--- title: EU AI Act Training Requirements description: Does the EU AI Act require AI training for employees? Yes — Article 4 has applied since February 2025. What you must cover, and for which roles. image: https://www.cybercoach.com/hubfs/featured-image-ai-act.png --- [![CyberCoach Full Logo with Bot Icon](https://www.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg)](https://www.cybercoach.com?hsLang=en) - PRODUCT ## CyberCoach at a glance An industry-changing platform built on peer-reviewed research: phishing, secure coding, and AI skills training, delivered directly in Teams, Slack, or the browser. ### [The Science Behind CyberCoach Why traditional phishing simulations don't work, according to peer-reviewed research from ETH Zurich.](https://www.cybercoach.com/science-behind-cybercoach?hsLang=en) ### [Is Phishing Simulation Legal Under GDPR? 9 steps GDPR requires before you phish your employees — and a new simulation approach that doesn't need any of them.](https://www.cybercoach.com/legal-basis-phishing-simulation?hsLang=en) ### [Pricing Flexible plans, also monthly.](https://www.cybercoach.com/pricing?hsLang=en) ### [Blog Latest insights into security awareness and what's new with CyberCoach.](https://blog.cybercoach.com?hsLang=en) ### [Customer Stories Read more about how CyberCoach has helped organizations across different industries modernize their approach to security and AI training.](https://www.cybercoach.com/customer-stories?hsLang=en) ### [OT Security Training Targeted training for employees working with OT technology.](https://www.cybercoach.com/ot-security-training?hsLang=en) - [AI TRAINING](https://www.cybercoach.com/ai-security-training?hsLang=en) ## [AI Training The most comprehensive role-based AI security and productivity training — built to help employees use AI effectively and safely, and keep your organization compliant with the EU AI Act.](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [AI Security Training Why choose CyberCoach for your AI security training needs?](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [EU AI Act Training Requirements: What You Actually Have To Do AI literacy training has been mandatory since February 2025.](https://www.cybercoach.com/eu-ai-act-training-requirements) - [FOR DEVELOPERS](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ## [For Developers Go beyond OWASP Top10 and offer hands-on interactive training for technical roles in secure coding and efficient use of AI.](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ### [Secure Coding Skills Meet ISO/IEC 27001 or SOC 2 requirements for secure development practices with no-nonsense training for your developers and other technical roles, directly in Microsoft Teams or Slack chat.](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [COMPANY](https://www.cybercoach.com/about-us?hsLang=en) ## [About us We're growing into the most diverse training platform company on the planet.](https://www.cybercoach.com/about-us?hsLang=en) ### [About Us Get to know our international team.](https://www.cybercoach.com/about-us?hsLang=en) ### [Contact Us Get in touch.](https://www.cybercoach.com/contact-us?hsLang=en) ### [Careers We are hiring.](https://www.cybercoach.com/careers?hsLang=en) ### [Partner with us Learn more about our partner program.](https://www.cybercoach.com/partnerships?hsLang=en) [FREE TRIAL](https://www.cybercoach.com/free-trial?hsLang=en) [GET A DEMO](https://meetings-eu1.hubspot.com/maria-bique/cybercoach-demo?uuid=88959d26-2ff7-4dd0-8ebd-dd43eb31443e)           # EU AI Act training requirements: what you actually have to do ![](https://www.cybercoach.com/hubfs/ai%20training%201%20badge.svg) **If your staff use AI at work, you are a deployer under the EU AI Act and Article 4 obliges you to take measures supporting their AI literacy.** It has applied since 2 February 2025, and national authorities began supervising and enforcing it in early August 2026. This is not something that organizations should treat as a tick-the-box exercise. AI competence is becoming a core operating capability, and training decides whether your people use AI well or use it badly: capturing the productivity upside, or leaking data into a public model, trusting a hallucinated answer, or spreading shadow AI tools nobody approved. [Start a free trial](https://www.cybercoach.com/free-trial?hsLang=en) [How CyberCoach covers this](https://www.cybercoach.com/eu-ai-act-training-requirements#how-cybercoach-helps) ## Your obligations, in one screen Required ### Train everyone who uses AI on your behalf Employees, and also contractors and service providers operating AI systems for you. There is no minimum-sophistication threshold: a team using a chatbot to draft copy is in scope and needs to understand risks such as hallucination. Required ### Match the training to the systems you actually use Cover what AI is and how it works, whether you are a provider or a deployer, the risks of your specific systems and their mitigations — including the legal and ethical dimension, not just the technical one. Required ### Differentiate by role and prior knowledge Technical knowledge, experience and education differ across your workforce, and so should the depth of training. Even staff with AI qualifications still need to know your systems, your policies and the legal aspects. Required — and stricter ### High-risk systems: train for human oversight If you deploy a high-risk AI system, the people overseeing it must be trained to actually exercise that oversight. This duty is separate from Article 4 and did not change in July 2026. Required ### Keep a record you can produce later An internal record of trainings and guidance is needed. The exposure is rarely a spontaneous audit; it is an incident, followed by the question of whether the people involved had been trained. ## What happens if you do nothing ![](https://www.cybercoach.com/hubfs/ai_hallucination_training_badge.svg) **Who enforces:** national authorities — practice will vary by country **Penalties:** set by national law, which member states were due to adopt by 2 August 2025  **How it is applied:** proportionately, case by case, weighing gravity and whether the failure was intentional or negligent **The realistic trigger:** an incident traced to missing training or guidance — which makes your training records the thing that matters There is also a quieter reason not to wait. Staff are already using AI at work, with or without a program telling them how — and the gap between organizations that are getting real value from it and organizations that are absorbing risk from it usually comes down to whether anyone taught people how. Article 4 gives you the mandate to make that deliberate: a workforce that knows which tasks to hand to AI, how to check what comes back, and where the actual boundaries are. The same training that satisfies the requirement is what actually makes a difference for your organization. ## How CyberCoach covers it Two things distinguish this from generic AI awareness content, and both matter more for capability than for compliance. ![](https://www.cybercoach.com/hubfs/eu-ai-act-training-badge.svg) ### Role-based, not one course for everyone A developer using a coding assistant, a teacher using AI in a classroom, and a salesperson, all use AI differently. In CyberCoach, each gets its own path. Skilled users can demonstrate their skills and skip trainings, as well as complete more challenging versions of trainings. Both support the Article 4 requirement to differentiate by role and prior knowledge. ![](https://www.cybercoach.com/hubfs/llm%20basics%20for%20developers.svg) ### Updated continuously as the technology moves AI capability that was current a year ago is not current now, and annual training cannot track that. Content is updated as tools, threats and guidance change, and delivered in short recurring sessions — so your people stay current and your compliance record stays current with them, rather than pointing at a campaign from last spring. Underneath that, each obligation maps to something you can run in Microsoft Teams or a browser, with no new portal and no new login. **Everyone who uses AI** — practical AI use training: what to use AI for, what to verify before trusting output, what must never go into an AI system. Scenario-based, in their own words, so it holds up better than a policy acknowledgement. **Your systems, not generic ones** — any text-based material you already have, an AI policy, an acceptable-use rule, a system's instructions for use, becomes an interactive scenario in minutes. That is how training gets specific to the AI you actually deploy. **Human oversight for high-risk systems** — scenarios where the learner has to decide when to override, escalate or stop, which is the capability the oversight duty is about. Build them from your own procedures. **Training and policy acknowledgement records**— successful completions are recorded per person, which is what an authority or auditor would ask for.  **Beyond the minimum** — the same platform that satisfies Article 4 covers modern AI-related phishing and social engineering training, secure coding for developers, and role-based programs for the rest of the organization, so AI literacy is not a separate compliance training. Your users will be more motivated to learn about AI Risks, when the same trainings also train them practical AIskills.  No training product grants AI Act compliance, ours included. Compliance depends on your systems, your risk analysis and your records. What a platform can do is deliver the role-differentiated training and produce the evidence.   ## Frequently asked questions ### Does the EU AI Act require AI training for employees? Yes. Article 4 requires providers and deployers of AI systems to take measures supporting the AI literacy of their staff and of others using AI on their behalf, and it has applied since 2 February 2025.  ### Does using ChatGPT at work put my company in scope? Yes. A company whose employees use a general-purpose AI tool to draft copy or translate text is a deployer, and those employees should be informed about the specific risks involved, such as hallucination. There is no size or sophistication threshold below which Article 4 stops applying. ### Is it enough to send staff the AI tool's instructions for use? Generally no. Relying on instructions for use, or asking staff to read them, may well be ineffective, and for deployers of high-risk AI systems it is not sufficient on its own — further measures are necessary so that the people involved can genuinely exercise human oversight. ### Who enforces Article 4, and what are the penalties? National authorities supervise and enforce, since early August 2026, and penalties come from national law rather than from the AI Act itself. Sanctions are applied proportionately, case by case, and are more likely where an incident can be traced to a lack of appropriate training and guidance. ### Do we need an AI officer or an AI governance board? Not for Article 4. No specific governance structure is mandated, and there are no sector-specific requirements, including for financial services and healthcare.  ### Are small organizations exempt from the AI literacy requirement? No. Article 4 applies to providers and deployers of AI systems regardless of headcount or turnover — there is no small-business exemption and no threshold below which it stops applying. What scales with your size is the effort, not the duty: the measures have to be appropriate to your systems, your risks and your people, so a ten-person company using one AI tool has a far smaller job than a bank.  ### Does the AI Act apply to public sector organizations? Yes. Public authorities and public bodies are deployers when they use AI systems, and Article 4 applies to them on the same terms as to private employers. Sources and disclaimer Based on the European Commission's [AI literacy questions and answers](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers) (last updated 27 July 2026), Regulation (EU) 2024/1689 (AI Act, Articles 4, 14 and 26) and the Digital Omnibus on AI, Regulation (EU) 2026/1744. The Commission's Q&A is non-binding guidance and is updated periodically. Published by CyberCoach, which sells AI and security training and therefore has a commercial interest in these conclusions. This is general information, not legal advice, and no lawyer–client relationship arises from reading it. It does not address your jurisdiction, sector or facts. Obtain qualified local counsel before acting. Reviewed 28 August 2026 Corrections: [info@cybercoach.com](mailto:info@cybercoach.com) ## Start with one team Run practical AI training in your own Microsoft Teams tenant or the browser, see the completion records it produces, and decide from there. ![](https://www.cybercoach.com/hubfs/eu-ai-act-training-badge.svg) [Start a free trial](https://www.cybercoach.com/free-trial?hsLang=en) ### Get notified of what's going on in AI and security awareness and compliance **Expert Tips:** Stay informed with curated content, expert opinions, and case studies that are relevant to your organization's security awareness strategy. **Special Offers:** Access to CyberCoach promotions and campaigns.  **Stay Informed:** Get the latest insights and updates on security and AI compliance trends, threats, and best practices delivered directly to your inbox. ![cybercoach\_logo\_white.svg.2023\_03\_15\_16\_58\_04.0](https://www.cybercoach.com/hubfs/cybercoach_logo_white.svg.2023_03_15_16_58_04.0.svg) ### Product - [For Developers](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [AI Security](https://www.cybercoach.com/ai-security-training?hsLang=en) - [Manage Subscription](https://billing.stripe.com/p/login/28o4jRclF4gab1C6oo) - [FAQ](https://www.cybercoach.com/faq?hsLang=en) ### Connect - [Partner Program](https://www.cybercoach.com/partnerships?hsLang=en) - [Careers](https://www.cybercoach.com/careers?hsLang=en) - [For Media](https://www.cybercoach.com/media?hsLang=en) - [Contact Us](https://www.cybercoach.com/contact-us?hsLang=en) ### Legal - [Privacy](https://www.cybercoach.com/cybercoach-website-privacy?hsLang=en) - [General Terms](https://www.cybercoach.com/general-terms?hsLang=en) ### Company - [About Us](https://www.cybercoach.com/about-us?hsLang=en) - [Blog](https://blog.cybercoach.com?hsLang=en) - [ESG Policy](https://www.cybercoach.com/esg-policy?hsLang=en) © 2026 CyberCoach All rights reserved ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#organization", "@type" : "Organization", "foundingDate" : "2019", "legalName" : "Cult Security", "logo" : "https://www.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg", "name" : "CyberCoach", "sameAs" : [ "https://www.linkedin.com/company/cult-security", "https://x.com/cybercoachUS", "https://www.instagram.com/cybercoachus/", "https://www.youtube.com/@CyberCoachOfficial" ], "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#software", "@type" : "SoftwareApplication", "applicationCategory" : "BusinessApplication", "applicationSubCategory" : "Security awareness and AI skills training", "availableLanguage" : [ "English", "Spanish", "Portuguese (Brazil)", "Portuguese (Portugal)", "French", "Dutch", "German", "Swedish", "Finnish" ], "description" : "CyberCoach is a role-based security awareness, privacy and AI skills training platform that runs as a conversational app inside Microsoft Teams, Slack or a web browser. Employees practice AI skills and responding to social engineering in short, psychologically safe scenario-based sessions. Learning is anonymous while successful completions are recorded per user so the organization can evidence training completion for compliance. CyberCoach can also run on pseudonymous identifiers such as Slack or Microsoft UUIDs, with no personal data shared with CyberCoach.", "featureList" : [ "Conversational phishing and social engineering challenges", "Role-based training programs for technical and non-technical roles", "AI security and AI use training", "Secure coding training for developers", "OT security training", "Custom content creation", "Compliance assessments (ISO/IEC 27001, GDPR, AI compliance)", "Anonymous learning with per-user completion records for compliance", "Optional pseudonymous deployment using Slack or Microsoft UUIDs" ], "name" : "CyberCoach", "offers" : [ { "@type" : "Offer", "description" : "Cover the basics.", "name" : "Starter", "price" : "49", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Broad topic coverage, custom content, hosted kick-off.", "name" : "Advanced", "price" : "159", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Full coverage, 24/7 AI chat, compliance assessments, hosted kick-off.", "name" : "Complete", "price" : "179", "priceCurrency" : "EUR" } ], "operatingSystem" : "Microsoft Teams, Slack, Web browser, iOS, Android", "publisher" : { "@id" : "https://www.cybercoach.com/#organization" }, "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is a security awareness, privacy and AI skills training platform that runs inside Microsoft Teams, Slack or a web browser. Employees practice role-based skills such as responding to social engineering, ethical and productive use of AI and even secure coding skills in short conversational scenarios. Learning is anonymous, while successful completions are stored so the organization can evidence training completion for compliance frameworks such as ISO/IEC 27001 and SOC 2." }, "name" : "What is CyberCoach?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, but not by sending deceptive emails to employees. CyberCoach uses conversational phishing challenges in which employees practice recognizing and responding to social engineering scenarios in Teams, Slack or the browser. Peer-reviewed research, including Lain et al. (ETH Zurich, 2022 and 2024), finds that traditional email-based simulated phishing does not reduce risk and can increase misplaced trust in the inbox." }, "name" : "Does CyberCoach do phishing tests?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Learning is anonymous: how an employee answered a training scenario is never visible to managers or administrators. What is recorded is successful completion, so the organization can evidence who has completed required training for compliance purposes. This is privacy by design: the sensitive part of the interaction stays private, and only the completion fact is retained." }, "name" : "Are individual employee answers visible to managers?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. CyberCoach can be deployed using pseudonymous identifiers, such as Slack or Microsoft UUIDs, so no personal data is shared with CyberCoach. Compliance reporting still works: the mapping between a UUID and a real person is resolved only for authenticated and authorized administrators within the customer's own organization." }, "name" : "Can CyberCoach be used without sharing personal data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach supports security awareness and secure development training requirements under ISO/IEC 27001 and SOC 2, and includes assessments covering ISO 27001, GDPR and AI compliance on the Complete plan." }, "name" : "Which compliance requirements does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is available in English, Spanish, Portuguese (Brazil), Portuguese (Portugal), Polish, French, Dutch, German, Swedish, Norwegian, Danish and Finnish, with more languages in development." }, "name" : "Which languages does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Plans start at 49 EUR per month for Starter, 159 EUR per month for Advanced and 179 EUR per month for Complete, available monthly or yearly, including through the Microsoft Azure Marketplace." }, "name" : "How much does CyberCoach cost?" } ] } ```