de
Two sets of rules are landing on L&D desks at the same time. NIS-2 has been in force in Germany since 6 December 2025. And Article 4 of the EU AI Act, the AI literacy duty, has applied since February 2025. Both have to do with training, and both raise questions L&D cannot answer alone.
A boundary first, because it matters to us: who exactly is obliged and who is liable for what depends on the individual organisation. That is a question for your legal department, not for a blog post. What can be said regardless is what these rules mean in practice for L&D’s work.
The symptom: training that is too slow
In many organisations the starting point looks like this: an annual information security briefing, created a few years ago and lightly updated since. A policy on AI, perhaps a webinar. And somewhere a list of who completed what and when.
The problem is less the content than the pace. Rules, threat landscapes and AI tools change faster than the production cycle of classic training. A study by Masterplan and Amadeus Fire shows the gap clearly: 55% of companies in the DACH region see AI as a top topic, but only 35% offer training on it (2025).
Three causes
The first cause is production. If a change to a course takes weeks, it gets postponed until the next big revision.
The second is the target group. One briefing for everyone is easy to administer, but it fits nobody properly. Someone handling customer data every day needs different examples from production staff, and someone using AI tools for text needs different rules from someone building models into processes.
The third is proof. Many organisations can say that a course exists. Fewer can say who completed which version and when. That is exactly the question asked when something goes wrong.
The instrument: a three-column inventory
Before producing new training, a simple inventory is worth doing. It needs no software; a spreadsheet will do.
- Topic: Which content on information security and AI use exists today, and how recent is the current version?
- Target group: Who is each course for, and are there groups for whom nothing exists?
- Proof: Can you show for each person which version they completed and when?
The table is filled in an afternoon. What it shows is usually uncomfortable but concrete: outdated versions, groups without training, gaps in proof. Take that list into the conversation with your legal department and your information security officer, who then decide what is mandatory.
What L&D should be able to do by 2027
Three capabilities follow from the inventory. Training must be changeable in days rather than weeks, so a new requirement does not wait for the next annual cycle. It must be producible in variants for different target groups and languages without each variant becoming a project. And every completion must land in the LMS with version and date, which usually works via SCORM, as described in SCORM explained.
With AI-assisted production, effort per training hour typically drops by up to 80%. Subtitles are available in 140 languages, voice-over in more than 50.
On Article 4, the framework has shifted since this article was first published. Since the amendment by the Digital Omnibus on AI, in force since mid-July 2026, there is no longer a mandated “sufficient” level of AI literacy for individuals. The obligation is now to support the development of AI literacy, with measures that fit the role and context of use of the people concerned. The European Commission explains this in its AI literacy questions and answers. For L&D the task stays the same: tailor training to each target group, document completions in a verifiable way and update content quickly when tools or requirements change.
Updated in October 2026: the Article 4 section reflects the amendment of the AI Act.
