How to Prove AI Literacy Compliance: The Evidence File Article 4 Actually Requires

Guide2 July 2026· 15 min read

How to prove AI literacy compliance under EU AI Act Article 4: the exact records, logs, policies and assessments that demonstrate it. No certification exists.

There is no certificate to wave at an inspector. Article 4 of Regulation (EU) 2024/1689 (the EU AI Act) sets a duty to act — since 27 July 2026, to take measures to support the development of AI literacy across your staff, without guaranteeing any specific level for any individual — but it names no curriculum, no accredited scheme, and no badge. So compliance is not declared; it is demonstrated, and an authority cannot inspect your intent — only your artefacts. This page sets out the exact records, logs, and policies that prove AI literacy compliance, and how to assemble them into a file you can produce on request.

Why "Proof" Is the Real Question Under Article 4

The obligation has been live since 2 February 2025

Article 4 has applied since 2 February 2025. It is enforceable now — not a deadline on the horizon you can plan around. A national authority can ask, today, to see how you ensure literacy among your staff and the other persons who deal with AI systems on your behalf, and "we are working on it" is not an answer the statute contemplates.

Article 4 is open-textured — proof is how you close it

The clause sets a standard, not a syllabus. Since 27 July 2026 it requires measures to support the development of AI literacy, proportionate to the persons' technical knowledge, experience, education, the context of use, and the people the systems affect. Because the law requires measures and leaves the method to you, the burden it creates is evidentiary. You close the open question by showing what you did — who you trained, to what depth, when, and how you keep it current. The scope reaches your own staff and other persons dealing with AI systems on your behalf, so contractors and outsourced operators sit inside the file too.

Why this is not delayed by the Digital Omnibus

Not everything is delayed, and Article 4 is one of the things that is not. The Digital Omnibus, adopted in June 2026 — the European Parliament passed it in plenary on 16 June 2026 and the Council adopted it on 29 June 2026 — defers the stand-alone high-risk Annex III timelines (Article 6(2)). It does not postpone the literacy duty, though it did replace Article 4's text with a softer duty. It was published in the Official Journal on 24 July 2026 and in force since 27 July 2026, and the high-risk dates now run to 2 December 2027 (stand-alone Annex III) and 2 August 2028 (Annex I product-embedded). None of that postpones Article 4, which has bound you since February 2025. The thesis of this guide follows from that: build the file now.

What an Authority or Auditor Would Actually Ask to See

Market-surveillance authorities supervise Article 4

Supervision of provider and deployer obligations, including Article 4, sits with national competent and market-surveillance authorities designated under Articles 70 and 74. Those authorities can request information and documentation, and the request is where an abstract duty becomes a concrete demand for paper. The question is never "are your people literate?" in the abstract — it is "show me."

The questions behind the request

Strip a literacy inspection to its logic and four questions sit underneath it. Did you identify who needs literacy? Did you deliver something proportionate to their role and the risk they carry? Can you show it happened, to named people, on dated occasions? And do you keep it current as systems and staff change? Every artefact in the next section exists to answer one of these. A file that cannot answer all four reads as a programme with gaps, whatever the underlying effort.

Why a verbal assurance is not evidence

The proof standard is contemporaneous and attributable: records created at the time, tied to named individuals and roles, beat any retrospective reconstruction. There is a second, sharper reason to take record quality seriously. Supplying incorrect, incomplete, or misleading information to an authority in reply to a request is itself a separate, lower-tier infringement under Article 99(5) — distinct from the underlying literacy duty. So a sloppy or backfilled file does not just fail to prove compliance; it can create a fresh exposure of its own.

The Six Artefacts That Demonstrate AI Literacy Compliance

Six concrete documents make up a defensible file. Each answers a different auditor question, and a gap in any one is a gap an inspector will find.

1. The AI literacy policy

The policy is the documented standard that turns the open-textured Article 4 duty into a defined internal rule — the why and the what. It states who is responsible, which roles are in scope, what the target competence is for each band, and how the programme is governed. Without it, every other artefact is an activity with no stated objective.

2. Role-based curricula mapped to your AI inventory

Role-based curricula prove the programme was proportionate. Article 4 names the factors — technical knowledge, experience, education, context of use, and affected persons — so your training content must visibly differ by role and risk. Mapping each curriculum back to the AI systems in your inventory shows the depth was matched to the stakes, not applied as a flat module to everyone.

3. Training delivery and attendance logs

Delivery and attendance logs prove the training reached the named people who use or oversee AI systems — the it happened, to these people evidence. Dated, name-attributed, and tied to the curriculum delivered, these logs are the spine of the file.

4. Assessment or comprehension checks

Assessment records prove outcome, not just exposure. A signed attendance sheet shows someone was in the room; a short comprehension check with a recorded pass threshold shows the measure worked. This is the artefact that distinguishes attendance from literacy.

5. Refresh and onboarding cadence records

Refresh and onboarding records prove literacy is maintained rather than treated as a one-off. A written cadence — annual refresh plus an onboarding hook for new joiners and an ad hoc trigger when you adopt a materially new system — with last-completed and next-due dates per role, shows the file is alive.

6. Governance sign-off and review minutes

Governance minutes prove ownership and periodic review. A dated sign-off — typically annual — links literacy to the human-oversight competence required of deployers under Article 26(2) and to the design-side oversight obligations of Article 14 for high-risk systems. It is the artefact that shows a named owner, not an orphaned spreadsheet.

Evidence Map: Auditor Question to Artefact to Source Article

How to read the table

Read each row as a question an inspector asks, the artefact that answers it, what a "good" version of that artefact looks like, and the Article that grounds the demand. The map is also a self-audit: work down the rows against your own file.

Auditor question	Artefact that answers it	What "good" looks like	Grounding article
Who needed literacy?	AI inventory + role mapping	Every role touching an AI system is listed	Article 4
Was it proportionate?	Role-based curricula	Content differs by role and risk	Article 4
Did it happen?	Attendance / completion logs	Dated and name-attributed	Article 4
Did it work?	Assessment results	Pass thresholds recorded	Article 3(56)
Is it current?	Refresh schedule + onboarding records	Defined cadence, last and next dates	Article 4
Who owns it?	Governance review minutes	Annual sign-off	Articles 26(2) / 14
Can you produce it on request?	Indexed evidence file	Retrievable on demand	Article 99(5)

Filling the gaps in your own file

Treat any empty cell as an open finding to remediate before an authority asks, not after. A file that answers six of the seven questions but cannot be produced on demand still fails the last row — and that row carries its own Article 99(5) exposure. Index the file so any single artefact is retrievable within minutes, because the request, when it comes, is rarely patient.

Worked Example: Building the Evidence File at a 140-Person Insurer

The starting position

Consider Meridian Mutual, a 140-person regional insurance company. It is a deployer, not a provider: it runs a third-party AI claims-triage tool and an internal customer chatbot, but builds neither. Training existed — managers had walked teams through the triage tool informally — but nothing was documented, attributable, or dated. In evidentiary terms, the literacy was effectively unprovable. If a market-surveillance authority had asked, Meridian had a story and no file.

What they assembled

Over one quarter Meridian built the file in order. It started with an AI inventory, then mapped its 140 staff into four literacy bands: executive sponsors, claims operators who use the triage output, oversight and compliance reviewers, and general staff with incidental exposure. It wrote a one-page policy fixing those bands and a named owner. It delivered band-specific sessions, logged attendance on dated sheets, and ran a short comprehension check with a recorded pass mark. Finally it set a 12-month refresh with onboarding hooks for new joiners and a trigger for any new system.

What their evidence file looked like after 90 days

Ninety days in, Meridian held a single indexed evidence file: policy v1.0, the role-mapping matrix, four dated attendance sheets, the assessment scores, and a governance sign-off minute — producible in full if an authority requested it. The instructive part is the proportionality. The claims operators, who rely on AI output for decisions affecting customers, got the deepest training and the strictest comprehension check, while general staff got a short awareness session. That gradient is exactly the proportionality Article 4 demands, and for the claims operators it doubles as evidence of the competence their Article 26(2) oversight role requires.

The Honest Truth: There Is No Article 4 Certification

No badge, stamp, or accredited scheme exists

No. There is no certification, conformity assessment, or accredited mark for AI literacy anywhere in the EU AI Act. Article 4 establishes none, and no body issues an "Article 4 certificate." Any product or course marketed as conferring one is describing something that does not exist in the Regulation.

What this means for how you defend compliance

Because there is no external attestation to lean on, the burden of proof sits entirely with your organisation. You defend compliance with your own internal evidence trail — the six artefacts above — not with a third-party certificate. This is liberating and demanding in equal measure: no scheme to pass, but no scheme to hide behind either. Keep the distinction from high-risk conformity assessment clear. Article 43 conformity assessment and CE marking are separate regimes that apply to high-risk AI systems, not to the Article 4 literacy duty.

Beware vendors selling 'certified' literacy

A course-completion certificate from a training vendor is genuinely useful — it is solid evidence that delivery happened, and it belongs in your attendance records. But it is not "Article 4 certification," because no such thing exists. Treat any vendor claim that it sells one with caution, and file the certificate for what it actually proves: that a named person completed a named course on a named date.

Penalties: What Failing to Evidence Literacy Can Cost

Where Article 4 breaches sit in the penalty regime

Article 4 is not in the prohibited-practices tier. Penalties follow the general obligation regime under Article 99, set and enforced by Member States. For reference, the ceilings are: up to €35 million or 7% of total worldwide annual turnover, whichever is higher for prohibited practices (Article 99(3)); up to €15 million or 3% of total worldwide annual turnover, whichever is higher for most other obligation breaches (Article 99(4)); and up to €7.5 million or 1% of total worldwide annual turnover, whichever is higher for supplying incorrect, incomplete, or misleading information to authorities (Article 99(5)).

The separate risk of poor record-keeping

The record-keeping angle is the one most organisations miss. Even where the underlying literacy effort was reasonable, giving an authority incorrect or misleading information about it is its own infringement under Article 99(5). That is a second, independent reason the evidence file must be accurate and contemporaneous — a backfilled or inflated record can convert a defensible position into a fresh breach.

Proportionality and the realistic risk picture

For SMEs and start-ups, Article 99(6) caps each fine at the lower of the percentage or the fixed amount, not the higher — proportionality is built into the penalty design. The realistic near-term risk, though, is less a standalone Article 4 fine and more that thin literacy evidence surfaces during a broader inspection — say, of your high-risk obligations — and undermines your overall credibility. Authorities read a missing literacy file as a proxy for how seriously you take governance generally.

How Confir Helps

Confir is the system of record for the six artefacts above. It structures your AI inventory, holds the role-to-literacy mapping and the policy, and assembles the dated attendance, assessment, and governance records into a single indexed file that is retrievable on request — the producible-on-demand standard Article 99(5) implies.

The synthesis logic is deterministic and rule-based: the same system profile and role mapping produce the same file structure and the same refresh triggers every time — the same logic every time, no model inference, no hallucination. It surfaces gaps against Article 4's named factors rather than generating compliance for you, and the maintenance loop — refresh cadence, onboarding triggers, governance review reminders — keeps the file current instead of letting it go stale after the first round.

Frequently Asked Questions

How do you prove AI literacy compliance under the EU AI Act?

You prove it with a documented evidence trail, because Article 4 sets no certification scheme. The core artefacts are a written AI literacy policy, role-based training curricula mapped to your AI inventory, dated and name-attributed attendance or completion logs, comprehension checks, a refresh and onboarding cadence, and governance sign-off minutes. Together these show an authority that you identified who needed literacy, delivered something proportionate to their role and risk, confirmed it happened, and keep it current. Verbal assurances do not count; contemporaneous, attributable records do.

Is there an official AI literacy certification under Article 4?

No. The EU AI Act creates no certification, accredited scheme, or official badge for AI literacy. Article 4 requires measures to support AI literacy proportionate to people's roles (it no longer asks for a guaranteed 'sufficient level'), but it does not prescribe a curriculum or an external attestation. Certification and CE marking under Article 43 apply to high-risk AI systems, not to the literacy duty. A training vendor's completion certificate is useful evidence of delivery, but it is not 'Article 4 certification' — treat any vendor claiming to offer that with caution. The burden of proof rests with your own internal records.

What records do auditors want to see for AI literacy?

An auditor or market surveillance authority typically wants to see the documents that answer six questions: who needed literacy (your AI inventory and role mapping), whether training was proportionate (role-based curricula), whether it actually happened (dated attendance and completion logs), whether it worked (assessment results), whether it stays current (refresh schedule and onboarding hooks), and who owns it (governance review minutes). The strongest evidence is contemporaneous, tied to named individuals, and producible on request, since incomplete or misleading information to an authority is itself an infringement under Article 99(5).

Is the Article 4 AI literacy obligation delayed by the Digital Omnibus?

No. Article 4 has applied since 2 February 2025 and is fully in force. The Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, defers the high-risk timelines — chiefly stand-alone Annex III systems, now 2 December 2027. It does not postpone the literacy obligation, though it replaced Article 4's text with a softer duty. Either way, AI literacy is something you must already be able to demonstrate.

What happens if you cannot prove AI literacy compliance?

Article 4 sits in the general obligation regime, not the prohibited-practices tier. Penalties are set and enforced by Member States and follow Article 99, which caps most obligation breaches at up to EUR 15 million or 3% of worldwide annual turnover (Article 99(4)). Separately, giving an authority incorrect or misleading information about your literacy efforts can trigger fines up to EUR 7.5 million or 1% under Article 99(5). For SMEs and start-ups, Article 99(6) caps the fine at the lower figure. In practice, the near-term risk is thin literacy evidence weakening your position during a broader inspection.

Who needs to be covered by your AI literacy evidence?

Article 4 covers your own staff and other persons dealing with AI systems on your behalf, such as contractors and outsourced operators. Your evidence file should map every role that uses, configures, or oversees an AI system, then show proportionate literacy for each. Staff who rely on AI output for decisions, or who provide human oversight, warrant the deepest coverage, because their competence also supports oversight duties under Articles 26(2) and 14. General staff with incidental exposure need lighter, awareness-level coverage. The mapping itself is part of the proof that your programme was proportionate.

How often should AI literacy training be refreshed for the evidence to hold up?

Article 4 does not name a fixed interval, so the defensible answer is a documented cadence proportionate to how fast your AI use changes. A common pattern is an annual refresh plus onboarding training for new joiners and ad hoc updates when you adopt a materially new system or use case. What matters for proof is that the cadence is written down, with last-completed and next-due dates recorded per role, so an authority can see literacy is maintained rather than treated as a one-off event. An undated, one-time session is weak evidence.

Manage your EU AI Act compliance in one place

Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.

Start free trial →