At a municipality the executive board asks who is responsible for AI literacy. HR points to the training plan, which contains an AI module. IT points to the register of tools it has just set up. The data protection officer says she advises on it, but cannot lead it. Three answers, all three correct, and none of them answers the question.
The answer is: the organisation, with the board ultimately responsible. Article 4 of the AI Act is addressed to providers and deployers, and that is the employer as a whole. The law names no department and prescribes no job title. What Article 4 does ask is set out in AI literacy in 2026. This piece is about the division beneath it: who carries what, and who keeps the evidence.
Why does the law not name a department?
Because the measure is about three things at once, and those three sit with different people. Article 4 asks for measures matched to people's knowledge and experience, to the context in which they use AI, and to the persons on whom the systems are used. The first is an HR question, the second a question for IT and the business, the third a privacy question.
The AI Act divides responsibility along roles, not departments: provider or deployer. The deployer is the organisation that uses a system under its own authority. Everything that comes with that role is in the EU AI Act for employers. Internally you have to divide it yourself, and that is exactly what has not yet happened at the municipality in the opening.
Who carries what?
| Role | Carries | Keeps as evidence |
|---|---|---|
| Board or management | The decision on who carries what, the AI policy, and its own knowledge of what has been decided about tools | The policy and the decisions, with date and who took them |
| HR or learning and development | The explanation per role, the onboarding of new staff and contractors | Who received which explanation, when, and about what |
| IT or the administrator | The register of tools with statuses, and the way the decision per tool reaches the employee at the moment of work | The register, who took which decision, and the aggregated figures on notices and highlights |
| Data protection officer | Advice on the content, the check whether measures fit the processing, flagging what is missing | The advice and the outcome of the check |
| The business, per team | The use in its own work, and the oversight of systems that decide about people | The instruction per system and who was trained on it |
| Works council | Involvement in how measurement is done, and in systems used on employees | The advice or the consent |
The DPO row deserves a note. Under the GDPR the data protection officer has an advisory and monitoring role and must be able to carry it out independently. Making the DPO owner of the training and the register asks them to monitor their own work. That is why "the DPO will handle it" goes wrong in almost every organisation: not because the DPO cannot do it, but because they can then no longer check anything.
Why does one owner not work?
An organisation that places AI literacy with HR gets a good course and a folder of attendance lists. What HR does not have: sight of which tools are actually in use, a way to show the decision per tool at the moment someone opens the tool, and figures on what happens after the course. Those three sit with IT.
An organisation that places it with IT gets a register and figures, but no explanation per role and nobody who knows whether the explanation fitted the people who received it. And an organisation that places it with the DPO gets good advice and loses the check.
The evidence an auditor asks for comes in three kinds that run exactly along these lines: the explanation and who received it, the agreements and decisions per role and per tool, and behaviour at the moment of work in aggregated figures. Why all three are needed is in how do you demonstrate AI literacy. For this piece the lesson is simpler: if the evidence comes in three parts held by three departments, someone has to be tasked with putting them together.
What does that look like at the municipality?
The board decides three things. HR remains owner of the explanation, but splits the AI module into a basis for everyone and a supplement for the teams that use systems to decide about residents or employees. IT remains owner of the register and takes on making the decision per tool visible at the moment someone opens a tool. The DPO gets no ownership, but a fixed place: each quarter she checks whether the explanation, the register and the figures still fit together, and records that check.
At the first check it turns out the register lists Copilot as allowed, and an inventory shows Perplexity, ChatGPT and three specialised tools in use alongside it, two of which appear nowhere in the register. HR had not covered those tools in the explanation, because they were not on the list. That is not an incident. It shows that without the quarterly check the three parts drift apart, and that a register containing only what was requested quickly falls behind what is happening.
