Article 4 Compliance Record: What It Is and How to Prepare It

An Article 4 compliance record is a written document in which your company records the measures taken to support the development of AI literacy among employees and other persons using AI on its behalf - who did what, when, and in what specific way. It is not a contract or a declaration to the state, but your internal evidence trail: if a supervisory authority asks whether you are complying with Article 4 of the EU AI Act, the compliance record is the document you present. The record can make those actions easier to explain, although Article 4 does not prescribe this particular document and other evidence may also be relevant.

A good compliance record must demonstrate three things: which AI systems are used, what training has been conducted, and what evidence remains after it. Without these elements, the document easily becomes a mere piece of paper on a desk.

What is a compliance record and how does it differ from other documents?

A compliance record is a summary document that describes the actions taken in response to Article 4. It is not another policy or instruction - it is a record of actions taken, with dates, responsible persons, and references to other documents. It is easiest to think of it as your AI compliance "protocol".

Article 4 of the AI Act does not specify a mandatory form for the compliance record and does not even explicitly name it. However, the logic of the obligation itself requires provability: the duty to take measures supporting AI literacy has applied since 2 February 2025, while supervision and enforcement began in August 2026. Keeping evidence helps explain the measures taken; missing this particular record does not automatically establish non-compliance. For more details on the content of the obligation itself, see our article EU AI Act Article 4 Requirements.

It is important not to confuse the compliance record with other documents - each serves its own purpose:

In other words, the policy, register, and guide represent the content of compliance, while the compliance record brings together evidence of the measures taken.

What must an Article 4 compliance record include?

A good AI compliance document must answer simple auditor questions: what you did, when, who was responsible, and what it was based on. For a micro-company, a concise but specific record is sufficient. A useful suggested structure:

1. Company details - name, company code, responsible person (usually the manager).
2. Effective and review dates - when the record was prepared and when it is planned to be reviewed.
3. List of AI tools used - or a reference to a separate AI Tools Register, if maintained separately.
4. Applicable rules - reference to the current AI Usage Policy in the Company and its version and date.
5. Training fact - when AI literacy training took place, who participated, whether there was a knowledge check, and what the results were.
6. List of participants - which employees participated and any knowledge checks or certificates used by the company.
7. Signature or confirmation of the responsible person - to make the record official.

The key is that the record must be dated and specific. A phrase like "employees were informed about AI rules" without dates and names is weak evidence. A record such as "On 2026-06-05, all 7 employees completed AI literacy training and a knowledge check, average score 86%, certificates issued" is strong evidence.

Why a record and not just training?

A common mistake among micro-companies is thinking that holding a team meeting is enough. The problem is that actions become harder to describe reliably when no record is kept. After a year, no one will remember when the meeting took place, who attended, or what was learned.

A compliance record solves three practical problems:

• Memory problem - it records facts when they are fresh, not when they are needed.
• Evidence problem - it provides a document that can be presented during an audit.
• Change problem - when employees or tools change, you can see who was trained and when, and know what needs to be updated.

This is especially important when evaluating whether the training achieved its goal. To demonstrate that measures were taken considering knowledge, experience, training, and context, it is useful to have not only proof of participation but also the results of knowledge checks - how to measure this precisely is explained in the article how to measure AI literacy.

How to prepare a compliance record step by step?

A micro-company can prepare a compliance record with the following steps:

1. Gather the facts. Which AI tools you use, when you approved the rules, when the training took place. If you do not yet have a register or policy - prepare them first, as the record relies on them.
2. Record training results. Note the date, participants, and knowledge check results. Certificates are a convenient evidence element.
3. Write the record. Compile the previously listed elements into a single document with clear dates.
4. Confirm. The manager signs or confirms the document - this makes it official.
5. Set a review date. Record when the document will be reviewed (e.g., annually or when tools change).
6. Store and update. Keep it where you can find it within a minute and update it when something actually changes.

A compliance record is not a "write and forget" document. When you deploy a new AI tool, hire a new employee, or change the rules, the record must be updated. It is precisely a living, updated record that best proves that compliance is an ongoing process for you, not a one-time formality.

Common mistakes when preparing a compliance record

Even a well-conceived AI compliance document can become worthless due to a few typical mistakes:

• Undated record. Without dates, it is harder to explain when the measures were taken, including since the initial application on 2 February 2025.
• Vague phrases. "Employees were informed" without names and results is a declaration, not evidence.
• Unupdated document. A record written once and forgotten quickly ceases to reflect reality.
• Training without verification. If you do not check whether people understood the material, it is difficult to prove that measures were taken considering the context.
• Record without basis. A compliance record that is not based on a currently valid policy and register remains empty.

The same principles apply to all AI Act documents - for broader context, see the list of all articles, which also includes other topics related to Article 4.

How much time and money does it take?

In theory, you can write a compliance record yourself in a few hours if you already have a policy, register, and completed training. The practical obstacle for micro-companies is usually not complexity, but consistency - all documents must be prepared so that they align with each other and are based on the same dates and facts.

This is why this work can be fully automated. nebedirbam.lt automatically prepares the entire package of Article 4 documents - AI Usage Policy, AI Tools Register, compliance record, Employee AI Guide, and AI literacy training with knowledge checks and certificates - for a fixed €149 + VAT (€299) price. Based on your questionnaire answers, coordinated documents are prepared where dates, participants, and references are interconnected, so the compliance record becomes a clear part of the evidence set. These documents and training are a practical and convenient way to demonstrate compliance, but they are not mandatory legal minimums or a guarantee that compliance will be recognised.

If you are just starting to use AI and for now want to try the training yourself, you can start with free AI literacy training and prepare the full documentation with a compliance record later when you need to prove compliance. The free path is for one signed-in participant; team training is included in the paid documentation package.

Frequently asked questions about the compliance record

Do I need to send or register the compliance record somewhere? No. Article 4 does not require the record to be registered with a state institution or sent to a register. It is an internal document that you keep and present only when requested during an audit.

How often does the compliance record need to be updated? A company can choose an annual review, with earlier updates whenever something significant changes - a new AI tool, a new employee, an updated policy. It is important that the record reflects the actual situation.

Is a compliance record alone sufficient without other documents? A record alone does not replace actual measures. It should refer to the training, guidance or other steps actually taken. Article 4 does not prescribe a universal policy, register or document package.

Is a compliance record suitable for a one-person company? Yes. Even if you use AI only by yourself, it is useful to have a dated record so you know which tools you use and which rules you follow. It is simpler but still a valuable document.

Is the use of AI in a company always prohibited under GDPR? No. GDPR does not prohibit the use of AI, but it requires that it be done in accordance with a lawful basis, the principle of data minimisation, using approved tools and appropriate safeguards. Companies often only prohibit unapproved or public AI tools, not all AI tools in general.

Key takeaways

An Article 4 compliance record is a practical evidence document: it records that your company has taken measures to ensure AI literacy for employees and relevant persons, with specific dates, participants, and references to the policy and register. Article 4 does not require this particular document or a fixed form; it is one way of recording the steps taken. For a micro-company, the most important thing is that the record is dated, specific, based on real documents, and regularly updated. You can prepare it yourself or let the system do it automatically - but in any case, do not neglect this document, as it is precisely what turns your work into provable compliance.

The obligation to take measures supporting AI literacy has applied since 2 February 2025, while supervision and enforcement began in August 2026. The requirements for high-risk AI systems listed in Annex III apply from 2 December 2027, and for high-risk AI embedded in regulated Annex I products - from 2 August 2028. General and transparency (Article 50) rules have applied since 2 August 2026.

This article is based on Article 4 of the EU AI Act and information provided by the European Commission on the AI regulation. For more details, see the explanation of Article 4 of the AI Act and the European Commission’s Digital Strategy page.