1. AI inventory and scope
Document AI systems, generative AI tools, suppliers, purposes, teams, external parties and risk profiles. Without scope, training is hard to defend.
Article 4 EU AI Act
AI literacy evidence: the Article 4 dossier and how to prove it
You prove AI literacy by showing per role which measures you took and why: role matrix, learning goals, training records, follow-up and management reporting. There is no mandatory certificate and no form prescribed by law.
- Article 4 applies
- 2 Feb 2025
- Amended text
- 27 Jul 2026
- Measures by context
- Appropriate
Legally reviewed: 30 July 2026
Article 4
What should you be able to show under Article 4?
Article 4 of the EU AI Act has applied since 2 February 2025. Since 27 July 2026, providers and deployers must take measures to support the development of AI literacy. Those measures should reflect technical knowledge, experience, education, the context of use and affected persons. The law does not require a specific individual level, standard course or certificate.
Which AI systems or AI tools are used, for what purpose and by which teams.
Which roles work with those systems or act on behalf of the organisation.
Which risks, limitations, privacy rules and usage instructions matter per role.
Which training, guidance, assessment, certificates and follow-up are in place.
How progress, exceptions, incidents and changes are tracked at management level.
Evidence
The evidence dossier that works in practice
A supervisor is unlikely to ask only whether someone completed a course. A stronger dossier explains why your measures fit the organisation's AI use, role distribution and risks.
2. Role matrix
Connect functions to AI use: management, users, HR, legal/compliance, privacy, IT, product teams, procurement and suppliers do not need the same learning goals.
3. Learning goals per risk
Show what people must understand about hallucinations, bias, privacy, human oversight, logging, transparency, vendor claims and sector rules.
4. Training, guidance and practical cases
Keep modules, work instructions, prompt rules, practical exercises, policy updates and cases. AI literacy should connect to work behaviour.
5. Records and assessments
Track attendance, assessment results, certificates, exceptions, remediation and refresh cycles. A certificate helps, but context makes the evidence strong.
6. Management reporting
Report periodically on coverage per role, open gaps, incidents, new AI tools, vendor changes and the next quarterly plan.
Steps
How to build the evidence per role, in five steps
A supervisor mainly wants to understand whether your approach is logical. The question is not whether everyone clicked through a course, but whether the measures fit the AI systems, the risks and the people working with them. These five steps record that line.
1. Start from AI use, not from training
Which generative AI tools are allowed? Which software has AI features? Where is AI used for screening, advice, classification, customer contact or preparing decisions? Without that scope every measure becomes generic, while Article 4 asks you to take account of knowledge, experience, education, context of use and the people on whom the system is used.
2. Link systems to roles
Not everyone needs the same knowledge. A role that decides about people in HR, healthcare, education or public services needs more depth than a role using AI for drafting. Make clear per role:
- which AI systems or tools the role uses;
- which decisions or outputs depend on them;
- which risks the role must recognise;
- when human review or escalation is needed;
- which records or logging are expected.
3. Turn roles into learning goals, and explain the choice
A learning goal is stronger than a course name. "HR staff can explain when candidates must be informed about AI use" is more testable than "HR follows AI awareness". Also record why this level fits the role. That reasoning is the part a supervisor can assess.
4. Record delivery, assessment and exceptions
Record per person what was followed, when, for which role and with which result. Also record the exceptions: who has not finished, who scored too low and which remedial action is running. A dossier without follow-up shows that you offered something, not that you took a measure.
5. Make management the owner
Management periodically sees which roles are done, which teams lag behind, which systems need extra attention and which incidents lead to new learning goals. Record when you will look again, for example at a new system or an incident.
Recording is the way to make your measures demonstrable, not a form prescribed by law. The European Commission indicates that an internal record of training and other guidance can serve as evidence.
The thirty-minute test
Can you explain within half an hour which AI systems you use, which roles work with them, which knowledge each role needs, who has been trained, who is still open and which decisions management took? Then your evidence is in place. If not, there has usually been training, but no evidence was built.
Roles
Which roles should evidence what?
The European Commission stresses that AI literacy is context-specific. Evidence becomes stronger when you show what knowledge is needed per role and how that knowledge is maintained.
| Role | Knowledge focus | Evidence |
|---|---|---|
| Board and management | AI governance, risk decisions, policy, escalation and progress oversight. | Decision records, management reporting, roadmap, AI policy and governance meetings. |
| Staff using AI | Safe use, output checking, privacy, hallucinations, bias and human judgement. | Training records, assessment results, usage instructions and practical cases. |
| HR, recruitment and people analytics | Annex III risk, non-discrimination, transparency and candidate or worker impact. | HR-AI use-case register, Article 4 records, DPIA/FRIA and human oversight arrangements. |
| Legal, privacy and compliance | AI Act roles, GDPR, DPIA/FRIA, vendor review, policy, incidents and evidence. | Review records, risk assessments, supplier files and control framework. |
| IT, data and product teams | System boundaries, data governance, logging, model behaviour, monitoring and changes. | Technical documentation, change log, evals, monitoring and release decisions. |
| Suppliers and contractors | Use on behalf of the organisation, safe handling of output and contractual arrangements. | Onboarding, instructions, contract clauses, attestations and exception register. |
Certificate
Is an online AI literacy certificate enough?
No. The European Commission says there is no certificate requirement. An online certificate is still useful supporting evidence when it sits inside a broader dossier with role-based learning goals, records, assessment, follow-up and periodic evaluation. Be careful with providers who present a particular certificate as legally required.
Strong evidence
- Participant, date, module, score, role and validity are recorded.
- The module fits the role, AI tools and risk profile of the employee.
- There is follow-up for low scores, missed parts or changed systems.
- Management can see coverage, open gaps and exceptions.
Weak evidence
- Everyone gets the same generic awareness module.
- There is no link to AI systems, roles or risks.
- There is no refresh, assessment or follow-up when new tools appear.
- The certificate is treated as the endpoint instead of a piece of evidence.
Difference
AI awareness is not the same as AI literacy
Awareness is a useful start: people understand that AI has opportunities and risks. AI literacy goes further and must connect to the task, the system, the rights and obligations of the role and the impact on affected people.
| Area | AI awareness | AI literacy |
|---|---|---|
| Goal | Awareness | Responsible action in context |
| Evidence | Attendance or e-learning | Role matrix, learning goals, assessment and follow-up |
| Depth | Basic concepts | Risks, limitations, governance and practical decisions |
| Rhythm | One-off session | Ongoing evaluation and refresh |
Plan
30-day implementation path
This path is a starting point. Larger organisations should then turn it into a quarterly rhythm for new tools, new roles and changed risks.
Week 1: scope and AI inventory
Inventory AI tools, processes, teams, suppliers and external persons. Start with the highest impact or broadest use.
Week 2: roles and learning goals
Define minimum competency per role: what should someone understand, assess, apply and document?
Week 3: training and assessment
Start role-based modules, short practical cases and assessments. Record attendance and results immediately.
Week 4: reporting and embedding
Create a management update with attendance, scores, open gaps, exceptions, incidents and the next quarterly plan.
Governance
Connect Article 4 to your AI governance
AI literacy should not sit beside governance as a separate training project. It should run together with AI inventory, risk classification, DPIA/FRIA, vendor assurance, human oversight, transparency and incident response.
AI inventory
Determines which systems and teams need training.
Annex III classification
Raises training depth in high-risk or sensitive contexts.
DPIA and FRIA
Shows which risks staff must recognise and mitigate.
Vendor assurance
Ensures suppliers and contractors receive sufficient instruction.
Human oversight
Connects training to real authority, escalation and control.
Management reporting
Makes progress and open risk visible to leadership.
AI literacy guideDefinition, obligation, roadmap and FAQ.AI governance and complianceConnect Article 4 to governance, inventory and evidence.Provider vs deployerDetermine who is responsible for training and instructions.Annex III classificationHigh-risk context requires deeper role training.DPIA vs FRIATurn risk assessment into learning goals.Transparency (Article 50)Connect training to disclosure and human oversight.
Sectors
Sectors where Article 4 evidence matters more
Every organisation using AI should organise suitable AI literacy. In these sectors, evidence is often more urgent because of fundamental-rights impact, supervision, customer trust or Annex III risk.
HR and recruitmentRecruiters, HR, hiring managers and people analytics.EducationAI in assessment, admission, monitoring and support.GovernmentPublic services, algorithm registers and citizen impact.Financial servicesCredit, fraud, onboarding and model risk.HealthcareDecision support, privacy, safety and clinical context.Technology and softwareProvider roles, product teams and downstream instructions.
Next
From explanation to execution
Use Praxikon for explanation, sources and templates. Go to LearnWize when you want to organise team training, records, certificates and reporting. When governance, scope and implementation choices need to be set up, Praxikon does that itself.
LearnWize for training and evidence
Assessment, role-based learning paths, Article 4 training, certificates, records and team reporting.
Praxikon for governance and scope
Fixed monthly fee · matched to your organisation, agreed up front · 12 months, then cancellable per quarter
An external DPO with AI oversight as a fixed point of contact for AI policy, roles, the AI register, the oversight protocol under Article 26 and the Article 4 evidence rhythm.
External DPO and AI oversight: what you get
A board session or half day for lawyers is available on request, under Hire an AI and privacy legal adviser. Carried out by Zahed Ashkara, the legal adviser behind this explanation.
Context
Article 4 also touches governance, risk and evidence
Zahed Ashkara connects AI literacy with EU AI Act readiness, AI governance, Annex III and evidence. Read the central profile or the relevant in-depth pages when you need to place the obligation in a broader AI approach.
FAQ
Frequently asked questions
How do you prove AI literacy under the AI Act?
By recording per role which measures you took and why: which systems the role uses, which knowledge fits, which training, guidance and assessment were used, and how you follow up. Since 27 July 2026 Article 4 asks for measures that support the development of AI literacy, not a guaranteed level per person.
Is recording training legally required?
Article 4 does not prescribe a fixed form. The European Commission indicates that an internal record can serve as evidence. Recording is therefore the practical way to show what you did, not a form prescribed by law.
What level of AI literacy is enough?
The law names no level and expressly does not require a specific level per person. What is appropriate depends on technical knowledge, experience, education, the context of use and the people on whom the system is used. Record per role which knowledge you consider appropriate and why.
Does every employee need to be AI-literate?
Article 4 covers staff and other persons operating and using AI systems on the organisation's behalf. The organisation must take appropriate measures but does not have to guarantee a specific individual level. The approach can therefore differ by role, system and context.
What might a supervisor ask for?
Think of an AI inventory, role matrix, learning goals, training records, assessment results, policies, management reporting and evidence of periodic evaluation.
Is a certificate mandatory under Article 4?
No. The European Commission indicates there is no certificate requirement. A certificate can still be useful evidence when it is part of a broader dossier with role-based learning goals, records and follow-up.
Does Article 4 also apply to ChatGPT or Copilot?
Yes, when staff use AI systems or generative AI tools on behalf of the organisation, they should understand the relevant opportunities, limitations and risks, such as hallucinations, privacy, confidential information and output review.
Can LearnWize help with Article 4 evidence?
LearnWize helps with evidence: assessment, learning paths, assessments, certificates, training records and reporting. The organisation remains responsible for scope, governance and application in its own context.