An HR manager at a care organisation put the whole organisation through an AI course in spring. Three hundred and forty staff, 96 percent attendance, the attendance lists neatly filed. In September she sits across from the auditor, who leafs through the folder and asks one question: how do you know it works in the work itself?
The answer consists of three kinds of evidence. Training and attendance show that you explained to people what they need to know. Agreements and policy per role show what was decided and what is expected of whom. Behaviour at the moment of work, in aggregated figures, shows what happens afterwards. None of the three is enough alone, and the third is usually missing.
What is the auditor actually asking?
Not "did you train", because that is in the folder. The question is whether the measure does what it is meant to do. Article 4 of the AI Act asks for measures towards a sufficient level of AI literacy among the people who use AI systems, matched to their role and context. What that involves is set out in AI literacy in 2026. The core for this piece: no certificate is prescribed, and the European Commission confirms in its questions and answers on Article 4 that your own record of the measures taken suffices.
Good news, but it only moves the question from "which document" to "what does this document actually prove". An auditor asks that of every document you put on the table.
Three kinds of evidence side by side
| Kind of evidence | What it shows | What it does not show |
|---|---|---|
| Training and attendance (attendance list, material, test) | That people received an explanation on a given day of what is and is not allowed | What they do afterwards, and whether the explanation fitted their role |
| Agreements and policy per role (register with statuses, instruction per system, who decided what) | That the organisation thought it through and decided, and that decisions are traceable | Whether those decisions reach the employee at the moment it matters |
| Behaviour at the moment of work (aggregated figures on notices and highlights) | Whether the decision was visible when someone opened a tool, and what happened next | What happens outside the reach of the measurement, and why someone chose what they chose |
The three complement each other because each describes a different moment. The first is about the day of the course. The second about the moment the organisation decided. The third about the ordinary working day, which is the moment Article 4 is ultimately about.
Why an attendance list is about the day of the course
A course makes people aware. What they do a month later, under time pressure, with a tool that did not exist on the day of the course, is a different question. Knowledge fades and habit wins, and that is not a reproach to the employee but a property of people. Why it works that way is covered in awareness training makes people aware, it does not change their behaviour.
For the evidence this means an attendance list says exactly one thing: on that day, this group heard this. That is valuable, because without that basis the rest helps less. But it is a statement about the day of the course. The auditor asks about the Monday after, and then the list is silent.
How do aggregated figures fit in?
The third kind of evidence is the least familiar and most often absent: figures that describe what happens when someone opens an AI tool and what happens when sensitive data is in a text. Not who, but how often, and with which outcome.
For a tool that has a decision, that decision appears in the browser. Every time such a notice is shown, it can be counted with what the person did: opened the approved alternative, or continued anyway. For sensitive data that got a highlight: masked, removed, or sent regardless. And the share of AI use that runs through approved tools has a trend.
Those figures carry no user id, so they describe the organisation and never a person, which is exactly why they belong here. The auditor does not want to know who continued, but whether the organisation's decision was present at the moment of work and how often people acted on it. That is the question the attendance list cannot answer.
