AI officer: mandatory or voluntary?
The EU AI Act does not require an AI officer. What is required are measures on AI literacy under Art. 4; each company decides for itself who coordinates them.
Do we need an AI officer?
No, the EU AI Act contains no obligation to appoint an AI officer. Unlike the GDPR with its data protection officer (Art. 37 GDPR), the AI Regulation provides for no such role. In its questions and answers on AI literacy, the European Commission makes clear that Art. 4 prescribes no particular organisational structure, neither an AI officer nor an AI board.
What is required is something else: providers and deployers take measures to support the development of AI literacy of their staff and other persons acting on their behalf (Art. 4(1)). The company itself decides who plans and tracks these measures.
When does a fixed point of responsibility still make sense?
A named person is worthwhile as soon as several AI tools are in use or teams try out new services themselves. Then someone is needed to keep an overview and answer questions, for example in these cases:
- Your company uses several AI services, such as ChatGPT, Microsoft Copilot and AI functions in the CRM.
- You use AI in an area listed in Annex III, for example in recruitment. From 2 December 2027, human oversight there must be assigned to persons with the necessary competence, training and authority (Art. 26(2)).
- Customers or auditors, for example in ISO 27001 audits, ask who is responsible for AI.
Which tasks fit the role?
Four tasks are typical, and they can also be split between several people:
- Keep an overview of the AI systems in use and their providers.
- Draw up an AI policy and keep it up to date, for example with our AI policy template.
- Plan AI literacy measures and record who took part in which measure and when.
- Review new AI projects: do they fall under the high-risk rules or the transparency obligations under Art. 50?
A simple measure for all employees is a documented EU AI Act training course with a personal certificate for each person and an audit report for the company.
Can the data protection officer take this on?
Yes, that is possible, but it is not an obligation. The Commission answers the questions on an AI officer, on a dual role with the data protection officer and on an AI board together: no particular structure is prescribed for Art. 4. If the data protection officer takes on the role, it must not give rise to a conflict of interests with their tasks under the GDPR (Art. 38(6) GDPR). Anyone who decides on the use of AI should not at the same time oversee its data protection.
Frequently asked questions about the AI officer
Is there a fine if we have no AI officer?
No. The EU AI Act does not require an AI officer, so there is no fine for not having one. The Member States lay down the sanctions for infringements of Art. 4 (Art. 99(1)); Art. 4 requires measures on AI literacy, not a particular role. More on the Fines page.
Does an AI officer need specific qualifications?
No, there is no prescribed training or exam. Knowledge of the AI systems in use, the EU AI Act and data protection is useful. For employees, too, the Commission does not require a certificate; an internal record of the training and other measures is enough.
Does this apply to small companies too?
Yes. Art. 4 applies to all providers and deployers regardless of company size. In small companies, management often coordinates this itself; a dedicated position is not needed. What Art. 4 requires in detail is explained on the page AI literacy obligation under Art. 4.
Train your team now AI policy template
Note: this article is for general information only and does not constitute legal advice.