In spring an HR manager at a care organisation put the entire organisation through an AI course. Three hundred and forty staff, 96 per cent attendance, the attendance lists neatly filed. In September she sits opposite the auditor, who leafs through the folder and asks one question: how do you know it makes any difference to the day-to-day work?
The answer lies in three kinds of evidence. Training and attendance show that you told people what they need to know. AI rules and policy for each role show what was decided and what is expected of whom. Behaviour during everyday work, in aggregated figures, shows what happens next. None of the three is enough on its own, and the third is usually missing.
What is the auditor actually asking?
Not "did you train people?", because the answer is in the folder. The question is whether the measure does what it is meant to do. Article 4 of the AI Act asks for measures aimed at a sufficient level of AI literacy among the people who use AI systems, matched to their role and context. What that involves is set out in AI literacy in 2026. The key point for this piece: no certificate is prescribed, and the European Commission confirms in its questions and answers on Article 4 that your own record of the measures taken is enough.
That is good news, but it only shifts the question from "which document?" to "what does this document actually prove?" An auditor asks that of every document you put on the table.
Three kinds of evidence side by side
| Kind of evidence | What it shows | What it does not show |
|---|---|---|
| Training and attendance (attendance list, course materials, test) | That on a given day people were told what is and is not allowed | What they do afterwards, and whether the course suited their role |
| AI rules and policy for each role (register with statuses, instructions for each system, who decided what) | That the organisation thought it through and made decisions, and that those decisions are traceable | Whether those decisions reach the employee when it matters |
| Behaviour during everyday work (aggregated figures on notices and highlights) | Whether the decision was visible when someone opened a tool, and what happened next | What happens beyond the reach of the measurement, and why someone made the choice they did |
The three complement each other because each describes a different moment. The first covers the day of the course, the second the moment the organisation decided. The third covers the ordinary working day, which is what Article 4 is really about.
Why an attendance list only covers the day of the course
A course raises awareness. What people do a month later, under time pressure, with a tool that did not exist on the day of the course, is another matter. Knowledge fades and habit wins; that is no criticism of employees, just how people work. Why that is so is covered in our article on why awareness training does not change behaviour.
As evidence, then, an attendance list says exactly one thing: on that day, this group heard this. That has value: without that foundation, everything else achieves less. But it is a statement about the day of the course. The auditor asks about the Monday after, and on that the list is silent.
How do aggregated figures fit in?
The third kind of evidence is the least familiar and most often absent: figures that describe what happens when someone opens an AI tool and what happens when a text contains sensitive data. Not who, but how often and with what outcome.
When the organisation has made a decision about a tool, that decision appears in the browser. Every time such a notice is shown, it can be counted along with what the person did: opened the approved alternative or carried on anyway. For highlighted sensitive data, the outcome is counted too: masked, removed or sent regardless. And the share of AI use going through approved tools can be tracked over time.
Those figures carry no user ID, so they describe the organisation and never a person, which is exactly why they belong here. The auditor does not want to know who carried on, but whether the organisation's decision was there while people were working and how often they acted on it. That is the question the attendance list cannot answer.
