Article 4 of the European AI Act says that organisations providing or using AI systems must ensure a sufficient level of AI literacy among their staff. What the article does not say: how you should document that, which certificate you need, or which system you must use. There is no legally required register and no mandatory diploma.
So why keep records at all? Simple: if a question ever comes, from a regulator, a client, a works council or just your own board, you do not want to stand there empty-handed. An obligation you cannot show anything for is hard to defend in practice. This article explains what to log, which formats work, and how long to keep it.
What do you record?
The core of a good record is that an outsider can reconstruct what your organisation did to make staff AI-literate. That means at minimum:
- Who: which employees completed training? Name or staff number, role or department. Also track who has not been trained yet, because that is just as relevant.
- What: which training or learning material? Keep a short description of the content: which topics were covered, how long it took, whether there was a test or formal completion.
- When: the completion date. A record without dates is worth little, because AI literacy is not a one-off event.
- Result: was the training completed, was an exam passed, was a certificate issued? A verifiable certificate strengthens your file, even though it is not legally required.
- Refreshers: AI changes fast. Record when knowledge was refreshed or when that is scheduled. A file from 2025 with no update since will raise questions all by itself.
If you want to go one step further, also record why you chose this approach: which AI systems does your organisation use, which roles carry the most risk, and how does the training match that? Article 4 talks about literacy that fits the context in which AI is used. A short note explaining that reasoning makes your file far more convincing than a list of names alone.
Which format works?
There is no prescribed format, so pick what fits the size of your organisation. Three levels that work in practice:
1. The spreadsheet
For small teams, a simple spreadsheet is fine. One row per employee, columns for training, date, result and planned refresher. Add a tab with a short description of the training content and your reasoning. Biggest pitfall: the spreadsheet nobody maintains. Assign one owner, for example whoever already manages personnel files.
2. The HR system
If you already use an HR package with a training module, simply register AI training there, next to first-aid and other mandatory courses. The upside: it follows joiners and leavers automatically, and reminders for repeat training are often built in.
3. The LMS dashboard
If your staff follow an online course, a learning platform (LMS) automatically tracks who completed what and when. A dashboard with per-employee progress and issued certificates is the most complete form: your record builds itself while people learn. Teams training through a team licence usually get such an overview included.
Rule of thumb: the best system is the one that is still accurate in two years. A simple spreadsheet that gets maintained beats any sophisticated dashboard that nobody uses.
Certificates as evidence
Once more: article 4 does not require a certificate. But a certificate with a public verification page makes your record more robust, because the evidence does not only live in your own administration. Anyone can independently check that it is genuine and when it was issued. How that works is covered in our article on Open Badges and verifiable certificates. In your file, at least store the verification link or certificate number per employee.
How long do you keep it?
Here too, the AI Act sets no specific retention period for training records. So you are in the familiar tension between accountability and the GDPR, which says you should not keep personal data longer than necessary. A practical line:
- Keep records at least for as long as someone is employed, because the obligation to maintain literacy is ongoing.
- After someone leaves, align with the retention period you already apply to training data in personnel files, and document that choice in your processing register.
- Aggregated data without names, such as “in 2026, 92% of the team completed the training”, can be kept longer for accountability without GDPR complications.
A record is not the goal
Let’s be honest: a perfect record of a poor training is worth nothing. The goal of article 4 is that people genuinely understand what AI can do, where it goes wrong and how to use it responsibly. The record is the trail that effort leaves behind, not the other way round. So start with good training, and let the paperwork follow from it as automatically as possible.
A practical plan for this month:
- Map which AI tools are used in your organisation, including the unofficial ones.
- Decide who needs training and at what level.
- Choose a record-keeping format that fits your size and assign an owner.
- Schedule the first training and the first refresher right away.
Want to see what a course with built-in record-keeping and verifiable certificates looks like? Have a look at the AI literacy course or try the free module first, no strings attached. For teams there is a licence with a progress overview, so your record builds itself.