What exactly does EU AI Act Article 4 require?

Article 4 obliges providers and deployers to take measures that support the development of AI literacy among staff and others operating AI systems on their behalf, taking into account their knowledge, experience, training, and the context in which the systems are used. You do not have to guarantee a particular level for any individual. It is an obligation on the organization, which is why demonstrable training and a record of it matter, not just a one-off message.

What counts as evidence that we meet a training duty?

There is no single mandated format, but a defensible record generally shows who was assigned training, who completed it, when, and tailored to their role and the systems and processes they work with. LearnWize produces certificates, completion logs, and organization-scoped reporting you can present to an auditor, supervisor, or works council.

Is generic AI awareness training enough?

Article 4 asks you to take role and context into account, so a single generic module is hard to defend for people near Annex III high-risk systems or Article 50 transparency duties. Role and sector paths let you match the depth of training to the actual obligation for each group.

How does this support a works council or DPO review?

Reporting is organization-scoped, so you can show activation, completion, and certificate evidence for your own workforce without exposing other customers' data. We also provide a DPA baseline, TOMs, and subprocessor list so privacy and the works council can assess the processing.

Can you map training to our own systems, roles, and risk register?

Yes. We scope obligation-to-role mapping against your AI inventory, Annex III high-risk exposure, and Article 50 transparency duties, and against the training duties from the Dutch Cybersecurity Act (NIS2), the Dutch AML act (Wwft), and DORA that apply to your roles. Request a vendor-readiness briefing and we will tailor it to your register.

The compliance evidence platform

One register, one dossier, one answer when someone asks who is demonstrably trained.

Q: Where is our data hosted and how is privacy handled?

Core platform data is EU-hosted. During vendor review we share a DPA baseline, TOMs, subprocessor list, retention matrix, and security FAQ so your DPO and procurement can complete their assessment before contracting.

Your people get the path their role legally requires: AI literacy under Article 4 of the EU AI Act, board training under the Dutch Cybersecurity Act (NIS2), periodic training under the Dutch AML act (Wwft), and the resilience modules from DORA. Register your AI systems, classify them with the built-in AI Act wizard, and keep everything in one audit-ready dossier.

Four laws

knowledge and training duties proven through certificates, completion logs, and organization-scoped reporting

Annex III + Article 50

case studies across high-risk domains and transparency obligations

EU-hosted

with DPA baseline, TOMs, and subprocessor list for vendor review

The challenges compliance and legal teams face

The questions we hear when a knowledge duty stops being theory and becomes something you have to prove.

Nobody has the overview

Directors fall under the Dutch Cybersecurity Act (NIS2), staff in scope for the Dutch AML act (Wwft) fall under a periodic training duty, and AI tools enter through every department. Without a register you cannot classify, and without classification you do not know your obligations per person.

Training exists, evidence does not

People follow courses, but nothing connects a legal duty to the roles it applies to and the evidence that person can produce.

The request always comes at the wrong moment

An RFP, an audit, a works council question. Assembling evidence then takes weeks. A dossier you maintain takes one click.

"Procurement and the DPO need to sign off before we buy"

Legal and privacy reviews stall rollouts. We provide a DPA baseline, TOMs, subprocessor list, retention matrix, and security FAQ up front, so your vendor review moves instead of waiting on documents.

How we help you make every knowledge duty defensible

From obligation mapping to the audit trail, on one platform.

Obligation-to-role mapping

We map per role what someone legally needs to know: AI literacy under Article 4, board training under the Dutch Cybersecurity Act (NIS2), periodic training under the Dutch AML act (Wwft), and the resilience modules from DORA, set against your AI systems, Annex III high-risk exposure, and Article 50 transparency duties. No generic course, just the obligation that applies to that person.

Evidence and audit trail

Certificates, completion logs, and organization-scoped reporting give you a defensible record of who was trained, when, and against which program, ready for auditor, DPO, or works council review.

Vendor-review pack

DPA baseline, TOMs, subprocessor list, retention matrix, and security FAQ are shared during procurement so privacy and legal can sign off without a months-long back-and-forth.

Free readiness scan

The evidence gap scan

A short scan that shows which roles cannot yet prove their AI literacy is covered, and what evidence you are still missing before an audit.

Self-assessment of your AI literacy per role under EU AI Act Article 4
Evidence gap checklist (certificates, logs, reporting, audit trail)
Annex III high-risk and Article 50 transparency mapping guide
Vendor-review document checklist for procurement and the DPO

No credit card required. We don't share with third parties.

learnwize

The evidence gap scan

13 pages · PDF

Frequently asked by compliance and legal teams

The questions we hear most often from DPOs, risk, and legal in review calls.

Ready to make every knowledge duty demonstrable?

Discuss your evidence dossier. We map the roles and sectors in scope, the knowledge and training duties that apply to your people, your AI systems, and the audit trail your DPO and supervisor expect.

One register, one dossier, one answer when someone asks who is demonstrably trained.

Four laws

knowledge and training duties proven through certificates, completion logs, and organization-scoped reporting

Annex III + Article 50

case studies across high-risk domains and transparency obligations

EU-hosted

with DPA baseline, TOMs, and subprocessor list for vendor review

The evidence gap scan

A short scan that shows which roles cannot yet prove their AI literacy is covered, and what evidence you are still missing before an audit.

Self-assessment of your AI literacy per role under EU AI Act Article 4

Evidence gap checklist (certificates, logs, reporting, audit trail)

Annex III high-risk and Article 50 transparency mapping guide

Vendor-review document checklist for procurement and the DPO

No credit card required. We don't share with third parties.