How long is an AI certificate valid and when is refresher training due?

The AI Act names no validity period and no refresher interval. An AI certificate therefore does not expire on a date; it loses its force as soon as the use of AI in the company has changed. Refresher training is triggered by events rather than by the calendar, and in practice that comes down to an annual review.

This answer surprises many companies, because they know mandatory training from occupational safety and data protection, where intervals are the norm. Article 4 applies a different yardstick. Anyone who ran a training on ChatGPT in January 2026 and has had a copilot in the mail inbox since July that reaches company data holds a valid certificate and an outdated record.

This article sets out what determines the timing when there is no statutory interval, which events trigger refresher training, and how to build a rhythm from that which stands up to scrutiny.

What determines the timing when there is no statutory interval?

Change inside your own company. Article 4 requires measures to promote AI literacy for the persons who deal with the operation and use of AI systems. That wording is tied to the current state. If the current state changes, the training need changes, regardless of how old the last certificate is.

The Digital Omnibus turned this into an obligation to take measures and to evidence them. Article 4 carries no fine of its own. In practice this means the interval question is asked differently from what companies expect. What is asked is not when the last training took place, but whether the training matches the systems running today.

That also makes clear why a provider printing a two-year validity on the paper is making no legal statement with it. That is a product decision by the provider, not an expiry date from the regulation.

Which events trigger refresher training?

Four events come up regularly in practice, and any one of them is enough.

A new AI tool goes live, or an existing one gains a materially new function. The case from summer 2026 is typical, when the AI uplift entered the Microsoft 365 plans and Copilot Chat thereby landed in companies that had not ordered it. Anyone who trained before the tool arrived has a gap.

A person moves into a role with different AI exposure. Someone moving from accounting into customer service suddenly works with outputs that go outside, which brings Article 50 and its labelling duty into play.

The legal position shifts. The Digital Omnibus worked on Article 4 in 2026, and the deployer duties under Article 50 have applied since 2 August 2026 without a transition period. Anyone presenting a training from 2025 covers the 2025 position.

An incident in the company. A customer email with invented figures, a quote with a hallucinated reference, company data in a private chat window. That is the trigger which shows most clearly that the previous content did not land.

How do I build a rhythm from this that stands up to scrutiny?

Through a fixed annual date on which three things are reviewed. Which AI systems have been added since the last date, which people have changed roles, and which incidents were reported. Whatever has moved determines who gets refresher training. Where nothing has moved, that is documented and thereby becomes part of the record itself.

This date can be attached to an existing one. In most companies it sits sensibly where the mandatory safety briefings already run, because the role lists are then already current.

A robust record consists of the assignment of which roles work with AI, the training delivered with a content overview and per-person proof of participation, and a date for the review. That last part is precisely where the validity question gets answered. Anyone who can name a review date has an answer on currency even without a statutory interval. How the record is built as a whole is set out in How do I document AI training for the regulator?.

How does this relate to the term of a learning platform?

With the AI module of the PASSION4IT Academy, access runs twelve months from the activation date and is billed annually per booked user. Every completed training yields a certificate, and the progress view records who completed which unit and when.

This twelve-month term is not a validity period for the certificate. It is the commercial frame, and it helps in practice because it forces the annual review by itself. Whoever renews decides in the same movement whether the assignment still holds and which units get reassigned. That is why an annual model fits this obligation better than a one-off course with a certificate.

A certificate sitting only in the personal files of the trained individual is of no help to the company at the next enquiry. The record has to be kept by the company, and for that a platform with a progress view is the simpler solution than a collection of PDF files.

Conclusion

There is no expiry date, there is a trigger. A new tool, a role change, a change in the law or an incident sets off the refresher, and one fixed annual date catches all four. Anyone who can name that date has the sturdier answer to the validity question than anyone reading a date off a certificate.

To find out where your own company stands, check one thing. Does the training documentation contain a date for the next review? If not, that is the smaller of two gaps, because the larger one is the missing assignment.