AI literacy evidence: what to record (no certificate needed)
AI literacy evidence is an internal record of what your organization has done to support its people’s AI skills: who received which training or guidance and when, which AI policy version they acknowledged, and when you will review it. The EU AI Act requires no certificate, exam or set format. The European Commission’s AI literacy Q&A, updated July 27, 2026, says an internal record of trainings or guidance is enough.
The point is not paperwork. A clear record lets you answer a customer, an auditor or an authority without a scramble.
Status as of October 13, 2026. Not legal advice.
What AI literacy documentation needs to show
Since the Digital Omnibus (Regulation 2026/1744), Article 4 of the AI Act asks providers and deployers to take measures to support the AI literacy of their staff and others who use AI on their behalf, without guaranteeing any specific level for any individual (Article 4 after the Digital Omnibus).
Good documentation answers one question fast: what did you do, for whom, and why does it fit your risks? A register answers the first two parts, and the evidence pack answers the third.
A sample AI literacy register
Here is a register for a fictional 40-person company, Example Ltd, with one row per person.
| Name | Role | Relationship | AI tools used | Measures completed | Date | AI policy version acknowledged | Next review |
|---|---|---|---|---|---|---|---|
| Sanna K. | Customer service | Employee | Copilot, support chatbot | Course modules 1–7, final exam passed | 9/15/2026 | v1.2 | 9/2027 |
| Mikko L. | Sales | Employee | ChatGPT (business account) | Modules 1–5, team briefing on pricing data | 9/22/2026 | v1.2 | 9/2027 |
| Aino R. | HR | Employee | Copilot, recruitment tool (pilot) | Modules 1–7, session on high-risk HR use | 10/6/2026 | v1.2 | 4/2027 |
| Jonas P. | Field service | Contractor (Example Transport Ltd) | Translation app | Modules 1, 4 and 5, policy summary | 10/13/2026 | v1.2 | 10/2027 |
| Leena M. | CEO | Employee | Copilot, ChatGPT (business account) | Modules 1–7 | 9/10/2026 | v1.2 | 9/2027 |
What the columns are for:
- Relationship matters because Article 4 also covers people who use AI on your behalf, such as contractors and service providers.
- AI tools used links the person to your AI inventory, showing who is affected when a tool changes.
- Measures completed describes what the person received, not a score; an exam result is a bonus, not a legal requirement.
- Next review can differ by role. Here HR reviews sooner, because recruitment and HR systems become high-risk from December 2, 2027.
The register contains personal data, so keep only what you need (GDPR data minimization).
The evidence pack checklist
The rest of the pack shows why your measures fit your organization, in line with the Commission’s role- and risk-based approach.
- Scope list: everyone who uses AI for you, including contractors and temporary staff.
- AI inventory: the tools in use, the type of account (business or consumer), an owner for each, and whether you are a provider or a deployer.
- Role and risk assessment: one page on which roles use AI for what, the main risks and what each role needs.
- AI policy: the current version and the version history. The AI policy template for EU SMEs is a good starting point.
- Acknowledgements: who has read and accepted which policy version, and when.
- Training content: a short summary of the topics, such as a general understanding of AI, checking output, data protection and the AI Act.
- Completion records: the register above.
- Measure log: dated actions at organization level, such as “AI policy v1.2 published”, “new tool added to the inventory” or “refresher sent to sales”.
- Review record: when you last reviewed the pack, what changed and when the next review is due.
- If you deploy high-risk AI: who is assigned human oversight and what training they received. Article 26 requires deployers of high-risk systems to give this role to people with the necessary competence, training and authority.
Tip: In Aigen Campus, the competence register fills itself as people complete modules and acknowledge your AI policy. It can include contractors and temporary staff, and reports print or export to CSV. See pricing for the annual license.
Who asks for AI literacy evidence
You rarely need the evidence pack, but then you need it fast. The usual readers:
| Who asks | Typical situation | What they want to see |
|---|---|---|
| Customers and procurement teams | Tenders and supplier questionnaires | A short description of your measures, the share of staff trained and your AI policy |
| National market surveillance authority | Supervision of Article 4, which started in August 2026 | What you did, for whom, and why it fits your risks |
| Data protection officer | GDPR accountability under Article 5(2) | Data rules in the AI policy and training on handling personal data |
| Auditors and the board | Annual audit or risk review | The measure log, policy coverage and open gaps |
| Employee representatives | Introducing new AI tools | The plan, the rules and the training on offer |
Customers often want something they can check themselves. A certificate helps there, although the law does not ask for one. Aigen Campus certificates carry a QR code and a code that anyone can check on the certificate verification page.
Penalties are national, and Finland, for example, sets none for Article 4. The pack is about showing competence, not avoiding a fine.
How long to keep records, and when to review them
Retention. Neither the AI Act nor the Commission’s Q&A sets a retention period for Article 4 records. Two practical rules:
- Organization-level documents (policy versions, the measure log, the risk assessment) hold little or no personal data. Keep them as long as your other compliance documents, to show how your measures developed.
- Personal records (the register) fall under the GDPR. Set a retention period that matches your other training records, note it in your record of processing activities, and delete or anonymize entries when that period ends after someone leaves.
Review. Review the evidence pack at least once a year, and also when:
- you add a major AI tool or a new use in HR, credit or another sensitive area;
- you publish a new AI policy version, which should trigger new acknowledgements;
- the Commission or your national authority issues new guidance;
- an incident reveals a gap, for example personal data pasted into a consumer AI tool.
If you use certificates, decide how long they stay valid. In Aigen Campus you choose 12, 24 or 36 months, and the register shows who is due for a refresher.
Frequently asked questions
Is an AI literacy certificate required under the EU AI Act?
No. The Commission’s AI literacy Q&A says there is no need for a certificate. An internal record of training and guidance is enough.
How long should we keep AI literacy records?
The AI Act sets no period. Keep organization-level documents as long as your other compliance documents, and personal records for a set period that matches your other training records, in line with the GDPR.
Do we have to test employees’ AI knowledge?
No. Article 4 does not require measuring AI knowledge. A quiz or exam can still help people learn and add evidence, but it is optional.
Do contractors need to be in the AI literacy register?
Yes, if they use AI systems on your behalf. The Commission’s Q&A counts contractors and service providers among the “other persons” that Article 4 covers.
Get started
Start today with a spreadsheet and the checklist above. When you want the register to fill itself, the Aigen Campus annual license costs €99 per year including 10 users, plus €4.90 per extra user per year; VAT is added on the invoice. See pricing and plans.