How to Evidence AI Literacy Without a Certificate

Article 4 of the EU AI Act asks you to take measures to support AI literacy among the people who operate AI systems on your behalf. It does not ask you to produce certificates. The European Commission own AI literacy material states that there is no need for a certificate and that no mandatory trainings are imposed.

What that leaves you needing is evidence — a record that shows you identified who was exposed, worked out what they needed, did something about it, and kept it current. This is a documentation exercise more than a procurement one, and most organisations can build it from material they already have.

Start with an AI inventory, not a training plan

You cannot scope training until you know what is in use. Most organisations underestimate this badly, because AI has arrived through the side door: embedded in software already licensed, in browser extensions, in features switched on by a vendor update nobody announced.

List every system where an AI component informs a decision, drafts output, screens an input, or ranks something. For each one, record what it does, who uses it, what decision it touches, and whether you are the provider or the deployer of it — a distinction with real consequences, covered in our guide to provider and deployer roles.

This inventory is the foundation of everything else. It is also the document most likely to be asked for first, because it demonstrates that you have actually looked.

Map exposure to roles, not to headcount

Article 4 asks for literacy appropriate to the role and the context in which the system is used. That makes a single organisation-wide module the wrong shape of answer, however convenient it is to buy.

Group people by what they actually do with AI output:

• People who act on AI output affecting someone else. Credit decisions, recruitment screening, clinical triage, case prioritisation. Highest exposure, deepest training, and often the smallest group.
• People who produce work with AI assistance. Drafting, summarising, coding, analysis. They need to understand accuracy limits, confidentiality, and when to check.
• People who procure or configure AI systems. They need to understand the obligations attaching to what they are buying.
• Everyone else. General awareness, kept short, so attention is spent where exposure actually sits.

Our guide to tailoring AI literacy training by role goes into how to scope each of these properly.

What an adequate record contains

The record is the deliverable. For each training intervention, keep:

• Date delivered — dated records are what turn an intention into evidence.
• Who attended — by name and role, not a headcount.
• What was covered — the actual content outline, not the course title.
• Who delivered it — internal or external, and their basis for doing so.
• Which systems it related to — tying it back to the inventory.
• How it was assessed, if it was — and what happened to anyone who did not complete it.

Note that none of this requires an external provider. An hour delivered internally by someone competent, documented properly, is better evidence than an unrecorded external course.

Build it into things you already do

The most durable approach is to stop treating AI literacy as a standalone project and fold it into existing processes:

• Induction. New starters in exposed roles get the relevant module as part of onboarding, so the record populates itself.
• Procurement. Any new tool with an AI component triggers a review of who needs training before it goes live. Our guide to AI vendor due diligence covers what to ask at that point.
• CPD cycles. If your staff already record CPD with a professional body, AI training logged there is evidence you are keeping anyway.
• Annual review. Re-check the inventory. Tooling changes faster than training calendars.

The thing most organisations get wrong

The common failure is not an absence of training. It is training that happened and was never recorded in a way that connects it to a specific system and a specific role. A folder of completion emails from a generic AI course does not show that you assessed exposure; it shows that some people did a course.

The second most common failure is treating the obligation as a one-off. Article 4 has applied since 2 February 2025 and is ongoing. A single training session in 2025, never refreshed against tooling that has changed three times since, is a weaker position than the certificate in the drawer suggests.

Where certificates still help

A certificate is a convenient, portable record for the individual holding it, and it saves you building attendance tracking from scratch. That is a real administrative benefit. It is just not the obligation. If you buy one, buy it because it is good training with a useful record attached, and be clear-eyed about what the credential itself is — our guide to self-awarded versus accredited certificates sets out how to tell.

Frequently asked questions

Will a regulator accept internal training as evidence?

There is nothing in the Regulation requiring training to be externally delivered. What matters is that the measures are appropriate to the role and documented.

How long should we keep records?

The Regulation does not set a retention period for Article 4 records. Keeping them for as long as the related system is in use, plus your normal corporate retention period, is a defensible default.

What if someone refuses the training?

Record it, record what you did about it, and consider whether that person should continue to operate the system. The measures you take include how you handle non-completion.

Does this apply to contractors?

Article 4 covers staff and other persons operating AI systems on your behalf, which can include contractors. Scope your inventory accordingly.

If you would rather have role-mapped AI training that produces a usable CPD record as a by-product, our CPD courses are built that way.