AI literacy compliance checklist for HR and L&D

An AI literacy checklist helps HR and L&D teams document the systems people use, the roles exposed to AI, the development each group needs, and the evidence kept afterwards. The evidence log brings those decisions together in one record, with dates, assessments, owners, and review points.

This guide is general information, not legal advice. Take advice on your own exposure.

What should an AI literacy checklist for HR and L&D cover?

An AI literacy checklist for HR and L&D has eight steps: inventory AI systems in use, map roles to exposure, define the literacy level each role needs, choose role-based training inside real work, run cohorts with dates, log evidence per person and cohort, review at milestones and system changes, and report to the board. The full checklist and template follow.

1. Which AI systems are your people using?

Start with an inventory of the AI systems used across the organisation.

Include approved standalone tools, AI features built into existing workplace software and general-purpose systems employees use for work. Record the system, the teams using it and the main use cases.

Do not make this a theoretical list of every AI product the company owns. The useful question is where AI is already part of people’s work and where its outputs matter.

This inventory becomes the starting point for deciding which roles need development.

2. Which roles have the greatest AI exposure?

Map people to the systems and use cases you identified.

Look at what employees actually do with AI, how frequently they use it, and what happens with the output. A person drafting internal notes faces a different context than someone using AI for analysis, customer work, or decisions that affect other people.

The purpose is not to label every role as high or low risk. It is to understand where different levels of knowledge, judgement and support are needed.

3. What level of AI literacy does each role need?

Article 3(56) of the EU AI Act defines AI literacy as the skills, knowledge, and understanding needed to use AI systems responsibly and recognise opportunities, risks, and potential harms.

Article 4 also requires providers and deployers to consider technical knowledge, experience, education, training and context of use.

Turn that into a practical expectation for each role. Write down what people need to understand, where judgement matters, and what they should be able to do after development.

4. Does the training fit the work people actually do?

Choose development that reflects the roles and use cases you mapped.

A common foundation can be useful across the organisation, but people who use AI differently will often need different examples, practice and depth.

Where possible, connect development to real or realistic tasks. Someone may understand a principle in a course and still struggle to apply it in their own work.

The objective is not simply to deliver training. It is to give people development that makes sense for the situations they encounter.

5. Can you show who received what training, and when?

Deliver development in identifiable cohorts or groups and keep a clear record.

At minimum, record who participated, the role or cohort, what development they received, and the date. If different teams receive different training, preserve that distinction in the evidence.

This makes it easier to answer a basic governance question later: what did this group need at the time, and what did the organisation do about it?

Avoid relying on one aggregate completion percentage that hides those differences.

6. What evidence do you need to keep?

Regulators and auditors look for a record, not a certificate. Keep an evidence log showing which AI systems are in use, which roles are exposed, what literacy level each role needs, who completed which training and when, how capability was assessed, and when the next review is due. Store it with dates and owners so it can be produced.

A completion record can sit inside that evidence, but it should not be the whole story.

Where development is assessed, record the assessment method and result. If you track capability over time, keep the baseline and later assessment together so the change can be understood rather than inferred from attendance alone.

7. When should the checklist be reviewed?

Do not treat the evidence log as something created once and filed away.

Review it when the organisation introduces a new AI system, expands an existing use case, changes a role materially, or moves AI into work with different consequences.

You may also choose a regular internal review date so ownership does not drift.

The current Article 4 does not prescribe a fixed annual or quarterly training cycle. Your review cadence should follow how AI use changes inside the organisation.

8. What should you report to the board?

Keep the board view focused on decisions and change rather than a long list of courses.

Useful reporting can show which AI systems are in use, which parts of the workforce have been mapped, what development has taken place, what evidence is available and which areas still need attention.

If capability is assessed, show how it is changing at team or cohort level.

The aim is to give leaders a useful view of workforce readiness and the decisions that need to follow.

What should the AI literacy evidence log contain?

Field	What to record
AI system	The system or tool in use
Use case	How it is used in work
Role or cohort	Who uses it
Exposure and context	How the system or its output affects the work
Required literacy	What the role needs to understand or be able to do
Development delivered	Course, workshop, practice, coaching or other activity
Date	When the development took place
Assessment	How understanding or capability was checked
Evidence	Completion record, assessment result or other supporting record
Owner	Who is responsible for the record
Next review	When the decision should be reviewed

Frequently asked questions

Is this checklist enough for Article 4?

No checklist can determine an organisation’s legal position on its own. These steps provide a practical way to document the systems, roles, development and evidence relevant to AI literacy. Article 4 is context-based, so organisations should assess their own exposure and take legal advice where necessary.

Who should own the evidence log?

Ownership should sit with a named person or function that can keep the record current. In many organisations, HR or L&D may manage development records, while legal, risk, compliance, IT or business teams contribute information about systems, use cases and responsibilities.

How often should we update the evidence log?

Update it when something material changes, such as a new AI system, a new use case, a significant role change, or different people becoming responsible for AI-enabled work. A regular internal review date can also help ensure that the record remains current.

Does a certificate of completion count as evidence?

It can be part of the evidence, but a certificate shows that an activity was completed. It does not by itself explain why that development was appropriate for the person’s role, what was assessed or how the organisation considered the context in which the AI system is used.

Do contractors count as staff?

Article 4 refers to staff and other persons dealing with the operation and use of AI systems on behalf of providers and deployers. That wording can extend beyond direct employees depending on the arrangement and activity. Assess the people actually operating or using AI on the organisation’s behalf.

What if we only use Copilot or ChatGPT?

Using general-purpose AI does not remove the need to understand who is using it, for what work, and what development is appropriate. Start with the actual use cases and roles involved. The relevant literacy will depend on the context, responsibilities, and how AI-generated outputs are used.