How do you show AI literacy to a regulator?

Show records, not intentions. A regulator wants to see which roles work with AI, what each was trained on, the level each person reached, and when that was last renewed or refreshed. For people who approve agent actions, add checkable certificates and evidence their approval rights depend on them. A policy document helps frame the records but cannot replace them.

What is a regulator actually looking for?

A regulator asking about AI literacy is usually asking whether the firm understands its own use of AI well enough to control it. Under the EU AI Act, Article 4 asks providers and deployers to ensure a sufficient level of AI literacy among staff, taking account of their role and the context of use. Other regulators reach the same place through conduct rules, model risk expectations or operational resilience.

The questions behind the request are practical. Do the people who oversee AI know what it does and where it fails? Is training matched to what each person does? Does the firm know when someone's knowledge has gone stale? Literacy that cannot be shown in records is, from a regulator's point of view, an assertion.

Which records should you have?

1. A literacy policy. What the organisation expects at each level and why. The AI literacy policy template gives a structure.
2. A role map. Every role that uses, approves, builds or owns AI systems, with the literacy level each requires.
3. Training content per level. What each level covers, written down, including the agents and capabilities it relates to.
4. Individual training records. Who completed what, when, at what result. The AI literacy training record template captures the fields.
5. Certificates for approvers, checked at the issuer, with expiries.
6. Rights history. Evidence that approval rights depend on current certificates.
7. Refresh records. Briefings when agents, rules or products change, logged against the people affected.

What should the content cover?

Content matters because a regulator may ask to see it. For people working with agents, it should cover more than general awareness:

• What the agent may do and at what depth, and why some actions are held, refused or withheld.
• Provenance. Where each fact in an agent's output came from and how much weight it bears. An agent that shows its sources is only useful if staff know how to read them.
• Risk. How agents fail in this job, and what the person approving should look for; see what risk literacy means.
• Instructions. For people who write or adjust agent briefs, how wording shapes behaviour; see what prompt literacy means.
• Escalation. How to stop an agent and who to tell.

How should you present it?

Present it as a short pack: the policy, the role map, summary counts per level, and a sample of individual records. Be ready to produce any individual's full record on request.

An example from a supervisory visit

A supervisor visiting a mid-sized lender asks how staff are prepared to oversee the agents in its credit and collections teams. The lender produces its literacy policy, a role map showing four levels, and a summary: all staff at level 1, credit and collections staff at level 2, credit officers and collections team leads certified at level 3, and the agent owners at level 4.

The supervisor picks two credit officers at random. The lender shows their training records, their certificates verified at the issuer that morning, their practicum logs and their rights history. One had a lapse of three days; the history shows rights were removed and restored on renewal. The supervisor moves on.

What weakens the evidence?

• Completion counts without results.
• One course for every role.
• Certificates held as PDFs rather than checked at source.
• No link between certificates and approval rights.
• No record of refreshers when agents change.

The guide to AI literacy and certification covers how literacy and certification fit together across roles.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.