NIS-2 and the EU AI Act: What L&D Has to Deliver by 2027

Two sets of rules are landing on L&D desks at the same time. NIS-2 has been in force in Germany since 6 December 2025. And Article 4 of the EU AI Act, the AI literacy duty, has applied since February 2025. Both have to do with training, and both raise questions L&D cannot answer alone.

A boundary first, because it matters to us: who exactly is obliged and who is liable for what depends on the individual organisation. That is a question for your legal department, not for a blog post. What can be said regardless is what these rules mean in practice for L&D's work.

The symptom: training that is too slow

In many organisations the starting point looks like this: an annual information security briefing, created a few years ago and lightly updated since. A policy on AI, perhaps a webinar. And somewhere a list of who completed what and when.

The problem is less the content than the pace. Rules, threat landscapes and AI tools change faster than the production cycle of classic training. A study by Masterplan and Amadeus Fire shows the gap clearly: 55% of companies in the DACH region see AI as a top topic, but only 35% offer training on it (2025).

Three causes

The first cause is production. If a change to a training takes weeks, it gets postponed until the next big revision.

The second is the target group. One briefing for everyone is easy to administer, but it fits nobody properly. Someone handling customer data every day needs different examples from production staff, and someone using AI tools for text needs different rules from someone building models into processes.

The third is proof. Many organisations can say that a training exists. Fewer can say who completed which version and when. That is exactly the question asked when something goes wrong.

The instrument: a three-column inventory

Before producing new training, a simple inventory is worth doing. It needs no software; a spreadsheet will do.

• Topic: Which content on information security and AI use exists today, and how recent is the current version?
• Target group: Who is each training for, and are there groups for whom nothing exists?
• Proof: Can you show for each person which version they completed and when?

The table is filled in an afternoon. What it shows is usually uncomfortable but concrete: outdated versions, groups without training, gaps in proof. Take that list into the conversation with your legal department and your information security officer, who then decide what is mandatory.

What L&D should be able to do by 2027

Three capabilities follow from the inventory. Training must be changeable in days rather than weeks, so a new requirement does not wait for the next annual cycle. It must be producible in variants for different target groups and languages without each variant becoming a project. And every completion must land in the LMS with version and date, which usually works via SCORM, as described in SCORM explained.

With AI-assisted production, effort per training hour typically drops by up to 80%, and voice-over and subtitles are available in more than 140 languages.

One open question remains, and we do not want to define it away: what exactly “sufficient AI literacy” under Article 4 means has not yet been conclusively settled. Whoever trains today trains towards a target that will still sharpen. All the more reason to be able to update content quickly.