Building Your AI Literacy Evidence Pack
This final lesson assembles everything into the single artefact that answers the question an authority, a customer or a board will ask, which is what measures you took to ensure a sufficient level of AI literacy. The pack should be a real document, owned by a named person, dated, and capable of being produced within a working day.
Open the pack with a short statement of position. Say what the organisation does, which AI systems it uses, whether it acts as provider or deployer for each, and who owns AI governance. This section exists so that a reader can tell within two minutes whether your programme is proportionate to your use, which is the judgement Article 4 actually calls for.
The system register comes next, as described in Lesson 10, with each system’s name, version, supplier, role, intended purpose, actual use, business owner, populations affected and date of entry into service. Include retired systems with their end dates. If the register shows any system in an Annex III category, say so and note the 2 December 2027 date and what preparation is under way, because a reader who spots a high-risk use you have not acknowledged will read the rest of the pack with suspicion.
The population map follows, showing which groups of people touch which systems and what each group does with them. This is the section that demonstrates calibration, since it connects the training you delivered to the tasks people perform and to the persons on whom the systems are used.
The curriculum section sets out what each population received, with dated versions of the material attached or referenced. Show the baseline module, the role modules, the technical track, the executive session, and the assessment used in each. If a module was updated, show the versions and the trigger for the update, since a programme that changed when a tool gained the ability to browse the web demonstrates active maintenance better than any policy statement.
The delivery record then shows who received what and when, with assessment results rather than only completion flags, and with coverage of joiners, movers, contractors and agency staff. Show the mechanism as well as the numbers, so a reader can see that access is tied to completion rather than trusting a percentage.
The operational controls section carries the acceptable use policy with dated acknowledgements, the approved tool list, the tool request route with typical turnaround, the disclosure rules staff follow under Article 50, and the definition of what “checked” means for each type of work, which is the verification discipline from Lesson 13. This section is what converts training into behaviour, and it is the part that impresses experienced assessors, because anyone can produce slides while few can produce working rules.
The assurance section holds incident and near-miss reports with what happened afterwards, spot checks of AI-assisted work, and any internal audit findings. A pack with three incidents, each investigated and each followed by a change to training or configuration, is stronger than a pack with none. Silence reads as absence of monitoring rather than absence of problems.
Governance closes the pack. Name the owner, show the committee that reviews AI use and literacy coverage, attach the minutes of at least one review, and state the review cycle and the triggers that force an off-cycle review. Add a short forward plan showing what changes before the next milestone, whether that is the marking requirement for pre-existing generative systems on 2 December 2026 or the Annex III obligations on 2 December 2027.
Two habits keep the pack alive. Export the underlying records from any vendor platform at least annually and store them where the organisation controls them. Review the whole pack on a fixed date each year and after every trigger, and record the date of the review even when nothing changed, because an unchanged pack with a recorded review is evidence of a decision while an unchanged pack with no review is evidence of neglect.
Return finally to the words of Article 4, since they are the standard the pack is measured against. The duty is to take measures to ensure, to your best extent, a sufficient level of AI literacy among your staff and other persons dealing with the operation and use of AI systems on your behalf, taking into account their technical knowledge, experience, education and training, the context of use, and the persons on whom the systems are used. A pack that names your systems, maps your people, shows calibrated content, proves receipt and understanding, demonstrates working controls, records incidents and shows senior ownership answers that sentence clause by clause. Building it is a few weeks of work, and after that it is an hour a month. The organisations that struggle in 2027 will not be the ones that lacked resources. They will be the ones that never wrote down which tools their staff were using.