Evidencing AI literacy: documentation that holds up

Article 4 of the AI Act obliges providers and deployers to take measures for sufficient AI literacy. It contains no express documentation duty. In practice, though, what is not documented cannot be proven. When a supervisory authority, a customer running a supplier audit or a court after an incident asks, what counts is what exists in writing.

Other rules also demand accountability explicitly. Article 5(2) GDPR requires controllers to be able to demonstrate compliance with its principles. Under Article 26(2) AI Act, deployers of high-risk systems must assign human oversight to people with the necessary competence, training and authority — something they must be able to show if challenged.

Good documentation has three layers that build on each other. The first is the concept: which AI systems are in use, which groups use them, what level of literacy each group needs and why. This shows that measures are aligned with prior knowledge and context, as Article 4 requires.

The second layer is content: curricula, course materials and assessment questions in the version that applied at the time of training. If you later need to prove what was taught, you need that version, not today's.

The third layer is the individual record: who, when, which course, which result, valid until when. This layer is most often incomplete, because attendance lists live in spreadsheets that nobody reconciles with the training plan.

An individual record should make sense on its own. It names the person, the course with title and version, the completion date, the form of assessment and its result, the issuer and, where relevant, an expiry date. For role-specific training it helps to note the role the training was intended for.

Attendance alone is weak evidence. A short knowledge check shows that content was understood and separates presence from competence. It need not be hard, but it should match the learning objectives.

A signed attendance sheet is better than nothing but hard to analyse and easy to lose. A PDF certificate is more convenient but just as easy to alter. Verifiable digital credentials solve this: a QR code or verification code leads to the issuer's verification page, which shows whether the record is authentic, valid and not revoked. Under open standards such as W3C Verifiable Credentials, the record is also cryptographically signed and machine-verifiable.

For internal purposes a central register in the learning platform is often enough, showing the status per person and course and exportable as a report. For evidence towards third parties — for example customers checking their suppliers' AI literacy — verifiable credentials have the edge, because the checker does not have to trust the organisation but can verify for themselves.

Training records are personal data. Processing them can be justified within the employment relationship, but purpose limitation and storage limitation apply (Article 5(1)(b) and (e) GDPR). A deletion rule aligned with validity and likely evidentiary needs makes sense. Assessment results should not be used for performance appraisal unless this was defined beforehand and, where required, agreed with the works council.

This article explains the law in general terms and is not legal advice. For any individual case, the official text in its current version prevails; if in doubt, consult a lawyer, your data protection officer or the competent supervisory authority.