At one municipality the executive board asks who is responsible for AI literacy. HR points to the training plan, which includes an AI module. IT points to the register of tools it has just set up. The data protection officer says she advises on it but cannot lead it. Three answers, all correct, and none of them answers the question.
The answer is the organisation, with final responsibility resting with the board. Article 4 of the AI Act is addressed to providers and deployers, which means the employer as a whole. The law names no department and prescribes no job title. What Article 4 does require is set out in AI literacy in 2026. This piece is about how the work is divided underneath: who is responsible for what, and who keeps the evidence.
Why doesn't the law name a department?
Because the measure covers three things at once, and they sit with different people. Article 4 asks for measures that take account of people's knowledge and experience, the context in which they use AI and the persons on whom the systems are used. The first is a question for HR, the second for IT and the business, the third for privacy.
The AI Act assigns responsibility by role, not by department: provider or deployer. The deployer is the organisation that uses a system under its own authority. Everything that comes with that role is covered in the EU AI Act for employers. Inside the organisation you have to divide it up yourself, and that is exactly what the municipality in the opening has not yet done.
Who is responsible for what?
| Role | Responsible for | Keeps as evidence |
|---|---|---|
| Board or management | Deciding who is responsible for what, the AI policy and knowing for itself what has been decided about tools | The policy and the decisions, with the date and who took them |
| HR or learning and development | Role-specific training, and onboarding new staff and contractors | Who received which training, when and on what topic |
| IT or the administrator | The register of tools with their statuses, and how each tool decision reaches employees while they work | The register, who took which decision and the aggregated figures on notices and highlights |
| Data protection officer | Advising on content, checking whether the measures suit the processing, flagging what is missing | The advice and the outcome of the check |
| The business, team by team | How AI is used in its own work, and oversight of systems that make decisions about people | The instructions for each system and who was trained on it |
| Works council | A say in how measurement is done, and in systems used on employees | Its advice or consent |
The DPO row needs a word of explanation. Under the GDPR the data protection officer has an advisory and monitoring role and must be able to carry it out independently. Make the DPO owner of the training and the register, and you are asking them to monitor their own work. That is why "the DPO will handle it" goes wrong in almost every organisation: not because the DPO is not capable, but because they can then no longer check anything.
Why doesn't a single owner work?
An organisation that hands AI literacy to HR gets a good course and a folder of attendance lists. What HR lacks is a view of which tools are actually in use, a way to show the decision on a tool when someone opens it and figures on what happens after the course. Those three sit with IT.
One that hands it to IT gets a register and figures, but no role-specific training and nobody who knows whether the training suited the people who received it. And one that hands it to the DPO gets good advice and loses its check.
The evidence an auditor asks for comes in three kinds that follow exactly these lines: the training and who received it, what was agreed and decided for each role and each tool, and behaviour while people work, in aggregated figures. Our article on how to demonstrate AI literacy explains why you need all three. For this piece the lesson is simpler: if the evidence comes in three parts held by three departments, someone has to be given the job of putting them together.
What does that look like at the municipality?
The board decides three things. HR keeps ownership of the training but splits the AI module into a core for everyone and an add-on for teams that use systems to make decisions about residents or employees. IT keeps ownership of the register and takes on the job of showing the decision on a tool at the moment someone opens it. The DPO gets no ownership but a fixed role: each quarter she checks whether the training, the register and the figures still line up, and records that check.
The first check shows that the register lists Copilot as allowed, while an inventory finds Perplexity, ChatGPT and three specialist tools in use alongside it, two of which appear nowhere in the register. HR had not covered those tools in the training, because they were not on the list. That is not an incident. It shows that without the quarterly check the three parts drift apart, and that a register holding only what people asked for soon falls behind what is actually happening.
