AI officer: required by the AI Act or not? Roles for an own AI in a company of 20 to 500

Does the AI Act require an AI officer?

No. The EU AI Act does not name an AI officer, and the European Commission's question-and-answer page on AI literacy says that "no specific governance structure is mandated" to comply with Article 4; the law asks for duties instead, mainly AI literacy measures for staff and, for some uses, transparency towards the people the AI talks to. A company that runs its own AI assistant still needs someone answerable for it, or nobody decides which documents it may read, who may use it and what happens when it gives a wrong answer.

This guide is for the owner or managing director of a company of 20 to 500 people who plans an internal assistant on an own server, and for the office, quality or IT lead who will end up looking after it. It separates what EU law requires from what is simply good practice, and sets out a small set of roles with their monthly tasks. It is general information on EU law as of October 2026; your legal counsel and your data protection officer confirm how it applies to you.

What the AI Act asks of a small company running its own AI

A company that uses an AI system "under its authority" is a deployer under Article 3(4) of the AI Act. A company that puts together its own assistant and uses it in-house can also be its provider, because the definition of putting into service covers first use for the provider's own purpose; our EU AI Act guide for companies running LLMs explains both roles. For an assistant that drafts, summarises and answers questions on company documents, the duties are few.

Regulation (EU) 2024/1689, Articles 3, 4, 5, 26, 50 and 113 as consolidated at 27 July 2026, AI Act Service Desk of the European Commission; Regulation (EU) 2026/1744 on eur-lex.europa.eu; read 25 October 2026.

Article 4. Since the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026, providers and deployers "shall take measures to support the development of AI literacy" of their staff and of others who operate or use AI systems on their behalf, taking into account their knowledge, experience and the context of use. The amended text adds that the obligation does not require any specific level of AI literacy in any individual, and that the Commission and the Member States support these efforts, in particular for SMEs. The Commission's Q&A lists four minimum steps: a general understanding of AI in the organisation, a view of the company's role as provider or deployer, a view of the risks of the systems it provides or deploys, and literacy actions built on that analysis that take account of the staff's technical knowledge, experience, education and training. It says there is "no need for a certificate" and that organisations "can keep an internal record of trainings and/or other guiding initiatives". The national market surveillance authorities supervise and enforce the rules from 2 August 2026. Our guide to AI literacy training under Article 4 gives training content by role.

Article 50. Providers design systems that interact directly with people so that those people are informed that they are interacting with an AI system, unless that is obvious, and the information reaches them "at the latest at the time of the first interaction or exposure". For an internal assistant, naming it as AI in its interface covers the practical side.

Article 26. Oversight by "natural persons who have the necessary competence, training and authority" is a duty of deployers of high-risk systems. An assistant becomes high-risk through its purpose: Annex III lists, among others, the filtering of job applications and the monitoring and evaluation of staff performance. Under the amended Article 113 those uses fall under the high-risk rules from 2 December 2027. A small company that keeps its assistant to drafting and search needs no high-risk oversight function. It does need someone who notices when a department wants to use the assistant for such a purpose.

For an owner the summary is short. The law asks for literacy measures, a record of them and transparency, and it does not ask for a job title. The roles below make those duties work in practice.

The data protection officer is a different role

Owners often mix up the AI question with the data protection officer (DPO), who is a role under the GDPR. Article 37(1) requires a DPO where processing is carried out by a public authority, where the core activities consist of "regular and systematic monitoring of data subjects on a large scale", or where they consist of large-scale processing of special categories of data. Article 37(4) adds that a company may designate one voluntarily and must where Union or Member State law requires it, so national law can widen the cases; your legal counsel confirms which apply. The DPO can be a staff member or work under a service contract (Article 37(6)).

Two rules matter for an AI project. The DPO "does not receive any instructions regarding the exercise of those tasks" (Article 38(3)), and may hold other tasks only if they "do not result in a conflict of interests" (Article 38(6)). A DPO who also decides what the assistant may read and how long logs are kept would be advising on decisions they made themselves. In a small firm the DPO is therefore a good adviser to the AI project and a poor choice as its owner. Their part is the data protection impact assessment, retention periods and staff data questions, as in our guide to a DPIA for an internal LLM.

Five AI governance roles for a firm of 20 to 500

Each role is a set of tasks that existing staff take on; no new posts are needed. In a company of 30 people, two persons can hold all five; in a company of 400, each has a name and a deputy.

Our summary. The AI Act requires none of these titles; the tasks follow from Articles 4 and 50 of Regulation (EU) 2024/1689, the GDPR roles from Articles 37 to 39 of Regulation (EU) 2016/679.

System owner. This person is answerable for the assistant as a whole. They sign off the purpose in plain words ("drafting, summaries and questions on our manuals and procedures"), decide which departments get access and in which order, and name the uses the company excludes, such as rating individual performance. They approve changes that touch those decisions, for example a connector to the HR system. Where employee representatives exist, the system owner prepares the conversation with them, as our article on the works council and an internal AI assistant describes.

Content owners. The assistant answers from documents, and documents have owners. The head of quality decides which procedures it may use, the head of sales decides on price lists and offers, HR decides that personnel files stay out. Each content owner also checks that outdated versions are removed, because the assistant cites what it finds. Our guide to preparing company documents for an AI assistant covers that work.

IT contact. Someone keeps the server, the operating system, the model software and the chat front end up to date, manages accounts and keeps a short record of the settings: who has administrator rights, what is logged and for how long. In a firm without IT staff this is an external partner with a written scope, as in our guide to an AI server without an IT department.

Data protection. The DPO, or an external adviser where no DPO is required, advises on the impact assessment, the retention of chats and logs and any question about employee data.

User champions. One experienced user per department answers first questions, collects examples of wrong answers and runs the short session new users take before access. That session, with a list of who attended, is the internal record the Commission's Q&A refers to.

Our Private AI/ML service trains the people who will run the platform; describe who in your company would hold these roles, and our team replies with what the training and the platform would cover.

What each role does each month

A fixed monthly round keeps the duties small. Put it in the calendar of each role holder.

1. System owner: read the list of reported wrong answers and the changes requested, decide on new departments or connectors, and check that the excluded uses are still excluded.
2. Content owners: remove superseded documents from the collections the assistant reads, add new ones, and confirm that access rights still match the department.
3. IT contact: apply updates and security fixes to the front end and model server, check backups and disk space, compare the user list with the training record, and note any setting changed. Our Open WebUI hardening guide suggests a monthly check of the project's security advisories.
4. Data protection: check that chats and logs are deleted on schedule and review the impact assessment if the purpose, the data or the users changed.
5. User champions: pass on recurring questions, run the session for new users and add them to the record.

Once a year the system owner reviews the AI system list, the training content and the role holders, and records the result. A company that uses the assistant for one or two departments can do this in one meeting.

How the roles combine at 20, 100 and 500 staff

Our example allocation; company sizes are examples.

The pattern that fails is a single enthusiast in IT who owns everything. When that person is away, nobody decides, and the documents the assistant reads drift out of date. Split the decisions (system owner, content owners) from the operation (IT contact), and the role set survives holidays and staff changes. Larger organisations that want a certified management system will find the ISO/IEC 42001 route in our guide to AI governance for a private LLM platform.

Our Private AI/ML service builds the platform with a query log and permissions management and trains your team to run it; send us your company size and the departments that would use it, and we reply with a proposed split of tasks and a configuration.

The server the IT contact looks after

The IT contact's job depends on the hardware. An own server keeps prompts, documents and logs in your network or in an EU data centre you choose, and it is one machine to update, back up and watch. The table shows the two configurations a company of this size usually starts with.

Reference configurations on our AI servers page; staff by the example values of our company-size guide (about 4 requests in flight at the busy hour per 100 employees, gpt-oss-120b); power by our estimate with the cards at 600 W, two AMD EPYC processors and 15 per cent for the rest of the server; a 230 V 16 A feed carries 2.94 kW at 80 per cent.

For a firm of 20 to 500 people, the entry server is enough: two NVIDIA RTX PRO 6000 Blackwell Server Edition cards, two AMD EPYC processors, 384 GB of DDR5 ECC memory and two NVMe drives. One card runs the language model of the assistant; the other runs document search and speech-to-text. The staff figure comes from our sizing by company size, which counts the people who send a request at the same moment in the busiest hour. The server needs a server room, because it is loud and turns its full power into heat; our article on AI server electricity per year turns that power into annual kWh for the budget.

What to write down

The records that make the duties visible are short and belong to named roles.

• AI system list (system owner): each AI tool in use, built or bought, with purpose, users and data it reaches.
• Training record (champions and IT contact): who completed the session, which version, when; compared with the user list.
• Settings record (IT contact): administrator rights, log levels, retention, connectors, with the date of each change.
• Document collections (content owners): which folders the assistant reads, for which users.
• Wrong-answer reports (champions): what was asked, what came back, what was fixed.
• Impact assessment (data protection): where one is needed, with its review date.

What we supply

You can buy this system from us: our team sizes the configuration to your workload and budget and replies within one business day. We build AI servers with two or four RTX PRO 6000 Server Edition cards to order, assembled and tested before delivery, delivered across the EU on one EU contract and invoice, with manufacturer warranty on every component handled through us; quantities and lead time are confirmed in writing with the quote. Our Private AI/ML service, with our engineering partner Vixen.UNO, deploys the assistant with a query log and data and permissions management and trains your team to run the platform.

General information on EU law as of October 2026, not legal advice; national law can add requirements, for example on the data protection officer.

FAQ