Fake certificates in the AI boom: Is the EU AI Act a trap? The dangerous boom in worthless AI training courses

Xpert Pre-Release

Language selection 📢

Published on: March 26, 2026 / Updated on: March 26, 2026 – Author: Konrad Wolfenstein

Fake certificates in the AI boom: Is the EU AI Act a trap? The dangerous boom in worthless AI training courses – Image: Xpert.Digital

The billion-dollar scam: Why many AI certificates aren't worth the paper they're written on

Warning to employers: One in four AI-generated job applications could soon be fake

Fake certificates & grant fraud: The dark side of the AI boom

The global boom in artificial intelligence has not only created a gigantic market for new technologies, but also a lucrative shadow market: the trade in worthless or even forged AI certificates. Driven by the massive shortage of skilled workers and new regulatory requirements such as the EU AI Act, companies are currently investing millions in the further training of their workforce. But the reality is alarming: often, impressive-sounding diplomas conceal nothing more than superficial crash courses, blatant subsidy fraud, or even AI-generated deepfake applications that can penetrate deep into the sensitive IT infrastructure of corporations. The seemingly secure proof of competence is thus turning into a ticking time bomb. Why the proliferation of fraudulent training programs poses a tangible economic and security risk – and how companies can effectively protect themselves from this deception of competence – is explained in the following analysis.

Related to this:

The EU AI Act and the blind spot for SMEs: Why AI in standard software could result in millions in fines for you

The document lies – and nobody checks it

The global hype surrounding artificial intelligence has created a market that is growing so rapidly that oversight and quality assurance can barely keep pace. In few other areas is the gap between what certificates promise and what they actually prove as wide as in AI training. Companies invest millions of euros in training programs, hire employees with impressive-sounding credentials, and believe they are thus in regulatory and professional compliance with the EU AI Act. What many overlook is that a significant portion of these certificates are empty in content, legally meaningless, or in some cases simply forged. The resulting false sense of security is not just a reputational problem, but a very real economic risk.

A bottomless boom: The exploding market for AI qualifications

The pressure to demonstrate AI expertise is real and growing rapidly. In Germany, according to analyses by the job portal Indeed, the proportion of job postings requiring AI skills more than doubled within a single year in several commercial sectors. Human resources saw a 138.7 percent increase in AI-related job postings, while project management saw a 117.1 percent rise. Even against the general decline in the German labor market, job postings for AI experts increased by around 30 percent. This demonstrates not a cyclical fluctuation, but a structural shift in the world of work.

This shift has led to explosive growth in the alternative education market. The global market for alternative qualifications, including AI certificates and micro-credentials, was estimated at around US$18.83 billion in 2025 and is projected to reach almost US$70 billion by 2034, with an annual growth rate of 18.6 percent. On the supply side, the supply chain has followed this trend with a dynamic that overwhelms any quality control. An analysis of the German AI training market alone identified 51 providers with prices ranging from €299 to almost €25,000 per participant, with demand increasing by 340 percent since 2023. This quantitative explosion has resulted in a qualitative erosion.

The regulatory foundation fueling this boom is Article 4 of the EU AI Act, which has been in force since February 2, 2025. It obliges companies to ensure their staff possesses a sufficient level of AI competence. Crucially, however, this paragraph lacks a concrete definition of what constitutes "sufficient," which forms of evidence are acceptable, and which institutions are authorized to issue certifications. The result is a legal obligation without standards, which has driven the market into a free-for-all where every provider can market their own seal of approval as compliant.

Paper tigers in the job market: When certificates don't prove competence

The gap between claimed qualifications and actual ability is alarmingly large. According to a 2025 survey of 874 HR professionals, 72 percent of recruiters reported encountering AI-generated or otherwise manipulated application documents during the hiring process. Of these, 51 percent of the forged submissions contained AI-generated portfolios, 42 percent fabricated references, and 39 percent forged diplomas or certificates. The phenomenon of falsely claiming competence is not new, but generative AI has taken it to a qualitatively different level: These are no longer poorly copied documents, but deceptively realistic, individually tailored forgeries that even trained eyes cannot detect.

Based on a survey of 3,290 job seekers, the analytics firm Gartner predicts that by 2028, one in four candidate profiles worldwide will be fake. Already, six percent of the surveyed candidates openly admitted to actively committing interview fraud, either by impersonating someone else or having someone else speak for them. The economic consequences for companies are far more serious than a poor hiring decision. Jamie Kohn, Senior Research Director at Gartner, succinctly summarized it: Candidate fraud creates cybersecurity risks that can be far more serious than a simple mishire. The threat isn't confined to the HR department; it extends deep into the company's infrastructure.

A particularly striking example of the existential dimension of the problem is the case of North Korean IT workers who, using stolen identities, forged certificates, and AI-generated application materials, infiltrated more than 300 American companies. The US Department of Justice revealed that these included Fortune 500 corporations in the media, technology, aerospace, and automotive sectors. In one documented operation alone, the fraud generated at least $6.8 million, which was then transferred to North Korea. Google Cloud CISO Iain Mulholland stated at a press conference that nearly every Fortune 500 CISO he had spoken with admitted to having hired at least one North Korean IT worker. This is not an abstract threat in the future, but an already active, systemic danger.

The funding scam: When government funds flow into empty courses

The problem of counterfeit or worthless AI certificates has a second, more institutional dimension that is equally worrying: the state-subsidized fraud within the continuing education market itself. In February 2026, the Frankfurter Allgemeine Zeitung published an investigative report that sent shockwaves through the continuing education sector. Titled "The Great AI Continuing Education Scam," the paper documented how providers claim government funding, sell superficial courses, and in some cases simply disappear as soon as prosecutors investigate suspected subsidy fraud. The term "Corona Testing Centers 2.0" is already circulating in the industry, a grim metaphor that encapsulates the scale of the problem.

The structural weaknesses are evident: Certification bodies often lack the qualified personnel to truly assess complex AI training content. The funding structure rewards form over content because formal criteria are easier to measure than actual learning gains. Numerous courses merely demonstrate how to use specific tools like ChatGPT, without imparting core competencies such as responsible data handling, critical evaluation of AI results, or the integration of AI into business processes. Those who complete such a course receive a certificate that legally and for employers attests to their AI competence, without actually demonstrating it.

The German AI Association succinctly summarized the problem: many courses lack depth and practical relevance, failing to impart genuine AI skills for everyday professional use. According to a trend study on small and medium-sized enterprises (SMEs), 53 percent of German companies cite a lack of internal experts as the main obstacle to developing AI expertise, and 63 percent point to a lack of time. The paradox is evident: the need is acute, the supply is plentiful but deficient in quality and often fraudulent – and companies that have invested often only realize this when the acquired expertise fails in practice.

The economics of lost trust: What certificate fraud really costs

The economic damage caused by forged and worthless qualifications is difficult to quantify directly, but can be approximated using related data. In March 2026, Interpol published a global threat analysis indicating that more than US$442 billion flowed out of the global economy through financial fraud in 2025. A key driver of this is AI-powered fraud, which, according to Interpol, is 4.5 times more profitable than traditional methods. For Germany, an analysis by the German Insurance Association (GDV), based on 4,400 claims, shows that criminal employees cause their employers an average of around €125,000 in damages before being caught. In the analyzed years 2022/23, insured losses totaled approximately €450 million in Germany alone.

Beyond the direct financial damage, there are far-reaching consequential costs that don't immediately appear on any balance sheet. If a company has hired someone with falsified AI qualifications, and that person is responsible for AI systems in critical business processes, operational risks arise, ranging from flawed decisions to compliance violations. Deloitte predicts that AI-driven fraud in the US alone could cause losses of up to $40 billion by 2027, up from $12.3 billion in 2023 – an annual growth rate of 32 percent. The global market for AI fraud detection, which emerged as a direct response to these threats, was valued at $12.42 billion in 2024 and is projected to grow to over $65 billion by 2034. Fraud prevention has thus long since become a significant economic sector in its own right.

Added to this is the loss of trust as a systemic factor. If one in five fraudulent verification processes in Europe involves a manipulated or forged document, this undermines the reliability of the entire qualification system. Employers react with skepticism, which affects genuine and competent applicants. 86 percent of American recruiters believe that AI makes it too easy to inflate resumes, and 80 percent say that candidate profiles do not reflect their actual skills. A market in which no one can trust anyone else loses its allocation efficiency: capital and talent no longer connect.

🎯🎯🎯 Data-driven B2B industry hub as a quasi-in-house solution

The quasi-in-house solution: How Xpert.Digital closes operational gaps in B2B marketing and sales – Smart Content-Driven Business - Image: Xpert.Digital

Xpert.Digital is a data-driven B2B industry hub led by Konrad Wolfenstein . The company acts as an external, quasi-in-house solution for industrial partners, closing operational gaps in marketing, content, and sales – without requiring additional resources on the client side.

More information here:

The quasi-in-house solution: How Xpert.Digital closes operational gaps in B2B marketing and sales – Smart Content-Driven Business

EU AI Act and the certification chaos: Who really protects companies?

The regulatory framework and its blind spots: What the EU AI Act leaves open

The EU AI Act marks a historic moment in the regulation of artificial intelligence, and Article 4 is its key lever for the broader business landscape. Since February 2, 2025, companies that use or develop AI systems must demonstrably ensure that their staff possess adequate AI competence. The legislation defines AI competence in Article 3, paragraph 56, as the skills, knowledge, and understanding to use AI systems knowledgeably and responsibly, including awareness of opportunities, risks, and legal frameworks.

What the regulation deliberately left open, however, is the question of how this proof is to be provided in concrete terms. Article 4, according to legal interpretation, is formulated as an appeal and does not directly impose fines. This means that companies that do not conduct AI training or that conduct it of inadequate quality will not be sanctioned in the short term, but will bear civil liability risks for damages resulting from incompetent AI use. The EU AI Office provides best practices in a public repository, but does not require a certification body and does not accredit providers. In Germany, this framework was implemented through the AI Market Surveillance and Innovation Promotion Act (KI-MIG), which was adopted by the cabinet in February 2026 and designates the Federal Network Agency as the central coordinating body. The law deliberately focuses on openness to innovation and streamlined oversight – which is a moderate way of saying that uniform quality standards for AI training certificates will not be mandated by law in the future either.

The regulatory vacuum has created a market dynamic that inevitably leads to quality problems. If anyone is allowed to issue certificates purporting to attest to EU AI Act compliance, and if no independent body verifies these certificates, then opportunistic providers are incentivized to operate at a low level of quality. Reputable providers who actually invest in teaching staff, curricula, and examination procedures are thus in direct price competition with unscrupulous competitors who achieve maximum operational returns with minimal costs. This is a classic case of market failure that requires external regulation, which has so far been lacking.

Related to this:

AI consolidation in the financial sector: EU AI Act & Compliance – Why managed services are now the safest way for banks

Deepfakes in job interviews: The new dimension of AI skills fraud

Since the widespread availability of generative AI tools, fraud involving false qualifications has taken on a new technical dimension, rendering conventional corporate defense strategies simply obsolete. Deepfake verification attempts increased by 53 percent in Germany in 2025. In the financial sector, a study by Signicat and Consult Hyperion found that deepfake fraud attempts increased by 2,137 percent over three years, and that more than a third of all fraud attempts against financial institutions are now AI-generated.

For HR professionals, this means that an applicant for an AI expert role can now, in a video interview using real-time face-swapping software, impersonate someone else who actually possesses the claimed skills. Fifteen percent of recruiters in the 2025 SoftwareFinder survey reported having already experienced voice cloning or face-swapping during video interviews. AI-generated resumes are individually tailored to job postings, featuring fabricated project histories and qualifications that perfectly match specific job requirements. The business model of forgery is now so industrialized that 90 percent of the managers surveyed stated they had already encountered falsified documents.

Particularly worrying is the fact that only 31 percent of companies currently use AI or deepfake detection software, while 66 percent rely on manual visual inspection. Almost half of HR professionals have not received any training in dealing with AI fraud. This creates a classic asymmetric information problem: fraudsters use state-of-the-art AI tools, while defenses rely on outdated manual methods. 72 percent of EU companies expect AI to enable even more sophisticated attacks in the future. Anyone who still believes that a CV with impressive certificates and a smooth video interview are sufficient proof of qualification is fundamentally underestimating the problem.

No competence, but a certificate: What this means for corporate governance

The economic consequences of certificate fraud are not yet systematically discussed at the board level in many companies, even though that is precisely where they belong. When a company hires employees for AI-sensitive positions who submit forged or insufficient qualifications, risks arise in four dimensions: operational, regulatory, reputational, and security-related. Operational risks arise when AI systems are operated by personnel who lack the necessary expertise but document otherwise. Regulatory risks arise when companies believe they are complying with Article 4 of the EU AI Act because they can present certificates that do not withstand substantive scrutiny.

In the worst-case scenario, candidate fraud leads to active security threats from within. The FBI has documented several instances where North Korean IT operators, after being hired via privileged system access, installed malware, stole intellectual property, and extorted ransoms. Having been recruited using fake AI identities, these individuals had legitimate access to corporate networks, allowing them to exfiltrate data undetected for months. Experts warn that it is only a matter of time before a global corporation is completely compromised by a fully autonomous AI system that initially gained entry through fraudulent qualifications.

For supervisory boards and executive boards, this means that AI governance is not just a matter of the internal use of AI systems, but also a matter of the integrity of the human qualifications that manage these systems. According to a study by Thomson Reuters and Forrester Consulting, organizations with visible and implemented AI strategies are 3.5 times more likely to achieve a return on investment (ROI) from AI investments than companies without clear planning. However, this outperformance presupposes that the people implementing AI strategies are genuinely competent and not merely certified.

Trust through verification: Technological and structural ways out of the trap

The solution to the certificate chaos lies primarily in the technological and institutional reconfiguration of the verification process. Blockchain-based certification systems are the most promising technical answer to the problem of counterfeit qualifications. These systems create a cryptographic fingerprint for each issued certificate, which is stored decentrally and is accessible to recruitment platforms in real time. SRH Fernhochschule was one of the first universities in Germany to issue blockchain-based certificates. Credly and similar platforms already enable verifiable digital badges that employers can check directly via APIs. According to the World Economic Forum Skills Report 2025, 74 percent of employers prefer candidates with verified digital competency credentials for AI-related roles.

Institutionally, the solution requires a clear state accreditation structure for AI training providers, analogous to existing systems in other regulated continuing education sectors. In Germany, the State Central Office for Distance Learning (ZFU) offers an accreditation option for distance learning courses, which ensures at least a minimum level of quality assurance. However, this is insufficient for the nationwide AI training market. What is needed is an independent, expert accreditation body that assesses AI training content against recognized competency frameworks, such as the EU's AI Literacy Framework. As long as this institutional infrastructure is lacking, the certificate remains what it is in the worst-case scenario: a nice piece of paper without substance.

Until this infrastructure is in place, several immediate measures are recommended for companies. First, every AI qualification should be practically validated; simply presenting a certificate should not suffice, but rather a direct demonstration of the claimed skills should take place during the hiring process. Second, companies with more than 250 employees should invest in specialized deepfake and identity verification software, as these groups are particularly vulnerable. Third, only certificates from accredited or at least publicly verifiable institutions should be accepted, including chambers of commerce, accredited universities, or internationally recognized platforms such as Coursera or edX. Finally, internal AI experts should be developed who can review the content of external training programs before companies book them for their employees.

Market failure foretold: The structural economics of the proliferation of certificates

What is happening in the AI certification market is, from an economic perspective, a textbook case of market failure under asymmetric information. George Akerlof's classic concept of the "market for lemons" is directly applicable here: If buyers cannot assess the quality of a good, poor-quality products will drive good ones out of the market because they are offered at the same price or cheaper. In the AI certification market, the buyers are the companies that treat certificates as quality signals, and the sellers are both training providers and applicants. Since neither the certificate itself nor the course behind it can be easily verified for actual competence, inferior offerings dominate the market.

The demand side contributes structurally to the problem. In times of regulatory pressure from the EU AI Act, companies have a direct incentive to quickly gather evidence of AI training for their employees, regardless of the training's substantive content. This compliance logic favors certificates that are quick and cheap to obtain over lengthy and expensive, genuine skills development. The result is a demand structure that systematically incentivizes superficial providers. When the driving force behind certificate acquisition is regulatory compliance rather than genuine skills improvement, a market emerges that produces more appearance than substance.

The societal dimension should not be underestimated. AI systems are increasingly being used in far-reaching decision-making processes, from loan approvals and medical diagnoses to personnel decisions. If the people operating and monitoring these systems only simulate their competence, the quality of these decisions systematically declines—in ways that remain invisible until a problem arises. Society bears the cost of this failure in the form of poorer resource allocation decisions, increased security risks, and eroded trust in AI-supported institutions.

Competence as a competitive factor: Why genuine AI qualification is strategically crucial

Despite the inherent problems, it would be wrong to conclude from the certification chaos that AI training is fundamentally pointless. Quite the opposite is true: genuine, substantial AI expertise within companies is a crucial competitive advantage, and the damage caused by pseudo-certificates lies precisely in the fact that they discredit and devalue this strategic asset. AI-supported fraud detection, the meaningful application of generative AI in production, marketing, and logistics, and the ability to critically examine and validate the outputs of AI-based systems—these are competencies that create real economic value and provide a measurable advantage to the companies that possess them.

Companies that want to realize this advantage must begin to deprioritize certifications and prioritize competence. Specifically, this means moving away from the question "What certification does the candidate have?" and towards "What can the candidate do?". Practical AI assessments, structured case studies, technical tests, and live demonstrations of problem-solving in AI-related scenarios must become part of every hiring process for AI-sensitive roles. This effort is greater than simply ticking a box for a certification on an application form, but the alternative is more costly: hiring incompetent or even fraudulent candidates who expose the company to operational, regulatory, and security risks.

The trend study "AI Compass for SMEs" shows that 72 percent of German companies prefer practice-oriented learning formats and want concrete use cases instead of theoretical modules. This desire of companies aligns perfectly with what actually generates competence. If the procurement logic shifts from certificates to practical formats, and if, at the same time, the institutional infrastructure for reliable verification is established, the current deception could contain the seeds of its own demise. Until then, the sober assessment remains: Anyone who blindly trusts an AI certificate today is lulled into a false sense of security.