AI literacy evidence under Article 4 of the AI Act: what to keep on file

What Article 4 asks, and what it does not

Article 4 has applied since 2 February 2025. Regulation (EU) 2026/1744, the Digital Omnibus on AI, amended it with effect from 27 July 2026. Providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The amended text adds that this does not require them to guarantee "any specific level" of AI literacy of any individual.

The duty is about effort, and you need to be able to show that effort. A deployer is any organisation using an AI system under its authority, other than for personal non-professional activity (Article 3(4)). If your staff use a chat assistant, a writing tool or AI features inside other software for their work, that includes you. On the form of proof the AI Office is direct: "There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives."

The AI Office lists what organisations should consider at a minimum: a general understanding of AI in the organisation, whether they act as provider or deployer, the risks of the AI systems they use, and literacy actions built on staff knowledge and the context of use.

The evidence file: three records

1. A short AI policy

One or two pages: which AI tools are allowed and with which account, which data never goes in (personal data of customers, confidential documents, passwords), when a person checks the output before it is used, and who owns the policy. Add a paragraph on your AI literacy approach: who gets which instruction and how often. Date it and have management sign it off.

2. An AI usage register

One row per AI tool in use. It shows that your training fits the tools people actually use:

3. A training log

One line per session or initiative: date, topic, format (workshop, e-learning, team meeting, written instruction), who took part, who delivered it, and the next refresh date. Keep the attendance list or a learning-platform export with it. A quiz is optional: the amended text sets no level per person. Include freelancers and agency staff who use AI on your behalf: the AI Office gives a contractor, a service provider and a client as examples of persons under the organisational remit.

Match the training to the role

Article 4 asks you to take into account the technical knowledge, experience, education and training of the people involved and the context in which the AI systems are used. In practice that means two or three groups:

• Everyone who uses AI tools. What the tools do well and badly, which data stays out, and when to check the output.
• Staff whose AI output reaches customers or decisions. How to check facts and sources, how to spot a biased or invented answer, and when to escalate.
• Whoever picks or manages AI tools. The register, the supplier's terms, and which AI Act role your organisation has for each tool.

Write down in the policy which group gets what. That short rationale is part of the evidence.

Keep the file current

• Update the register when a new tool is adopted or an existing product adds AI features.
• Repeat a short session every six to twelve months, and earlier when the tools change. Log each one.
• Keep the three records in one place with one owner, so you can show them quickly when asked.

Common mistakes

• Treating a course certificate as the proof. A course can be useful. The record that counts is your own.
• A policy without a register. Without a list of tools you cannot show that the training matches real use.
• Forgetting built-in AI. AI features in email, CRM or office software count when staff use them for work. When in doubt, add them to the register.