Open source LMS for EU AI Act AI literacy

Open source LMS for EU AI Act AI literacy: what Article 4 asks of your training

If you provide or deploy AI systems in the EU, or serve EU users, Article 4 of the AI Act already applies to you. It has applied since 2 February 2025 and covers all AI systems, not only high-risk ones. A role-based course catalog and internal training records on a self-hosted LMS can support the duty, but the law sets no mandatory training format and no certificate. The question for your team is not which course to buy but whether you can show, for each group of people operating AI for you, that you took appropriate measures and can prove it. The Commission's AI literacy questions and answers state that organizations may keep internal records of training and other AI literacy initiatives, and that relying only on instructions for use is often not enough. Vendor documentation alone will not satisfy a supervisor.

The 2026 amendment changed the wording of Article 4(1). As replaced by Regulation (EU) 2026/1744, it requires measures to support AI literacy of staff and others operating AI on your behalf, and it states that it does not require guaranteeing any specific level of competence for any individual. The earlier text required a sufficient level to the best extent, so the obligation is now about measures and their evidence rather than individual outcomes. Since 2 August 2026, national market surveillance authorities, not the AI Office, supervise and enforce Article 4. Those authorities are your likely audience, so plan your records for them: who was in scope, which role-based course each person took, the date, and the version of the material.

Start with a role inventory before you build content. Separate staff who build or configure AI, staff who use it in customer-facing or decision-making work, and contractors who operate it for you. Map each role to a short course set on Moodle or Open edX, and keep the mapping in your own records. Confirm with your counsel which Article 26(2) duties apply, because deployers of high-risk systems must also assign human oversight to people with the necessary competence, training and authority. High-risk obligations in Chapter III now apply from 2 December 2027 for Annex III systems, so you have a planning window, but Article 4 is already in force. Ask your LMS partner how completion reports, course versions and reassignment after a role change will be kept, since those records carry most of the evidential weight.

How each Article 4 requirement maps to LMS configuration

This table maps each AI literacy duty to what the LMS must do, the configuration that supports it, and the record an assessor may ask for. Read it as the implementer's interpretation of the Act and the Commission's Q&A, and confirm each row with counsel before relying on it. The main takeaway is that Article 4 has no mandated course format, so the defensible position rests on role-based assignment and provable records.

Requirement	What the function must do	Moodle configuration notes	Evidence to keep
Article 4(1): measures for staff and others operating AI	Take measures so that people who provide, deploy or operate AI on your behalf have a level of AI literacy suited to their role, without guaranteeing a specific level for any individual	Create one course per audience group, such as a developer track and a customer service track, enrolled through cohorts linked to HR job codes or department attributes	Written audience definitions and the course list for each group, dated and version controlled
Audience segmentation by AI system and job role	Identify which staff operate, supervise or are affected by each AI system in use, and which literacy content applies to each group	Use cohorts or groups keyed to the AI system inventory, with a cohort per system and role combination; avoid enrolling whole sites by default	Mapping of AI systems to roles and the cohort membership export at each review date
Role-based enrollment	Assign courses automatically when someone joins a role and remove or reassign when the role changes	Use cohort sync from the identity provider or HR feed, or enrollment plugins driven by user profile fields; confirm the chosen method with the implementation partner	Enrollment logs showing who was assigned, when, and by which rule
Completion tracking and conditions	Show that each in-scope person completed the course, with a date and the content version they saw	Set activity completion and course completion conditions, such as passing a knowledge check and acknowledging the policy; keep the quiz attempts and completion timestamps	Completion report with completion date, quiz score and course version per learner
Commission Q&A: internal records	Keep internal records of training and other AI literacy initiatives, which the Commission says organizations may do	Use course completion reports and the logstore; export to a records store before any backup retention window closes; confirm retention settings with the administrator	Training register covering initiatives such as workshops, briefings and course runs, not only LMS courses
Commission Q&A: instructions for use are often not enough	Do not rely only on vendor instructions for use; provide training that explains the system's limits, risks and oversight in the organization's context	Build scenario-based activities and knowledge checks on the organization's own AI use cases; link to the internal AI policy as a course resource	Course design documents, the scenario list and the quiz bank with version history
Article 26(2): competence of human oversight staff (high-risk deployers)	Assign human oversight of high-risk systems only to people with the necessary competence, training and authority	Create a separate oversight course and restrict enrollment to named oversight roles; gate access to related resources with completion conditions and periodic reassessment	Named oversight roster, authority assignment reference and completion records tied to each named person
Refresher and periodic review	Keep literacy current when systems, roles or the Act's guidance change, and refresh training as the AI inventory evolves	Set course re-enrollment after a fixed period or on a version change; the period is a policy choice, so confirm it with your governance owner	Change log linking each course version to the AI system or regulatory update that triggered it

How course paths differ for providers, deployers and high-risk operators

Article 4 applies to providers of AI systems and general-purpose AI models placed on the EU market, so a company that builds an AI feature and sells or offers it in the EU needs a course path for the people who design, train, test, document and support that system. The Act does not prescribe a training format or hours. The practical question is which staff touch the system and what each needs to understand to make sound decisions about it. On a self-hosted Moodle site, the usual role groups are engineering and data science, product and design, quality and testing, and customer-facing support. Each group gets a course that covers the system's known limits, data sources, evaluation results and escalation paths, and the course is assigned by role in the LMS rather than by job title alone.

Role-based paths: Separate courses for model builders, product owners, testers and support staff, each tied to the systems they work on.
Technical depth: Content on training data limits, evaluation metrics, known failure modes and when to stop or roll back a release.
Records: Completion dates, course versions, assessment scores and the system or release each learner was trained on.
Version control: Course updates when the system changes materially, with the old and new versions kept in the LMS.
Review cycle: A documented review of the course content against the provider's own documentation and incident history.

Before building this path, confirm with counsel which of your systems count as AI systems under the Act and which roles your internal documentation already names as responsible for them.

Which open source LMS platforms fit an AI literacy program

Article 4 does not prescribe a training format, so the platform choice comes down to how role-based courses, completion records and identity integration will be run for years. The cards below compare the main options and the checks to make before committing.

Moodle 5.3 as the LTS route

Moodle 5.3 is the next long-term support release, with bug fixes until 4 October 2027 and security fixes until 1 October 2029. Moodle 5.1 has security support until 19 April 2027 and Moodle 5.2 until 4 October 2027, so a program that starts on an older point release needs a dated upgrade plan. Check the PHP and database versions in the release notes against your hosting, and confirm that your role-based course assignments survive the upgrade cycle.

Open edX and the single-release model

Open edX supports only the latest named release, so Verawood is the current target and Willow and Xylon are planned for December 2026 and June 2027. Each upgrade lands on a fixed cadence rather than an LTS window, which suits teams with in-house platform engineering. Confirm that your upgrade capacity can absorb a release every few months before choosing this route for an AI literacy program that must run for several years.

Aspects analytics for completion evidence

Open edX Aspects captures tracking logs as xAPI statements through the event-routing-backends plugin, stores them in ClickHouse via Ralph or Vector, and presents them in Superset dashboards. This gives a stack for showing who completed which AI literacy module and when. Confirm the retention period for these logs, who can query them, and whether the stored records meet the internal record-keeping standard your compliance team expects.

Tutor as the production route

The edx-platform maintainers recommend running Open edX in production through a service provider or with Tutor, and note that bare-metal installation is complex and has limited community support. Tutor is Docker-based, supports Kubernetes and uses plugins under Apache 2.0. Ask a partner which Tutor version they will pin, how plugin updates are tested, and who carries the upgrade work when Verawood is succeeded.

Canvas LMS under AGPL-3.0

Canvas LMS by Instructure is licensed under AGPL-3.0, so self-hosting is possible under open-source terms. It is an option where the organization already uses Canvas-connected tools or teaching workflows. Confirm the integration path for your identity provider, the LTI tools you need for assessments, and the operational effort of hosting and upgrading it yourself before treating it as a peer to Moodle or Open edX.

Identity and role assignment

Article 4 expects staff and others operating AI on your behalf to be trained, and role-based courses only work if the LMS receives correct role data. Moodle core includes LDAP, LTI, OAuth 2, Shibboleth and web services authentication. Open edX supports OAuth2, SAML 2.0, Shibboleth and LTI for third-party authentication. Map which roles need which AI literacy course, then confirm how each platform gets those roles from your HR or directory source.

How the AI literacy program is rolled out on a self-hosted LMS

The rollout moves from knowing which AI systems and roles exist, to role-based courses, to a controlled pilot and a scheduled review. Each step produces an artifact that a market surveillance authority or auditor can later examine.

Inventory AI systems and the people who operate them
Your compliance lead, IT owner and business owners list every AI system the organization provides or uses, including vendor tools embedded in other software, and identify the staff, contractors and others who operate or rely on those systems. The client supplies access to the system register, procurement records and HR role data. The step closes when each system has a named owner and each role that touches it is written down, since Article 4 covers all AI systems, not only high-risk ones.
Define role-based learning paths
Working with your legal, risk and business leads, DeployOpen drafts a small set of paths, such as executive oversight, developers building AI features, staff using AI tools in daily work, and staff overseeing high-risk uses. Each path states its learning objectives, the systems it covers and the context the learner's work involves. The client approves the paths in writing. The output is a path map that links each role to its course set, which keeps the program tied to the organization's actual use of AI.
Build and review course content
DeployOpen builds the course modules in Moodle, Canvas or Open edX according to the approved paths, using the organization's own policies, approved tool lists and examples drawn from its workflows. The client's subject matter experts and legal reviewer check accuracy and sign off on each module. Assessments and any acknowledgment steps are set so that completion depends on the learner passing, not on opening a page. The step closes when every module has an approved version and a recorded reviewer.
Configure identity, enrollment and completion records
DeployOpen connects the LMS to your identity provider using the authentication methods your platform supports, then sets enrollment rules that assign each path from HR role or group data. Completion, score and date fields are configured so that reports show who completed which course, when, and against which version of the content. The client confirms the HR data source, the group naming and who holds administrator rights. The step closes when test accounts receive the correct paths and a sample report shows the expected records.
Pilot with a limited group
A small group from each role path completes the program before wider release. DeployOpen collects learner feedback on clarity and relevance, checks that enrollment and reporting behave as designed, and confirms that assessments measure what the module claims. The client's compliance lead reviews the pilot findings and decides on changes. The step closes with a written pilot report and a list of corrections completed, so the final content reflects what the pilot showed.
Roll out to the full population
DeployOpen and the client's HR and communications teams release the paths to all in-scope staff, with enrollment driven by the rules configured earlier. The client decides who must complete each path and by which internal date, since the Commission's Q&A notes there is no mandatory training format or certificate. DeployOpen monitors completion and escalates gaps to managers. The step closes when completion reports show every in-scope person assigned, with a documented reason for any exception.
Keep internal training records
The client keeps the training and related AI literacy initiatives as internal records, and DeployOpen configures export of completion reports, content versions and assessment results to a location the client controls. The Commission's Q&A states that organizations can keep such internal records. The client confirms its retention period with legal counsel, since it is not set by the AI Act's literacy provision. The step closes when a sample evidence pack can be produced on request for a named period.
Set the review cycle
The client's compliance owner and DeployOpen agree on triggers for content review, including new AI systems in the register, changes to the Act, changes to the organization's AI use, and LMS platform upgrades that affect courses. Platform upgrades follow the supported release cycle of the chosen LMS, so the review schedule must account for those dates. The step closes with a written review calendar, an owner for each path, and a changelog that records each update to the content and the register.

Which evidence auditors and regulators ask for and what produces it

This table maps each evidence item the Commission's AI literacy Q&A makes possible to the LMS component that produces it and what to confirm with the platform team. Read it as a checklist for the records you will need when a market surveillance authority asks how your AI literacy measures work in practice.

Evidence item	LMS component that produces it	What to confirm with the platform team
Role-to-course mapping	Cohorts or groups tied to job roles, with course assignments and the rule that enrolls each role	Which roles are mapped to which courses, who approved the mapping, and whether the mapping is exported with a date
Versioned course content	Course versioning, backups and a retained copy of each published course package	How each published version is frozen, where old versions are kept, and whether a past version can be restored for review
Enrollment and completion logs	Completion reports, activity completion records and enrollment timestamps	Whether completion dates are stored in the database and exported without editing, and how long logs are retained
Dated assessments	Quiz attempts with timestamps, scores and retained question banks	Whether attempt records and the question version used are kept together, and whether results can be exported by learner
Records of refreshers	Re-enrollment or scheduled reassignment rules and a history of each new attempt	Whether a refresher creates a new record instead of overwriting the earlier completion
Instructions for use reviewed as part of training	Course pages or resources that hold the reviewed instructions, with access and completion tracking	Whether the reviewed version of each instruction document is stored and linked to the course version it belongs to
Administrator and configuration change trail	Audit logs of admin actions, role changes and plugin changes	Whether logs are kept outside the application server and who can alter them
Program review record	Exported reports and a dated review document stored with the course versions reviewed	Who signs the review, how often it runs, and where the signed record is filed

What the LMS alone does not satisfy

An LMS can deliver courses, record completions and hold evidence, but it cannot make the decisions that Article 4 leaves to the organization. The cards below cover the work that stays with people: scoping roles, owning legal accuracy, judging competence, covering AI use outside the LMS and meeting the authority rules for high-risk oversight.

Deciding which roles are in scope

Article 4 covers staff and others operating AI on the organization's behalf, so the population is not limited to data science or IT teams. Someone must map who uses AI systems, who configures them, who reviews their output and which contractors act for you. The LMS can only assign courses to the groups you define, so the role inventory has to exist first and be reviewed when new AI tools are adopted. Confirm the list with HR, procurement and business owners, not only with IT.

Owning the legal accuracy of content

The LMS does not know whether a course correctly describes the AI Act, your sector rules or your own AI systems. Legal, compliance and product owners need to approve each module, record the version and date reviewed, and trigger updates when the regulation changes. The 2026 amendments already changed the high-risk timelines, so content that cites old dates is a visible error. Treat course text as a controlled document with a named owner.

Proving competence beyond completion

The Commission's Q&A says Article 4 does not require guaranteeing a specific level of competence for any individual, but a record that someone clicked through a module shows exposure, not understanding. Decide what evidence fits each role, such as a scenario assessment, a supervised task or a manager sign-off, and whether the assessment is scored or observed. The LMS can store these results, but the standard for passing has to come from your own policy.

Covering AI used outside the LMS

Staff learn to use AI tools in browsers, office suites, developer environments and vendor products that never touch the LMS. Training records cannot show what a person actually does with those tools unless you also maintain an inventory of AI systems and the permitted uses for each. Pair course assignments with that inventory and with access approvals, so that new tools trigger new training rather than relying on a yearly catalog update.

Meeting Article 26(2) authority requirements

Where a deployer uses a high-risk AI system, Article 26(2) requires human oversight by people with the necessary competence, training and authority. Training alone does not give a reviewer the power to stop or override a system, so the role must also be defined in process and access control. Record which named people hold oversight roles, the training they completed and the authority granted to them, and keep those records together. This applies to high-risk systems, which the 2026 amendments moved to December 2027 for Annex III systems.

Questions buyers ask before hiring help for AI literacy training

How much does AI literacy training cost and what drives it up?

The cost depends mostly on how many roles you define and how many AI systems each role touches, because each role needs its own course path and each system needs its own content. The Moodle, Open edX and Canvas code bases carry no license fee, so the spend is in the people and the hosting. Your cost components are setup and course design, content writing for each role, hosting and maintenance, and identity or HR integration. One-time work includes the AI inventory, course design and the first build. Recurring work includes hosting, upgrades, content refreshes when systems change, and support. Ask any partner for a quote that lists these items separately and states what each role and each AI system adds. No supplied figure gives a typical price, so treat any number you see without a written scope with caution.

Can our own team build the AI literacy courses without a partner?

Yes, if you have people who can write role-based content, run an LMS and keep records current. Many teams do this with internal legal, HR and engineering staff. The harder parts are usually the AI inventory, mapping each role to the systems it operates, and keeping evidence in a form a market surveillance authority could review. Article 4 does not prescribe a training format, so your team can choose the design. Decide early which parts you will own, such as course content and completion reports, and which you will outsource, such as platform setup, upgrades or hardening. DeployOpen works on fixed-scope engagements, so a partner can take a defined part of this work while your team keeps the rest.

What does our organization need to provide before the work starts?

The main inputs are an inventory of the AI systems you provide or use, a list of roles and the people in them, access to HR data for role assignment, and legal review of the content. The inventory matters most, because the duty applies to all AI systems, not only high-risk ones, so each system needs a named owner and a short description of how staff use it. Legal or compliance staff should confirm the wording of the course content and the retention period for records. Agree in advance who signs off on each item. Ask a partner to list these client inputs in the written scope, with the person responsible for each, so delays do not surface late in the project.

How long does the first AI literacy rollout take?

No supplied fact gives a standard duration, so the timeline should come from the written scope rather than a generic estimate. The main variables are the number of roles, the number of AI systems, whether an LMS already exists, the state of your HR and identity data, and how quickly legal review and sign-off happen. Most engagements are fixed-scope, which means the scope, deliverables and timeline are agreed in writing before work begins. Ask the partner to break the timeline into phases: inventory, role mapping, course build, pilot, rollout and reporting. Each phase should name its deliverable and the client decision it depends on.

Which authority supervises Article 4 AI literacy, and why is there no certificate?

National market surveillance authorities supervise and enforce Article 4 in their member state, not the Commission's AI Office. According to the Commission's AI literacy questions and answers, this applies as of 2 August 2026. The same guidance states that no certificate is required and that there is no mandatory training format. The reason is that Article 4 asks you to take measures that support AI literacy, not to reach a fixed credential. That makes records of what you did and who took part the core evidence. Confirm with counsel which authority covers your activity in each member state where you operate, because enforcement practice can differ between countries.

Does a self-hosted LMS help with training record retention?

A self-hosted LMS helps because you control where completion records, course versions and assignment history are stored, how long they are kept, and who can read them. The Commission's guidance says organizations can keep internal records of training and other AI literacy initiatives, and that relying only on instructions for use is often not enough. Your platform should keep dated completion records, the course version each person took, role assignments and the policy acknowledgments tied to them. Confirm with the platform vendor and your counsel that the platform exports these records in a usable format and that your backup and retention settings match your legal retention period. Platform support does not replace your own retention policy.

Does AI literacy training also cover high-risk human oversight duties?

Partly. Article 4 covers staff and others operating AI on your behalf for all AI systems. Article 26(2) separately requires deployers of high-risk AI systems to assign human oversight to people with the necessary competence, training and authority. The high-risk rules in Chapter III apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems, after the 2026 amendment. Many organizations build one course path for general literacy and a more detailed path for oversight roles, which you can plan now. Confirm with counsel which of your systems could be high-risk, because that decides whether Article 26 applies and how deep the oversight course must go.

What is the penalty exposure if training is missing?

Article 99 sets maximum fines of EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most operator obligations, whichever is higher. The Act does not list a separate fine for Article 4 in the supplied facts, so ask counsel how a national authority would treat a missing or weak training program within those limits. A documented, role-based program with dated records gives you a clearer position than an undocumented one, whatever the penalty tier. Confirm this reading with your legal team before you rely on it.

How DeployOpen scopes, builds and supports the AI literacy LMS

This sequence turns an AI literacy requirement into a written scope, a self-hosted Moodle or Open edX platform in your own infrastructure, role-based learning paths and training records, and an evidence pack your internal and external reviewers can read. DeployOpen plans and implements the system and prepares evidence, while your organization owns the policy, the content decisions and the final compliance position.

Map AI systems and roles in scope
DeployOpen starts with a discovery workshop where your compliance, legal, HR and AI owners list the AI systems you provide or deploy, the teams that operate or oversee them, and any contractors acting on your behalf. The output is a written role inventory that maps each group to a learning objective and to the AI systems it touches. The step is complete when your AI owner signs off the inventory as the basis for course design.
Agree a fixed-scope written statement of work
Based on the role inventory, DeployOpen drafts a statement of work covering the platform option (Moodle or Open edX), hosting location, integrations, course content to build or migrate, reporting outputs, and the evidence to be delivered. Your team reviews scope, deliverables and exclusions in writing before work begins. You receive a quote that follows from this written scope, and the agreement is complete when both parties sign it.
Design the platform in your infrastructure
DeployOpen plans the self-hosted deployment in your cloud account, data center or private network, selecting a Moodle release line or an Open edX release with the support window in mind, and documenting the database, PHP or Python runtime, web server, backup and identity settings. Your infrastructure team reviews the architecture and access model. The step closes with an approved architecture document and a deployment plan that names who operates each component.
Configure role-based paths and identity
DeployOpen configures user roles, cohorts and enrollment rules so each learner receives the course path tied to their role and AI system exposure. Single sign-on is connected to your corporate directory where your identity standards require it, and course completion, grade and attestation fields are set to produce the records you specified. The step is verified by test accounts for each role showing the correct enrollments and completion status.
Build content and records for each path
Your subject matter experts supply the AI literacy material for each role, and DeployOpen builds the courses, quizzes, acknowledgments and completion rules inside the LMS. Content is reviewed by your owners for accuracy against your own AI use, since the regulator does not prescribe a training format. The step ends when every path has been reviewed and signed off and a sample training record can be exported with the learner, course version, date and result.
Harden, test and prepare the evidence pack
DeployOpen applies the agreed hardening baseline, runs functional and access testing on the platform, and assembles an evidence pack that describes the system, the roles and paths, the record retention approach, and how completions are produced. The pack documents the internal records your organization can keep about its AI literacy initiatives. DeployOpen prepares this material for your compliance assessments but does not issue audit reports, attestations or certifications, which remain the work of independent auditors or the relevant authority.
Hand over, train administrators and go live
DeployOpen runs administrator training, delivers operating runbooks for backups, restores, upgrades and user administration, and launches the first cohorts under a supervised cutover plan. Your team confirms that records export correctly and that support contacts are set. Handover is complete when the agreed deliverables are accepted in writing and the runbooks are stored in your own document system.
Support upgrades and reviews through a retainer
After go-live, many organizations keep DeployOpen on an optional retainer for platform upgrades, security patches, course updates when AI use changes, and periodic evidence refreshes. Moodle and Open edX move through versioned release lines with defined support windows, so your retainer scope should name the release line you run and who approves each upgrade. The arrangement is confirmed when the retainer scope, response expectations and review cadence are agreed in writing.

Open source LMS for EU AI Act AI literacy