In this article
- What Does the EU AI Act Require You to Record?
- What the European Commission has confirmed
- Why keep an AI literacy documentation record?
- What Should an AI Literacy Documentation Record Contain?
- 1. AI inventory and your role
- 2. The risks people need to understand
- 3. The groups of people and their existing knowledge
- 4. The measures you chose, and why
- 5. What was delivered, when and to whom
- 6. Contractors and service providers
- 7. Separate human oversight records for high-risk AI systems
- 8. A review log
- How Do These Records Map to the Law?
- What Should You Avoid Over-Recording?
- Individual test scores
- Certificates as the only proof
- Unnecessary personal details
- Can You Copy an Example From the Commission’s Repository?
- What applies in Germany?
- Works council involvement
- Who can ask to see the records?
- How Does AnnexOps Help With AI Literacy Documentation?
- Ready to organise your AI literacy documentation?
- Author: Nitin Grover
AI literacy documentation under Article 4 of the EU AI Act does not require a prescribed template or a certificate. The European Commission confirms that organisations can keep an internal record of training or other guiding initiatives. Providers and deployers must still take appropriate measures to support AI literacy, taking account of people’s knowledge, experience, education, training and the context in which AI systems are used.
So, what should a company record? A useful starting point is to document the AI systems relevant to the organisation, the role they play, the groups of people who interact with those systems, the measures selected and the reasons behind those decisions.
Some of these records help explain how the organisation approached AI literacy. Others, such as records needed for human oversight of high-risk AI systems, relate to separate legal obligations. It is important to distinguish between the two.
For the legal background, read our complete guide to AI literacy training under Article 4. To understand who may need AI literacy measures, see who needs AI literacy training under the EU AI Act. For a practical task list, use our AI literacy training checklist.
Want to keep your AI literacy documentation organised?
AnnexOps AI Compliance Software helps teams connect training records with relevant AI systems and supporting evidence.
What Does the EU AI Act Require You to Record?
What the European Commission has confirmed
Article 4(1) requires providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among relevant staff and other people dealing with AI systems on their behalf. The applicable approach depends on the circumstances. The Commission’s guidance also explains that Article 4 does not prescribe one universal training programme or a standard certificate.
Four points are particularly relevant to documentation:
- No prescribed certificate: The Commission confirms that Article 4 does not require an AI literacy certificate. An internal record of training or other guiding initiatives can be used.
- No universal knowledge test: Organisations are not generally required by Article 4 to measure every employee’s AI knowledge.
- No mandatory governance structure: Article 4 does not require every organisation to appoint a dedicated AI officer or establish a specific governance board.
- Context matters: Organisations should consider people’s technical knowledge, experience, education and training, along with the context in which AI systems are used.
You can review the Commission’s AI literacy guidance and its AI Literacy Questions and Answers.
Why keep an AI literacy documentation record?
Article 4 does not prescribe a standard recordkeeping template. The Commission’s published Q&A also does not identify a general retention period for Article 4 records. Organisations should therefore establish a suitable retention policy after considering their other legal obligations and internal requirements.
Keeping a record is a practical way to explain the organisation’s approach. It can help teams identify which measures they selected, who they intended to reach and whether the measures need updating.
The record may also be useful when a competent authority examines the organisation’s approach. It should not be treated as automatic proof of compliance: the quality and suitability of the measures still matter.
The Commission’s published Q&A gives inconsistent dates for the start of Article 4 supervision and enforcement, referring to both 2 August and 3 August 2026. Article 4 already applies. Organisations should consult the latest Commission guidance and the relevant national market surveillance authority for clarification of the applicable enforcement position.
What Should an AI Literacy Documentation Record Contain?
Article 4 does not require every organisation to maintain all the records listed below. The Commission confirms that an internal record of training or other guiding initiatives can be sufficient as a recordkeeping approach. The following framework adds practical documentation recommendations to help organisations explain their decisions and maintain supporting evidence.
The Commission’s guidance considers four areas: general understanding of AI, the organisation’s role, the risks associated with its systems, and the measures chosen in light of people’s knowledge and the context of use. The recommendations below build on those considerations.
1. AI inventory and your role
Start by identifying the AI systems relevant to your organisation. Record each system’s purpose, its business owner, and whether your organisation acts as a provider, deployer or both.
This inventory helps establish the context for AI literacy measures. A company developing an AI product may need to address different issues from a business using a third-party system for recruitment, customer service or internal operations.
An inventory and role record are practical ways to organise this information. Article 4 does not itself prescribe a particular inventory format.
2. The risks people need to understand
Consider the risks associated with each system and how those risks affect the people who develop, operate or use it. For example, staff using an AI tool to support recruitment may need guidance on its limitations, appropriate human review and the risks of relying on inaccurate outputs.
A structured AI risk classification tool for EU AI Act workflows or an EU AI Act compliance checker may help teams begin organising their assessment. Any classification result should be checked against the system’s intended purpose, actual use and applicable legal criteria.
Documenting the risk considerations that informed a training decision is a practical recommendation. Article 4 does not create a universal requirement to produce a separate formal risk assessment for every AI system solely for AI literacy purposes.
3. The groups of people and their existing knowledge
Article 4 asks organisations to consider people’s technical knowledge, experience, education and training. Their working context also matters.
For documentation purposes, it can be useful to identify groups such as:
- Everyday users who interact with AI tools.
- Managers who review AI-supported decisions.
- Developers and technical teams who build or maintain AI systems.
- Contractors and other people who work with AI systems on the organisation’s behalf.
Record the relevant assumptions about each group’s responsibilities and learning needs. Group-level planning can often explain why a particular measure was selected without collecting unnecessary individual knowledge scores.
This is a recommended documentation method, not a prescribed Article 4 template.
4. The measures you chose, and why
Record the learning measures selected for each relevant group and the reason for choosing them.
Depending on the context, measures might include introductory training, practical demonstrations, instructions on responsible use, guidance on AI limitations or role-specific learning activities. A technical team may need different material from employees who use an AI assistant for routine office tasks.
The Commission’s guidance emphasises that organisations should consider their circumstances rather than assume that one approach fits every person or system.
A short explanation of the decision can be valuable. For example, a team may choose practical exercises because employees use AI-generated outputs in customer-facing work. The record should explain the connection between the working context and the selected measure.
5. What was delivered, when and to whom
A dated delivery log is a practical way to record what actually happened.
It can include the date, the relevant group, the topic covered, the format used, and the person or team responsible for delivery. Where appropriate, keep a reference to the materials used.
This delivery log is our recommendation, not a separate record format explicitly mandated by Article 4. It helps distinguish planned activities from those that have actually taken place.
Keep the information proportionate to the purpose. Avoid collecting personal information that the organisation does not need.
6. Contractors and service providers
Article 4 also covers relevant people dealing with AI systems on behalf of providers and deployers. This means organisations should consider contractors and other external contributors where their work involves the relevant systems.
The appropriate measures depend on the person’s responsibilities and the context in which they work with AI. A contractor who configures an AI system may have different learning needs from a service provider whose staff use an AI-enabled tool during routine work.
Record how these groups were considered and why the selected approach was appropriate. Where contracts allocate training responsibilities, check that the arrangements reflect the actual working relationship and applicable requirements.
7. Separate human oversight records for high-risk AI systems
Article 26 establishes additional requirements for deployers of high-risk AI systems. These include assigning human oversight to natural persons who have the necessary competence, training and authority.
Where Article 26 applies, retain the records needed to demonstrate how the relevant oversight arrangements are organised. These records should be connected to the organisation’s wider AI governance process but kept distinguishable from the general Article 4 literacy record.
See Article 26 of the EU AI Act for the applicable legal wording.
8. A review log
A review log can show when the organisation reconsidered its AI literacy measures and why changes were made.
For example, a review may follow the introduction of a new AI system, a change in intended purpose, a new group of users or an incident that reveals a gap in existing guidance.
Article 4 does not prescribe a universal review interval. Setting a review date and defining triggers for earlier reviews are practical recommendations. The schedule should reflect the organisation’s systems, activities and the pace at which relevant circumstances change.
How Do These Records Map to the Law?
The table distinguishes relevant legal considerations from practical documentation recommendations.
| Record | What it helps demonstrate | Basis |
| AI inventory and role | Which systems are relevant and the organisation’s role | Practical recommendation informed by Commission guidance |
| Risk considerations | Which system risks influenced the selected measures | Commission guidance and practical recommendation |
| Groups and prior knowledge | How relevant people’s experience and knowledge were considered | Article 4(1) and Commission guidance |
| Measures and rationale | Why particular literacy measures were selected | Article 4(1) and Commission guidance |
| Delivery log | What was delivered, when and to whom | Practical recommendation |
| Contractor considerations | How relevant external people were considered | Article 4 scope and Commission guidance |
| High-risk oversight records | Who is responsible for oversight and whether they have the required competence, training and authority | Article 26, where applicable |
| Review log | When measures were reviewed and whether changes were needed | Practical recommendation |
The table is a working framework, not an official EU AI Act template. Organisations should adapt it to their circumstances and other applicable legal requirements.
What Should You Avoid Over-Recording?
Good documentation should help the organisation explain its approach. Collecting more information does not automatically make that approach more effective.
Individual test scores
Article 4 does not generally require organisations to measure every employee’s AI knowledge. Individual scores are therefore not a universal Article 4 requirement.
If an organisation decides to collect individual assessment results for another legitimate reason, it should consider the purpose, necessity, access controls and retention arrangements. Employee-related records may contain personal data, so the organisation should involve its data protection function where appropriate.
Certificates as the only proof
A certificate may show that a person attended or completed a course. It does not, by itself, explain why the organisation selected that course, whether it was suitable for the person’s role or how the organisation considered the risks associated with its AI systems.
Keep certificates where they serve a useful purpose, but do not assume that certificates alone establish that the organisation has taken appropriate AI literacy measures.
A concise, dated record that explains the organisation’s decisions can be more useful than a lengthy policy that is never reviewed.
Unnecessary personal details
Avoid adding personal information simply because a documentation template offers a field for it. Record what is necessary to explain the organisation’s approach, demonstrate relevant activities and meet applicable obligations.
Set access and retention rules that reflect the sensitivity of the information and any other legal requirements that apply.
Can You Copy an Example From the Commission’s Repository?
The AI Office maintains a repository of AI literacy practices that organisations can consult when developing their own measures.
These examples can help teams explore different approaches to AI literacy. However, the Commission explains that replicating an initiative from the repository does not automatically establish compliance or create a presumption of compliance.
Use the examples as a starting point. Consider your own systems, the people who interact with them and the risks relevant to your organisation. Then record why the selected measures fit that context.
The goal is not to reproduce someone else’s programme word for word. The goal is to develop measures appropriate for your organisation and keep a useful record of the decisions behind them.
What applies in Germany?
Works council involvement
In Germany, AI literacy initiatives may raise works council consultation or co-determination questions under the Betriebsverfassungsgesetz, depending on how training is organised and whether employee-related monitoring is involved.
Sections 96–98 address aspects of vocational training and employee participation. Specific obligations depend on the proposed measures and circumstances. Employers should assess the applicable requirements with German employment counsel before introducing the programme.
Who can ask to see the records?
Under Germany’s KI-MIG, the Bundesnetzagentur serves as the default market surveillance authority, subject to statutory exceptions and sector-specific responsibilities.
Other authorities may have responsibilities for particular regulated sectors or systems. Organisations should confirm which authority is relevant to their activities rather than assume that every AI system falls under the same regulator.
See our guide to Germany’s EU AI Act competent authorities for further context.
How Does AnnexOps Help With AI Literacy Documentation?
A spreadsheet may be sufficient for a small team managing a few AI systems. As the organisation adds systems, suppliers, users and training activities, maintaining consistent records can become more difficult.
AnnexOps AI Compliance Software helps organisations organise AI system information, risk classification, compliance activities and supporting evidence. Its AI Literacy Compliance Tracker can support teams in connecting training activities with relevant AI systems and maintaining records for review.
These workflows can help teams see what has been documented and where information may need updating. They do not decide which literacy measures are legally sufficient for every organisation.
As an EU AI Act compliance platform, AnnexOps supports broader AI governance and compliance operations. The organisation remains responsible for selecting appropriate measures, reviewing its circumstances and obtaining legal advice where needed.
Ready to organise your AI literacy documentation?
AnnexOps can help teams connect training activities to AI systems and maintain a clearer record of their approach.
Author: Nitin Grover
Nitin Grover is an AI compliance strategist and writer focused on EU AI Act compliance, AI governance, Annex IV documentation, AI risk management, and AI compliance operations for AI startups, SaaS companies, and enterprise AI teams across Europe.
