificates expire – deliberately

A certificate is valid for one year from issue. After that the evidence has lapsed and the course must be taken again.
30 days before expiry an automatic reminder goes to the person concerned, a second one on expiry itself. Each stage is sent only once.
Every repetition counts as its own cycle. The history therefore shows not just the current state but training continuity – which is the actual evidence.
Administrators see the certificates of the whole organization, not only their own.

The competence score

A value from 0 to 100 per person, aggregatable per department and organization. It combines five factors – certificates weigh most, because they are the most defensible proof.

Factor	Weight	What it measures
Courses	45%	How many mandatory courses have been passed.
Quiz result	20%	How well the final tests were passed.
Recency	20%	How fresh the certificates are. Evidence from last month is worth more than evidence about to expire.
Scenarios	10%	Whether practical decision situations were worked through.
Streak	5%	Regular engagement; fully met from 14 consecutive days.

Not a performance ranking of individuals

Aggregated evaluations are only produced from a group size of five people. Smaller groups return no value – otherwise a departmental report would be an individual report by another name. Also mind co-determination: training data is employee data, and evaluating it is usually subject to works council involvement.

Relationship to AI literacy records in assurance

The Academy evidences competence per person. The AI literacy records in the assurance file evidence it per AI system and audience – for example "every caseworker operating this scoring system is trained". For high-risk systems you need both: individual participation and the system-level mapping.