Documenting and Evidencing AI Literacy Training
Article 4 requires organisations to take measures. A measure that leaves no trace is indistinguishable, from the outside, from a measure that was never taken, so documentation is not administrative overhead added to compliance. It is the compliance.
The test to design against is a reconstruction test. If an authority, a customer’s assurance team or your own auditor asked in March 2028 what a named employee had been taught about AI before they made a particular decision in November 2026, could you answer? Answering that question requires linked records, meaning a record of the systems in use at that time, a record of which population that employee belonged to, a record of the training content as it stood on that date, and a record that the employee received it and understood it.
Start with the system register, because everything else hangs from it. For each AI system record its name and version, the business owner, the supplier, whether you are provider or deployer, the intended purpose stated by the supplier, the actual use in your organisation, the populations that touch it, and the date it entered service. When a system is retired, keep the record rather than deleting the row, since evidence about a past period needs the register as it was then.
The training register is the second artefact. For each person record the modules completed, the version of each module, the date, the role-specific material they received, and the result of any check of understanding. Completion alone is weak evidence and is the most common gap. A quiz result, a scenario exercise, an assessed exercise or a manager sign-off converts a completion into evidence that the person can do something, which is what Article 3(56) asks for when it speaks of skills, knowledge and understanding rather than attendance.
Version control of materials is the third, and it is the one organisations forget until they need it. Training decks are edited continuously and platforms often show only the current version. If your material in November 2026 said one thing about tool approval and today it says another, you need the November version to answer a question about November. Keep dated copies of every module, including the slide packs, the scripts, the assessment questions and the policy documents referenced.
Coverage records are the fourth. Article 4 covers staff and other persons acting on the organisation’s behalf, so your evidence must show that joiners are trained before they get access rather than in the next annual cycle, that contractors and agency staff are covered by something even when they sit outside your learning platform, and that people who change roles receive the material for the new role. Access provisioning is a useful control point, because tying tool access to completion of the relevant module produces both the behaviour and the evidence automatically.
Refresh evidence is what turns a one-off event into a programme. Record why and when material was updated, and tie updates to triggers rather than only to the calendar. Useful triggers include a new tool being approved, a significant change in an existing tool’s capability such as gaining the ability to browse or to act through connected services, an incident, a regulatory change such as the arrival of the Article 50 duties on 2 August 2026, and a change in how a team uses a system.
Alongside training records, three other sources make an evidence pack persuasive. The acceptable use policy, with dated acknowledgements, shows the rules people agreed to. Incident and near-miss reports show a culture in which people notice and report, and a small number of reported incidents handled properly reads far better than silence. Governance minutes showing that a named committee or executive reviewed AI use and training coverage show that somebody senior owns this.
Retention deserves a decision rather than a default. Keep records long enough to cover the periods a claim or investigation could reach back to, which for employment-related systems can be years. Balance that against data protection principles, since a training register is personal data about employees, and keep only what serves the purpose. Storing quiz answers for a decade is rarely justified, while storing the fact and date of completion usually is.
Two failure patterns are worth naming. The first is evidence that exists only inside a vendor’s platform your organisation may stop paying for, which is why exports should be taken and stored independently at least annually. The second is a pack that shows volume rather than fit, meaning thousands of completions of a module that never mentions the tools your staff actually use. An assessor reading such a pack learns that you bought training, not that your people are competent, and Article 4 asks about the second.
The practical target is modest. An organisation should be able to produce, within a working day, a document that names its systems, describes its populations, lists what each received and when, shows how understanding was checked, and shows what has changed since. That document is the subject of the final lesson of this course.