Free template · Word and Excel · English and Dutch
AI literacy policy and evidence template: Article 4 EU AI Act dossier (Word)
An Article 4 evidence dossier shows which measures an organisation takes to support the AI literacy of its staff and others using AI on its behalf: for whom, why and when. Article 4 of the AI Act applies to providers and deployers and, since 27 July 2026, is a duty to take measures; no level per individual has to be guaranteed.
- Last checked against the law
- Editor
- Zahed Ashkara, jurist, privacy and AI
- Version and template ID
- 2.0 ·
praxikon:template:article-4-evidence-dossier-checklist, praxikon:template:article-4-register - Legal basis
- Art. 4 Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR)
Who is this template for?
- Board or executive teamAdopts the policy and makes resources available, for the organisation as provider or deployer (Article 4 AI Act)
- HR or L&D, as AI literacy ownerAssigns role groups, plans the measures and keeps the dossier up to date (Article 4 AI Act)
- Owner of a high-risk AI systemAs deployer, designates and prepares the staff assigned to human oversight, from 2 December 2027 for Annex III systems (Article 26(2) AI Act)
- Data protection officer or privacy officerAdvises on the participation records, which the organisation keeps as controller (Articles 5, 6, 13 and 39(1)(b) GDPR)
- Works council or employee representativesMay have information, consultation or consent rights under national law, for example Article 27(1)(f) and (l) of the Dutch Works Councils Act
What is inside
Article 4 evidence dossier (Word)
An Article 4 evidence dossier shows which measures an organisation takes to support the AI literacy of its staff and others using AI on its behalf: for whom, why and when. Article 4 of the AI Act applies to providers and deployers and, since 27 July 2026, is a duty to take measures; no level per individual has to be guaranteed.
- Chapter 1: what Article 4 requires since 27 July 2026 and what it does not, with supervision and the links to Article 5, Article 26(2), Article 50 and the GDPR
- Chapter 2: model provisions for an AI literacy policy, a division of tasks and an adoption block for the DPO and the works council
- Chapter 3: risk profile per application, a decision box for three levels, measures for twelve role groups and a worked fictional example
- Chapter 4: training plan with eight modules, planning and fixed moments to update it (2 December 2026 and 2 December 2027)
- Chapter 5: contents of the evidence dossier, participation records, a 14-point checklist, a quarterly board report and answers for a supervisory authority
- Chapter 6: records and the GDPR, with purpose, lawful basis, retention periods and model text for the staff privacy notice
- Annex A: self-test for level 1 with eight statements and explanations, without a pass mark
Article 4 register (Excel)
An Article 4 register is an overview of the measures an organisation takes, role by role, to support the AI literacy of its staff and others using AI on its behalf, with dates, reach and where the evidence is kept. The AI Act prescribes no form; such a register helps show that the measures fit knowledge, context and the people on whom AI is used.
- About this template: seven steps to complete the workbook, fields for organisation, owner and review, and the fixed credit and terms of use
- Dashboard: eighteen self-calculating counts, with red signals (role without a measure, evidence without a location, unknown Role ID), points to watch (human oversight, overdue review, retention) and the self-test outcome per target group
- Measures per role: one line per role with the factors from Article 4 (knowledge and experience, context, the people on whom AI is used), your role per system, level 1 to 3, measures, repetition and a calculated signal; six fictional example roles
- Evidence log: one line per measure carried out with date, Role ID, number intended and reached, type of evidence, location, personal data and deletion date; seven fictional examples
- Self-test: 24 multiple-choice questions in six target groups (everyone, communications and customer contact, HR, working with high-risk AI, IT and procurement, board), with instant result and explanation; a learning tool without a pass mark
- Article 4 sheet: the literal text of Article 4(1) and Article 3(56), what is and is not required, enforcement, the overlap with Article 26, Article 50 and the GDPR, and the level scheme of the evidence dossier
- Answer key: for each question the correct answer, the explanation and the article of the AI Act or the GDPR it rests on
How to use the template
- Map which AI your organisation uses or builds, and determine for each application whether you are the provider or the deployer.
- Give each application a risk profile and assign role groups with the decision box in chapter 3.
- Complete the policy in chapter 2, delete what does not fit and submit it to the DPO and, where needed, your employee representatives.
- Plan the modules with chapter 4 and set up participation records as described in chapter 6, using only the fields in 5.2.
- Keep the dossier up to date with the checklist and quarterly report in chapter 5, and revise it after a new tool, an incident or a change in the law.
Common mistakes
- Requiring a certificate, test or pass mark as if Article 4 prescribed one. The duty asks the organisation to take measures, not to guarantee a level per person.
- One standard course for everyone. Article 4 asks you to take into account knowledge, context and the people on whom AI is used; staff assigned to human oversight need more.
- Keeping test scores per person and using them in performance reviews. That conflicts with purpose limitation (Article 5(1)(b) GDPR) and may require the consent of employee representatives.
- Forgetting agency workers, contractors and supplier staff who work with AI on the organisation's behalf.
- Completing the dossier once and not updating it after a new tool, a new AI feature in existing software or an incident.
When do you need legal advice?
- AI helps make decisions about people. For example in recruitment or creditworthiness assessments. As a deployer of high-risk AI, from 2 December 2027 you assign human oversight to staff who have the necessary competence, training and authority, and you give them the necessary support (Article 26(2)); the GDPR restricts decisions based solely on automated processing (Article 22 GDPR).
- You want to use learning data for more than the dossier. For example test scores in performance reviews or progress dashboards per employee. As controller, you then assess purpose limitation (Article 5(1)(b) GDPR) and whether a DPIA is required (Article 35 GDPR); your works council or other employee representatives may have a right of consent (in the Netherlands: Article 27(1)(g) and (l) of the Works Councils Act, WOR).
- There is an incident or a question from a supervisory authority. An AI error affected customers or staff, or an authority asks about your measures. As a deployer of high-risk AI you report a serious incident to the provider first (Article 26(5)) and cooperate with the competent authorities (Article 26(12)); if personal data is involved, the 72-hour notification deadline applies to you as controller (Article 33 GDPR). What you report and what you show about your measures must then be consistent.
Frequently asked questions
Was Article 4 repealed by the Digital Omnibus?
No. Article 4 has applied since 2 February 2025. Since 27 July 2026, as amended by Regulation (EU) 2026/1744, it requires providers and deployers to take measures to support the development of AI literacy of their staff and others using AI on their behalf. What has gone is the expectation that they guarantee a specific level for each individual.
Does every member of staff need an AI course or certificate?
No. The AI Act does not prescribe a course format, minimum hours, test or certificate. The organisation chooses its measures, such as instruction, work instructions and a help desk, appropriate to role and risk. A course can be one of those measures.
What is the fine for not complying with Article 4?
Article 99 sets no specific maximum fine for Article 4. Member States lay down the rules on penalties and other enforcement measures (Article 99(1)), and their progress differs: the Netherlands, for example, had not yet designated its AI Act market surveillance authorities or adopted its implementing act on 6 October 2026. After an incident, an authority can still ask which measures you took.
May we record participation per member of staff?
Yes, within limits. As controller, record only who took which measure, when and which version, based on legitimate interests or the performance of the employment contract (Article 6(1)(f) or (b) GDPR). A public authority cannot rely on legitimate interests in the performance of its tasks. Do not keep test scores per person, and inform staff (Article 13 GDPR).
How does Article 4 relate to human oversight of high-risk AI?
There, training is a concrete requirement. The deployer assigns human oversight to persons who have the necessary competence, training and authority, and gives them the necessary support (Article 26(2)). This applies from 2 December 2027 to high-risk AI under Annex III and from 2 August 2028 under Annex I.
Do employee representatives have a say?
Often, depending on national law. In the Netherlands, a scheme on staff training needs works council consent (Article 27(1)(f) WOR), as does a learning platform that can monitor performance (point (l)). Separately, from 2 December 2027 a deployer that is an employer informs workers' representatives before using Annex III high-risk AI at the workplace (Article 26(7) AI Act).
Do we have to record AI literacy for each member of staff?
No. Article 4 prescribes no form of evidence and, since 27 July 2026, requires no specific level for each individual. An overview of measures per role, with date, reach and location, helps you show that you take appropriate measures. If you do record per person, you process staff personal data as controller and need a lawful basis and a retention period (Articles 5 and 6 GDPR).
Is the self-test an exam?
No. The self-test is a learning tool without a pass mark. The AI Act does not prescribe a test or certificate. Use the outcome per role, without names, to adjust your measures, and do not make access to work depend on a score.
Who belongs in the register?
Everyone who deals with the operation and use of AI systems on your organisation's behalf: your own staff, but also agency workers, contractors and external parties (Article 4). It covers all AI systems within the scope of the AI Act, not only high-risk systems.
How does this register relate to the Article 4 evidence dossier?
The register is the Excel part of the evidence dossier and is on the same page. The Word dossier sets out policy, role groups and levels; the register tracks the measures and evidence per role. Both use the same level scheme from 1 to 3.
What changes on 2 December 2027?
From then, the obligations for Annex III high-risk systems apply, for providers and deployers (for Annex I: 2 August 2028). The deployer assigns human oversight to people who have the necessary competence, training and authority, and gives them the necessary support (Article 26(2)). For systems already in use before then, Article 111(2) applies.
Use and credit
You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.
How to cite this template: Source: Praxikon, AI literacy policy and evidence template: Article 4 EU AI Act dossier (Word), version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/article-4-evidence-dossier-checklist
This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.
Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597