What Article 4 AI literacy asks you to do at any risk level
If your organization uses AI tools, Article 4 of the EU AI Act probably already applies to you, whatever risk level those tools fall into. Article 4 has applied since 2 February 2025 and covers providers and deployers of every AI system, not only high-risk ones. As reworded by Regulation (EU) 2026/1744, the duty is to take measures that support the AI literacy of your staff and of others who operate AI on your behalf, such as contractors. The Act does not require you to guarantee any specific level of literacy for any individual, so the test is whether your measures are reasonable and documented, not whether every employee passes a benchmark.
The risk this duty targets is ordinary misuse and misreading of AI output: a recruiter who treats a ranking score as a verdict, a support agent who pastes customer data into an unapproved chatbot, or an analyst who trusts a generated summary without checking its sources. Literacy measures are meant to help people understand what a tool can and cannot do, when its output needs human review, and what to do when something looks wrong. Start by listing every team and external party that operates AI tools for you, then confirm with counsel which of your uses also fall under the high-risk rules, since those add role-specific duties under Article 26(2).
The duty is hard to evidence for three reasons. The Commission's AI literacy questions and answers state that there is no mandatory training format and no certificate to obtain, so there is no ready-made checklist to follow. Training records are also often scattered across an LMS, a shared drive and team chat threads. The Commission's guidance says organizations can keep internal records of training and other literacy initiatives, and that relying only on a vendor's instructions for use is often not enough. Decide early who owns the records, what each one must show (audience, content, date, and the AI tools covered), and where they will be kept, because a national market surveillance authority will ask for them. Confirm the current guidance on the single information platform before you finalize your approach.
Which teams, systems and third parties Article 4 covers
Article 4 applies to providers and deployers of every AI system, whatever its risk level, so the scoping question is less about which systems are in and more about which people operate them. The cards below separate the decisions that set scope: the reach of the Act, the systems in your inventory, the people who work with them and the third parties who act on your behalf.
Providers and deployers of all AI systems
Article 4 has applied since 2 February 2025 and is not limited to high-risk systems. A provider that places any AI system on the EU market and a deployer that uses one in the EU both carry the duty, including for systems the organization classifies as minimal risk. Confirm your role for each system, because the same product can make you a provider for one use and a deployer for another.
Non-EU firms whose output reaches the EU
The Act reaches providers and deployers established outside the EU when the AI output is used in the EU. A US or Asian company whose scoring, recommendation or content output is used by EU customers or staff can owe Article 4 duties even with no EU office. Ask legal counsel to confirm where each output is used, not only where the model is hosted.
Staff and others operating AI
The duty covers staff and others operating AI on the organization's behalf, not only employees who hold a formal AI role. Customer support agents, analysts, managers who approve AI-assisted decisions and anyone who configures or monitors a tool all fall in scope. Map each role to the systems it touches, since literacy needs differ between a prompt author and a reviewer of automated outputs.
Contractors and outsourced operators
Contractors, agencies and outsourced service teams that run AI systems for you are operating AI on your behalf, so they need to be covered by your literacy measures. Your contracts should state who delivers training, what records they keep and how you verify completion. Do not assume a vendor's instructions for use will satisfy this duty on their own.
Scope changes with the AI inventory
Scope is set system by system. Each AI system added to your inventory can bring new roles, new users and new contractors into Article 4, and retiring a system can remove some of them. Keep the inventory linked to a current list of people who operate each system, so that a new tool or a reassigned team member does not leave a gap in the literacy record.
Evidence that proves who was covered
Where an organization can show who operated each system and what literacy measures reached them, the scope decision becomes auditable. Internal records of training and other initiatives are one way to keep that link, and a training log tied to role and system is more useful to a regulator than a general attendance list. Check that records follow people as roles and systems change.
How a supervisor tests Article 4 evidence
This table compares what a national market surveillance authority is likely to check under Article 4, the evidence that answers each check, and the findings that usually come up when the evidence is weak. Read it as a pre-audit checklist: each row pairs a test with the record a reviewer would ask to see. The main takeaway is that a training certificate alone rarely answers the question, which is whether measures fit each role and each AI system the organization actually runs.
| Supervisory test | Evidence the supervisor expects | Common finding |
|---|---|---|
| Review the AI system inventory | A current list of AI systems the organization provides or deploys, with the business owner and the roles that operate each one | Inventory missing, out of date, or limited to high-risk systems, so staff using other AI tools are never in scope |
| Ask for records of training and other initiatives | Dated records of courses, briefings, workshops and onboarding, with attendee lists kept internally | No records kept, or records that show attendance only with no content or learning outcome |
| Check fit to each role and system | Evidence that measures differ for developers, managers, HR staff, customer teams and others operating AI, based on the systems they use | Identical generic training for every employee regardless of the AI systems their work involves |
| Check the link to actual AI use | Training content that references the organization's own tools, use cases, data and known limits | Training that covers AI in general terms and does not mention the systems staff use day to day |
| Test reliance on vendor instructions | Evidence that staff understood the vendor's instructions for use and that the organization added its own measures | Instructions for use filed as the only literacy measure, which the Commission's Q&A says is often not enough |
| Check coverage of others operating AI | Records or contract terms showing measures for contractors and others who run AI on the organization's behalf | No measures for contractors or temporary staff who operate AI systems for the organization |
| Check that measures are current | Evidence of refresh or update when systems, use cases or roles change | One-time training delivered at go-live and never repeated after new systems were added |
How to build an AI literacy program that passes review
This sequence takes an organization from an inventory of who operates AI to a program that can show a reviewer what was taught, to whom, how understanding was checked, and when the program changed. Each step produces a record that an assessor or market surveillance authority can inspect.
Map AI systems and the people who operate them
Start with the AI systems your organization provides or deploys, including tools bought from vendors and systems built on third-party models. For each system, list the staff, contractors and others who operate it or make decisions based on its output. The output is a role matrix that ties each system to the roles using it, so you can see who falls under Article 4 and at what depth. Confirm the list with system owners and procurement, because shadow AI use is often missed. The step is complete when every operating role has at least one system attached to it.
Set literacy measures for each role
For each role in the matrix, define what that person needs to understand to operate the AI safely: what the system does, its limits, when to question an output, and who to escalate to. A developer, a recruiter using a screening tool and a customer support agent using a chatbot will need different measures. Record these as a curriculum note per role group, citing the system and the duties it carries. The step is complete when every role has a written set of measures that a reviewer can compare against the matrix.
Deliver training and other initiatives
Run the measures through the format your organization chooses, such as instructor-led sessions, e-learning, walkthroughs of the system, or on-the-job coaching. The Commission's Q&A states there is no mandatory training format, so the choice is yours, but it should match the role. Keep the course outline, materials and version history. Relying only on a vendor's instructions for use is often not enough, so add context specific to your own deployment. The output is a delivery record for each initiative.
Record completion for each learner
Log who received which measure, when, and in what form. A learning management system can do this automatically. For example, Moodle's activity completion can mark an activity complete when a learner views it, receives a grade, or ticks it manually, depending on the conditions you set. Choose the completion condition deliberately, because viewing a page does not show understanding. The Commission's Q&A says organizations can keep internal records of training and other initiatives. The output is a completion record per person and per role, retained under your document retention rules.
Check understanding and close gaps
Test whether people can apply what they were taught. Use short scenario questions, supervised practice on the system or a sign-off by a line manager. Where someone cannot demonstrate the expected understanding, assign follow-up measures and record the result. The Article 4(1) wording as replaced in 2026 does not require any specific level for any individual, so the aim is evidence of reasonable measures, not a guaranteed outcome. The output is an assessment record and a gap log showing what was remediated and when. Deployers of high-risk systems also need to check the competence of staff given human oversight under Article 26(2).
Keep the program current with AI use
Set a trigger for review whenever a system is added, materially changed, reassigned to a new role, or its risk profile shifts. Also review when the Commission, Member States or the AI Board publish practical examples or recommendations under the amended Article 4. Update the role matrix, measures and records, and note the change in the program log. The output is a dated change log linked to the role matrix. A reviewer should be able to follow each system from its inventory entry through its training history.
Evidence that shows AI literacy measures were taken
The Commission's AI literacy Q&A says organizations can keep internal records of training and other initiatives, and that instructions for use alone are often not enough. The cards below cover the records worth keeping and the routines that keep them accurate between audits, since a supervisor will ask what was done, for whom, and when it was last reviewed.
Training records by person
Keep a register that ties each staff member and each contractor operating AI on your behalf to the AI literacy measures they completed, with the date and the content version. Record who was in scope when the training was delivered, so a later role change does not erase the history. Check that the register covers people who left the organization during the period, since a supervisor may ask about them. Confirm that the record reflects what was delivered, not only what was scheduled.
Attendance and completion logs
Export completion data from your learning platform on a fixed schedule rather than relying on a single snapshot. In Moodle, activity completion marks an activity complete when a learner views it, receives a grade, or ticks it manually, depending on the conditions set for that activity. Decide in advance which condition counts as completion for each course, and document it. A tick alone shows attendance, not understanding, so pair logs with other evidence where the role is higher risk.
Role-based curricula
Map the AI literacy content to the roles that use each AI system, such as recruiters using a screening tool, customer staff using a chatbot, or engineers building on a model. Article 4 does not prescribe a training format or a specific level for any individual, so the curriculum should show why each role needs what it receives. Store each curriculum version with its approval date and the systems it covers. A curriculum that does not name the systems in use is hard to defend.
Briefings and team communications
Keep records of briefings, team meetings, and written notices about the AI systems in use, including the date, the audience, and the material shared. Short briefings often carry the practical guidance that matters most, such as limits on input data or when to escalate an output. Record attendance or distribution for each briefing. Where a notice changes how people should use a system, store the earlier notice as well, so you can show what staff were told at each point.
Records of initiatives beyond training
The Commission's Q&A recognizes AI literacy initiatives beyond formal training. Examples include internal guidance pages, reference sessions, peer review channels, and help desk procedures. Record what each initiative is, who owns it, when it started, and what it changed. Organizations that publish guidance on a wiki can rely on version control to show what each version said and when it changed, as XWiki does for every page change. Confirm that your platform keeps that history before you depend on it.
Review dates and inventory links
Set a review date for each record set and assign an owner who confirms it on that date. Link every training record and curriculum to the entries in your AI system inventory, so a change to a system triggers a check on who needs refreshed training. Use a permission model that limits who can edit these records while still letting auditors read them. In BookStack, permissions can be set by role and overridden at the shelf, book, chapter, or page level. Confirm how your own platform sets those rights.
What meeting Article 4 costs in money and effort
This table breaks down the cost components of an Article 4 AI literacy program, showing who is paid for each, whether it is one-time or recurring, and what drives it up. Use it to build a quote request, since no supplied source gives prices or durations for these items.
| Cost component | Who carries the cost | One-time or recurring | What drives it |
|---|---|---|---|
| Course design or licensing | Internal L&D team, or an external trainer or e-learning vendor | One-time build, with recurring licence fees if bought | Number of distinct roles, languages, and AI systems covered |
| Staff time for learners | Each employee or contractor who completes the training | Recurring with every new hire and each refresh | Headcount, role mix, and how many people operate AI on the organization's behalf |
| Content owner time | Product, risk, or HR staff who write role-specific material | Mostly one-time, with updates when AI use changes | Number of AI systems in use and how often their functions or vendors change |
| Records upkeep | Compliance or learning administrators | Recurring, as completions and initiatives are logged | Volume of records and whether tracking runs in a self-hosted learning platform or manually |
| Periodic refresh | Content owners and learning administrators | Recurring, triggered by new AI tools, model changes, or policy updates | Pace of AI adoption and the number of systems that need new guidance |
| Turnover backfill | Managers and new joiners | Recurring, driven by staff movement | Attrition rate in roles that operate AI systems daily |
| External review or delivery | Outside consultant or trainer, paid under a written scope | Usually one-time for review, recurring if delivery is outsourced | Internal skills, depth of role-specific content, and the need for an independent view |
Who owns AI literacy, who can help and what an auditor checks
Article 4 applies to every provider and deployer of an AI system, whatever its risk level, so the duty sits with your organization and cannot be delegated away. Your team decides who operates AI for you, what each group needs to understand, and who signs off on the program. Ownership works best when one accountable executive is named and each function holds a clearly defined part of the work.
- Role matrix: List every group that builds, buys, configures, supervises or uses AI, including contractors and vendors acting on your behalf, and record the knowledge each group needs for its job.
- Content owners: Assign a named owner for each training module or guidance note, usually from legal, security, HR or the business unit that uses the system.
- Records: Keep a register of who completed what, when, and on which version of the material, along with any assessments or attendance evidence.
- Review cycle: Set a schedule to refresh content when a system changes, a new AI tool is introduced or the regulation is amended.
Confirm internally who owns each row of the role matrix before any outside partner starts work, because gaps in ownership are the first thing an auditor will notice.
An implementation partner can help you design the program and prepare the systems that hold its evidence. DeployOpen works in this preparer role: it plans and builds the program structure, prepares record templates, and sets up learning and documentation platforms inside your own infrastructure. DeployOpen does not issue audit reports, attestations or certificates, and it does not decide on your behalf what your staff must know. Those decisions remain with your organization.
- Program design: Map roles to learning paths, draft the outline of each module and agree the success criteria with your content owners in a written, fixed scope.
- Record templates: Prepare templates for completion logs, attendance, assessments and sign-off so that each record shows the person, the content version and the date.
- LMS setup: Configure a learning platform such as Moodle so that activity completion is tracked per learner, and document how the settings produce the records.
- Knowledge base: Set up a self-hosted wiki or documentation tool, such as XWiki or BookStack, with version history and role-based permissions for policies and instructions for use.
- Handover: Document the configuration, runbooks and ownership so that your team can operate the program after the engagement ends.
Ask any partner to state in writing which tasks it performs, which remain with your staff, and that it will not issue any assurance report.
An independent auditor, assessor or regulator tests whether the program exists and works. The Commission's AI literacy Q&A states that national market surveillance authorities, not the AI Office, supervise and enforce Article 4 as of 2 August 2026, and that no certificate is required. An assessor therefore looks at what you did and how you can prove it, rather than at a badge. Auditors never design the program for you, because doing so would remove their independence.
- Test of design: Checks whether roles, content and responsibilities match the AI systems your organization actually uses.
- Test of operation: Samples staff records to confirm that the right people completed the right material on time.
- Evidence quality: Looks for dated, attributable and versioned records, such as completion logs and change history, rather than only a policy statement.
- Instructions for use: Notes that the Commission's Q&A says relying only on vendor instructions is often not enough.
- Competence for oversight: For high-risk deployments, checks the separate duty under Article 26(2) that people assigned to human oversight have the necessary competence, training and authority.
Before an assessment, confirm which authority supervises your organization and what sample of records it is likely to request.
Open-source platforms that record AI literacy evidence
Can Moodle show that staff completed AI literacy training?
Yes, Moodle can record completion of training activities for each learner, which is the kind of record the Commission's Q&A says organizations can keep. Moodle's activity completion marks an activity complete when the learner views it, receives a grade from it, or ticks it manually, depending on the conditions set for that activity. That distinction matters for evidence. A completion flag set by viewing a page shows access, not understanding, so pair completion with a short assessment or a documented acknowledgment where you need proof of comprehension. Confirm the completion rules, retention settings and reporting you need in your own Moodle version and hosting setup before you rely on them.
How does XWiki version history help prove AI literacy policies?
XWiki keeps every change to a page under version control, so you can show what a training policy or curriculum said at a given time, who changed it and when. You can compare any two versions and roll back to an earlier one. This supports the Commission's point that organizations should keep internal records of their AI literacy initiatives. Version history shows how the curriculum evolved, which helps when an assessor asks what staff were taught during a past period. It does not prove that the content was delivered or understood, so link each curriculum version to the training records that used it. Confirm the retention and backup arrangements in your own deployment.
How does BookStack control who can change AI literacy documents?
BookStack assigns user abilities through roles, and you can override permissions per role at the shelf, book, chapter or page level. In practice, this lets one group edit AI literacy materials, another group read them, and everyone else see nothing they do not need. Controlled documentation of this kind supports accountability: an assessor can see who was authorized to publish guidance to staff. Set up the roles to match your governance model, and document who approves changes. Check that the permission model meets your access requirements in your own environment, since the controls only protect what they are configured to protect.
Which AI literacy records should these platforms hold?
Store the records that show what was done, for whom and under which approved content. Useful categories include:
- Training catalogue and curriculum versions, kept in XWiki with change history
- Learner completion and assessment results, recorded in Moodle
- Approved guidance and role-based access rules, managed in BookStack
- Records of staff who operate AI on behalf of the organization, so coverage can be checked
Keep the link between these records clear, for example by referencing curriculum version numbers in completion reports. The Commission's Q&A does not prescribe a format, so agree the structure with your compliance lead and confirm it against your own legal and audit requirements.
Does using Moodle, XWiki or BookStack make us Article 4 compliant?
No. No tool certifies compliance with the AI Act, and the Commission's Q&A states that no certificate is required for AI literacy. Article 4 requires measures to support AI literacy, and the organization owns those measures and the decisions about them. These platforms only help store and show evidence of measures you have designed. National market surveillance authorities supervise Article 4 from 2 August 2026, and they will look at whether your measures are appropriate for your staff and AI use, not at which software you chose. An independent auditor does not certify AI literacy either, so treat any vendor claim that a tool certifies compliance with suspicion.
Who sets up and maintains these platforms for an organization?
The organization owns its training program and records, while an implementation partner can plan, install, configure and document the platforms inside your own infrastructure. DeployOpen works this way for self-hosted open-source platforms, delivering fixed-scope work agreed in writing before it starts, and it can support them under a retainer afterward. DeployOpen does not issue reports or certificates, and it does not decide what your staff must learn. Your internal owners remain responsible for content, learner assignments and approvals. Ask any partner to state in writing what they configure and what your team must still run.
What does it cost to run these platforms for AI literacy records?
The cost has two parts: the one-time setup and the recurring operation. Setup covers planning, installation, role design, course configuration, and documentation, and it is usually priced from a written scope. Recurring costs include hosting, backups, upgrades, staff time to maintain courses and content, and support. Software licensing is not the main variable, since all three platforms are open source, but confirm the license terms you need for your use. No supplied figure sets a price for this work, so ask any provider for a quote that lists each component, who performs it, and which costs recur each year. DeployOpen does not publish a price list, and a quote follows from the written scope.
What should we verify before relying on these platforms for evidence?
Confirm that each platform's version, configuration and hosting meet your evidence needs before an assessor asks. Check that completion settings match the proof you require, that version history and backups are retained for the period your records must cover, and that role-based permissions reflect your approval chain. Test a sample record end to end: an assessor should be able to trace a policy version to the training completions that followed it. Also confirm how records are exported and who can access them. If any of these points are unclear for your environment, verify them with your platform administrator or implementation partner before you rely on the records.
Where AI literacy programs usually fall short
Article 4 asks for measures that support AI literacy across every AI system an organization provides or deploys, so the gaps that matter are the ones that separate training from the systems and people it is meant to cover. The cards below describe where programs usually break down and what to check before an assessor asks.
Relying on vendor instructions
Many programs consist of forwarding a vendor's instructions for use and calling the job done. The Commission's AI literacy Q&A says that relying only on instructions for use is often not enough. Check whether staff learn how the system behaves in your context, including its limits, known failure modes and when a person must step in. Pair each vendor document with internal guidance on your own use cases and record who was briefed on what.
No link to the AI inventory
Training is often planned by course catalog rather than by the AI systems people actually touch. Each system in your inventory should name the roles that use, configure, monitor or act on its output, and those roles should map to a training path. Without this link, an assessor cannot see whether the people operating a given system were covered. Review the mapping whenever the inventory changes.
Undocumented contractors and vendors
Article 4 extends to others operating AI on the organization's behalf, which commonly includes contractors, outsourced service staff and consultants. Programs often cover employees only, leaving third parties outside any record. Check contracts for an AI literacy clause, request confirmation of the training their people received, and keep those confirmations with your own training records.
Records limited to formal training
Briefings, team walkthroughs, pilot reviews, internal newsletters and one-to-one coaching often shape how people use AI, yet they rarely leave a trace. The Commission's Q&A says organizations can keep internal records of training and other AI literacy initiatives. Log these activities with date, audience, content owner and outcome, so the record reflects how literacy was supported, not just who attended a course.
No review after new AI systems
A program approved for last year's tools may not cover a new assistant, an updated model or a feature that changes how outputs are used. Set a trigger that reopens the training plan whenever a system is added, materially changed or moved into a new business process. Record the review decision even when no new training is needed, so the timeline of AI literacy measures matches the timeline of deployments.
Training with no evidence trail
Completion data stored in a learning platform can be lost when a tool is replaced or a contract ends. Self-hosted platforms can keep this evidence under your control. In Moodle, activity completion can be set so a learner is marked complete when they view an activity, receive a grade or tick it manually. Choose the completion condition that reflects real understanding, and keep the export with your governance records.
Common questions about Article 4 AI literacy
Do we need an AI literacy certificate to comply with Article 4?
No. The Commission's AI literacy questions and answers state that no certificate is required. Article 4 asks providers and deployers to take measures that support AI literacy among staff and others who operate AI on their behalf, and an assessor will look for those measures and the records behind them. Certificates from a training vendor may be useful internal evidence, but they are not a legal requirement and do not replace a documented, role-based approach. Confirm the current Commission guidance on the AI literacy questions and answers before you design your program.
Does Article 4 require a specific training format or course?
No. The Commission's AI literacy guidance states that there is no mandatory training format. You can use classroom sessions, e-learning, short briefings, workshops, job aids or on-the-job guidance, or combine them. What matters is that the measures fit the technical knowledge, experience, context and the people affected by each AI system in use. Relying only on the vendor's instructions for use is often not enough, so pair any format with role-specific material that explains the system's limits, risks and the decisions staff must make.
How long does AI literacy work take, and what drives the cost?
No general duration or price applies, because the Act does not set one. The effort depends on how many AI systems your organization provides or deploys, how many roles touch them, how varied the risk levels are, and how much material already exists. Costs fall into staff time for content development and attendance, the cost of any external content or facilitation, and the time to keep records current as systems change. Ask any provider for a written scope listing the roles, systems, formats and records it will cover, and ask which parts are one-time and which recur each time a system or role changes.
What do our internal staff need to contribute to the program?
Internal staff own the program's substance. Compliance or legal teams should define which obligations apply, while product, data science and IT owners should describe each AI system's purpose, limits and known failure modes. HR or learning teams usually run enrolment and records. Managers should confirm who operates each system and what they need to know. Your staff also decide what counts as adequate understanding for each role, which is a judgment the Act leaves to the organization. Plan time for these people early, because the training content is only as accurate as the system knowledge behind it.
Can our own team design and run AI literacy measures without a partner?
Yes. Article 4 does not require outside help, and many organizations handle it internally with an existing learning platform and a documented inventory of AI systems. The work is mainly governance and record keeping, which internal teams can do if they have a clear owner and time to maintain it. A partner may help if you lack a current AI system inventory, need a self-hosted learning platform that keeps completion records under your control, or want an independent review of whether your records would satisfy an assessor. Make the decision by checking your staff capacity and your records, not by assuming a partner is required.
Does Article 26(2) add AI literacy duties for high-risk deployers?
Yes, for deployers of high-risk AI systems, Article 26(2) requires that human oversight be assigned to people with the necessary competence, training and authority. This sits on top of the general Article 4 duty, which applies to all AI systems regardless of risk. In practice, the oversight owner needs training that covers the system's intended use, its limits and how to intervene, and you should record that they hold the authority to act. Confirm the dates that apply to high-risk obligations under the 2026 amendments before you set deadlines for these roles.
What records show that we met the AI literacy duty?
Keep records of who was trained, on which AI systems, in which format, when, and what they were expected to understand. The Commission's guidance says organizations can keep internal records of training and other AI literacy initiatives. Useful evidence includes training catalogues, role-to-system mappings, attendance or completion logs, dated versions of course content, and a log of updates made after systems change. Self-hosted learning platforms such as Moodle can record activity completion per learner, and wiki tools such as XWiki keep version history for policy pages. Confirm with your assessor which records they will request.
Who enforces Article 4, and what happens if we fall short?
National market surveillance authorities enforce Article 4 from 2 August 2026, according to the Commission's AI literacy guidance, rather than the AI Office. Enforcement details, including penalties, are set out in the Act's penalty provisions, so check the current text of Article 99 and the national rules in each Member State where you operate. The practical risk is a finding that your organization lacks documented measures for its staff, which is hard to defend if records are missing. Build the evidence trail as you go rather than reconstructing it during an inquiry.
How DeployOpen prepares AI literacy evidence
DeployOpen helps organizations put AI literacy measures in place inside their own infrastructure, using self-hosted open-source platforms that record training and related activity. The organization owns its AI literacy program and decides what staff must learn, while DeployOpen prepares the systems, records and documentation that show the measures were taken.
How we scope
- Written scope agreed before work starts, listing which AI systems, teams and roles the Article 4 measures cover
- Inventory of who provides or deploys AI and who operates it on the organization's behalf
- Agreed deliverables, such as training catalogs, learning paths and evidence records, documented in the scope
How we build
- Configure a self-hosted learning platform, such as Moodle, to track completion of AI literacy activities per learner
- Set up a documentation wiki or knowledge base with version history for role-specific AI guidance and training materials
- Configure role-based permissions in a tool such as BookStack so access to AI guidance matches each role
How we hand over
- Deliver the configured platforms, completion records and version histories inside the client's own environment
- Provide documentation of how each record was produced, so assessors and market surveillance authorities can follow it
- Confirm with the organization which evidence it keeps internally and which records its legal team needs to retain
How we support
- Engagements are fixed-scope, and changes to scope are agreed in writing before work continues
- Ongoing support, upgrades and maintenance of the platforms are available as a retainer
- Ask the organization's counsel to confirm the AI literacy measures meet its obligations, since DeployOpen does not issue compliance opinions
