What an inspection asks for to accept your AI training
Having trained your staff and being able to prove it are two different things, and only the second counts before an authority. What constitutes evidence, what does not, and how long to keep it.
Most companies that take Article 4 seriously organise a session, deliver it, and consider the matter closed. Months later, when someone asks in writing, they discover they cannot show what was taught, to whom, or whether those people understood any of it. Having trained and being able to prove it are different problems, and before an authority only the second one exists.
Why the Regulation gives no list
Let us be plain: the Regulation publishes no checklist of evidence. Article 4 sets an outcome — a sufficient level of AI literacy — and leaves each organisation to choose the means. That openness is deliberate, because an architecture practice is not a hospital.
What we do know is how market surveillance authorities work when verifying an outcome-based obligation: they ask for traceability. Not «did you train?» but «show me what, to whom, when, and with what result».
The four data points that turn a claim into proof
- Who: individual identification of each person trained. An attendance sheet with no names, or «the department was trained», identifies nobody.
- What: the specific content, referencing Article 4 and the risks it covers. The title of the session is not enough.
- When: a verifiable date. Training delivered after the incident under investigation carries a very different evidential weight from training delivered before it.
- With what result: some form of check that the person absorbed the content. That is what separates having attended from having learned.
What usually falls short
A memo announcing that the Regulation exists. A recorded video with no record of who watched it. A scanned signature sheet with no content attached. An internal AI usage policy, which is a useful measure but evidences rules, not competence. All are better than nothing, but none answers the four questions above.
The problem with editable evidence
Here is a nuance almost nobody considers. A PDF certificate with a name and a date is a document anyone can edit. If the evidence you produce can be altered without leaving a trace, its evidential value is limited precisely when you need it most.
That is why accreditation should be independently verifiable: a queryable register where a third party can confirm that the code exists, belongs to that person, and has not been modified since issue. A cryptographic hash over the certificate data serves that function: any later change to the name, date or score breaks verification.
Frequently asked
How long must evidence be retained?
The Regulation sets no period for Article 4. As a prudent benchmark: while the person remains employed, and for the applicable limitation period afterwards. Aligning it with what you already do for occupational health and safety is sensible.
Does training have to be repeated periodically?
The text imposes no frequency. But the obligation is to maintain a sufficient level, and tools change quickly: training from three years ago on systems nobody uses any more hardly sustains a claim that the current level is sufficient.
Does training provided by the tool vendor count?
It can form part of the evidence, but it usually covers operating the product rather than the risks, the limits, or the Regulation's obligations. The question to ask is whether that material answers the four questions above.
What about new hires?
They fall within scope from the moment they start using AI in their work. Onboarding is the natural point to train, and it leaves a clean documentary trail tied to their start date.
How we solve it
Everyone who passes our training receives a named certificate with a unique code and a SHA-256 hash computed over their real data, including the score of each exam. That code is checked against a public register: any auditor, client or authority can verify it without asking you for anything. And the company dashboard exports the full dossier for your workforce — who, what, when and with what result — which is exactly what gets asked for.
This article is general information based on the text of Regulation (EU) 2024/1689. It is not legal advice and does not replace consulting a qualified professional: assessing a specific case depends on circumstances an article cannot capture.
Want to know whether Article 4 applies to you, and from when?
Take the free assessment