No. Neither the EU AI Act, Regulation (EU) 2024/1689, nor Germany's implementing act, the KI-MIG, requires an AI officer. Germany's Federal Network Agency (Bundesnetzagentur) explicitly lists appointing an AI officer among the things not required for the AI literacy obligation in Article 4, and the European Commission answers the question whether an "AI officer" is needed as for the GDPR with "No, no specific governance structure is mandated". What the law requires is a task, not a position: measures that support the AI literacy of the people working with AI in your business. For a small business it still makes sense for exactly one person to keep an eye on that task.
I am a developer, not a lawyer, and this is not legal advice, just the operator's perspective. I read the texts I rely on at the source on 18 October 2026: the AI Act and the amending regulation on EUR-Lex, the KI-MIG on gesetze-im-internet.de, the Commission's FAQ and the Bundesnetzagentur's guidance page. More on AI in day-to-day business is collected on the Artificial Intelligence page.
What the law says, and what it doesn't
The AI Act assigns obligations to roles such as provider, deployer, importer and distributor, not to a function inside a company. There is no "AI officer" position with a duty to appoint and defined tasks, of the kind the GDPR sets out for the data protection officer in Articles 37 to 39. Three provisions come closest to the idea, and none of them is an AI officer:
The second and third rows concern high-risk AI, such as Annex III systems for selecting job applicants. Under Article 113 as amended by Regulation (EU) 2026/1744, those obligations apply to Annex III systems only from 2 December 2027, and to high-risk products under Annex I from 2 August 2028. A business using Claude or ChatGPT for texts, research and emails lands in the first row. What Article 4 requires there, and what it doesn't, is in AI Literacy Under the AI Act: Training Staff.
Germany's KI-MIG of 22 July 2026 also regulates authorities, responsibilities, regulatory sandboxes and fines. I found no obligation for companies to appoint an AI officer in it.
Why the term still shows up everywhere
Type "ki beauftragter" (German for AI officer) into Google and the suggestions include "pflicht" (obligation), "schulung" (training), "zertifikat", "tüv", "dekra" and "ihk" (retrieved 18 October 2026). That shows what people look for: courses that qualify a person for the task. Such courses can make sense if someone takes on the job. They don't create a legal function, and a certificate is not required for Article 4: the Bundesnetzagentur lists external certification explicitly as not required, and the Commission says "There is no need for a certificate".
AI officer versus data protection officer
The data protection officer is real, with clear thresholds:
- Article 37(1) GDPR requires one, among other cases, where the core activities consist of regular and systematic monitoring of people on a large scale, or of large-scale processing of special categories of data.
- Section 38(1) of Germany's Federal Data Protection Act (BDSG) adds a German rule: a DPO is required where as a rule at least 20 people are constantly involved in the automated processing of personal data, and regardless of that number in certain cases, among them where processing is subject to a data protection impact assessment under Article 35 GDPR.
For an AI officer there is no such legal basis. There is one connection worth knowing, though: if you use AI in a way that requires a data protection impact assessment, German law requires a DPO even with fewer than 20 people (section 38(1) sentence 2 BDSG). Whether that applies to your use depends on the case; I cover the privacy side in Claude Privacy and GDPR: What Applies.
Can one person do both? The Commission answered exactly that question ("Can a DPO and AI officer be the same person?") by stating that no specific structure is mandated. The GDPR sets a limit, though: under Article 38(6) a DPO may fulfil other tasks, but the business must ensure that they "do not result in a conflict of interests". Someone who selects and approves AI tools can hardly monitor their data protection independently. So clarify the boundary before you hand AI tasks to your DPO. If you don't need a DPO, you don't need to appoint anyone for AI.
If you have a works council
For German businesses with a works council, the Works Constitution Act (BetrVG) has its own rules that mention AI explicitly. Under section 90(1) no. 3, the employer informs the works council about planned work processes and workflows "including the use of artificial intelligence". Under section 80(3), bringing in an expert counts as necessary when the works council has to assess the introduction or use of AI. Under section 87(1) no. 6 it has a right of co-determination over technical systems designed to monitor employees' behaviour or performance, and under section 95(2a) its rights on selection guidelines also apply where AI is used to draw them up. None of this creates a duty to appoint an AI officer, but it does create a duty to inform and consult the works council in good time and, for tools covered by section 87(1) no. 6, to obtain its agreement before the tool is introduced. Whether a tool is covered is a question for professional advice.
What small businesses should sensibly do
What follows are recommendations, not obligations.
- Name one person who owns the task. Not as a title, but as a responsibility: they keep the list of who uses which AI tool for what, organise the briefing and note what was done. In a business of five that is usually the owner; in a business of twenty, perhaps whoever already looks after the software. The Bundesnetzagentur recommends setting goals and responsibilities as part of the measures.
- Write the rules down. Which data may go into which tool, who approves results before they go to clients, and whom to contact when a tool produces nonsense. One page is enough.
- Meet the literacy obligation without creating a position. A briefing per tool, one log line per session. I describe that step by step in AI Literacy Under the AI Act: Training Staff.
- Look closer at high-risk AI, prohibited practices and transparency duties. If you plan to use a system for applicant selection, performance evaluation or similar Annex III uses, you will have considerably more obligations from December 2027, including human oversight under Article 26(2). Since 2 February 2025 it has already been prohibited, among other things, to use AI to infer emotions of people in the workplace, except for medical or safety reasons (Article 5(1)(f)). And since 2 August 2026 the transparency obligations of Article 50 apply, for example disclosure when you use AI to generate or manipulate a deepfake. In these cases professional advice pays off.
In my own business fourteen AI employees work, and responsibility for their rules sits with me: whatever leaves the house, I approve, and a separate role checks it first. That is my working rule, not a legal requirement. How to bring a team along with such a change is in AI Colleague or Competitor? Bring Your Team.
An AI officer is not the same as an AI lead role
This site has an article with a similar-sounding name: Does Your Business Need an AI Lead Role? It is about something else. The AI lead role there is an AI agent that keeps the overview of other AI agents, a role inside an AI workforce. An AI officer, by contrast, would be a human in the business who is responsible for how the business uses AI. One question is technical and organisational, the other legal, and the answers don't depend on each other. What such an AI role may decide on its own and what stays with the human is covered in What Can an AI Lead Role Decide?
Frequently asked questions
Is an AI officer mandatory above a certain number of employees?
No. Unlike the German DPO rule in section 38 BDSG, there is no threshold for an AI officer because there is no duty to appoint one. The literacy obligation in Article 4, on the other hand, applies regardless of size; the Bundesnetzagentur says it applies regardless of sector and size of the organisation.
Do I need a qualification or certificate as an AI officer?
Not by law. A course can help whoever takes on the task. For Article 4, external certification is not required according to the Bundesnetzagentur.
Can my data protection officer also be the AI officer?
In principle yes, the AI Act prescribes no structure. Under Article 38(6) GDPR, however, additional tasks must not result in a conflict of interests: someone who selects and approves AI tools can hardly monitor their data protection themselves. Clarify the boundary before you hand over the task.
Are there fines for not having an AI officer?
Not for lacking an AI officer, because there is no such obligation. For Article 4 itself I found no dedicated fine either in Article 99 of the AI Act or in section 15 of the German KI-MIG (as of 18 October 2026); supervision by the authority applies regardless.
Who is responsible in a one-person business?
You are. Article 4 speaks of your staff and of persons working with AI on your behalf, such as freelancers. If you work alone, there is no position to fill, but you should still know the risks of your own tools.
Where to go from here
Instead of handing out a title, write the list today: who, which tool, what for, what can go wrong. What comes next is in AI Literacy Under the AI Act: Training Staff. If you are just introducing AI in your business, Bringing AI to a Small Business helps with the order of steps.
How I give my AI employees responsibilities, rules and approvals is something I show in my community Claude Practitioners. Membership does not fulfil any legal obligation.
