Step-by-step
Five steps from inventory to repetition, with what you concretely have to be able to show at each one. The whole checklist is on this page, nothing sits behind a form.
01 · The plan
Step 01
Which AI systems are in use
Which AI systems are in use, by whom and for what. The official list holds Copilot and perhaps a translation service; the real list also holds the free ChatGPT accounts, the AI feature in the HR suite and the plug-in someone found handy.
Step 02
What fits which job
Article 4 asks for a level appropriate to role, context and risk. A lawyer having a contract summarised runs a different risk than someone tidying meeting notes. This is the step most organisations skip, and exactly where a uniform programme falls short.
Step 03
The base plus what each role needs
The knowledge base for everyone, the ninety-minute e-learning, plus whatever a role additionally needs. Where the matrix leaves an area pale, a targeted session is added.
Step 04
The file you still have a year later
Who did what and when, and did the level actually change. That last part is what almost nobody has, and the only thing that shows the difference between offering training and it working.
Step 05
A date for the next round
The systems change and new people arrive. Set a date for the next round now, because without it your file will in a year be a snapshot of something that no longer exists.
02 · The file
Five documents. Not five folders, five documents that hold up are stronger than a forty-page policy nobody has checked.
01
Name, vendor, who uses it, for what, and whether it arrived through procurement or around it. Don't only ask IT: the shadow list sits with the teams.
02
Why one group needs more than another, backed by something other than instinct. A five-minute measurement per employee produces this as a matrix.
03
With names and dates. This is where an attendance list does have value, because here it's about attendance rather than level.
04
The same questions, 60 days later. This is the part almost nobody has and the only one showing the level actually changed, including when it disappoints.
05
The systems change and new people arrive. Without a repeat date, in a year your file is a snapshot of something that no longer exists.
03 · Where it goes wrong
Starting at step three. Buying a training feels like progress and is, but without steps one and two you can't explain afterwards why that training was the right one.
What happens then is the same at nearly every organisation. A programme was purchased, there's an attendance list, and the question of whether it was sufficient gets a hesitant yes. That's not bad faith: the list feels like evidence. It just proves attendance, and the obligation is about literacy.
The repair is cheaper than redoing it. You don't have to repeat the training, you add the reasoning underneath. A five-minute measurement per employee still gives you the role analysis, and repeating it 60 days later gives you the difference that carries the rest of your file.
The second mistake is making the file heavier than necessary. The standard is proportionality, not completeness. Five documents that hold up are stronger than a forty-page policy nobody checked, and they can be produced in an afternoon.
Not legal advice
This is how we read it from the training side, in plain language. For a legal assessment of your situation you need a lawyer; we supply the material such an assessment rests on.
04 · Short answer
Proportionate to the risk. A five-person design studio having copy rewritten gets away with one sheet and an attendance list. An insurer having claims assessed demonstrably needs more. The standard in the law is 'sufficient', which means you have to be able to explain why your approach fits what you do.
In practice it lands with HR or L&D, while the inventory sits with IT and the question of sufficiency with privacy or compliance. That's exactly why it stalls: there's no owner. Appoint one, even if that person needs the other two.
Partly. It shows you did something, which is more than most organisations can show. What's usually missing is the rationale for why that programme was appropriate for the different roles, and a measurement showing what it delivered. You can add those two without redoing the training.
Yes, if they operate the systems on your behalf. Article 4 speaks of staff and others dealing with AI systems on your behalf. That's one of the most frequently overlooked points, and at organisations with lots of contractors it isn't a detail.
Step three: the knowledge base for everyone, with a certificate and group overview.
Where steps two and four come from: the matrix, the monthly email and the export.
What Article 4 literally says, who falls under it and how it's enforced.
The measurement asks each employee which AI systems they use and for what, producing the inventory and the role analysis at once. Five minutes per person, with no connection to your environment.