AI Literacy Enforcement: Linking Training Records to Real Usage via the Proxy

How will you prove to a regulator that the HR manager using DeepSeek to screen candidates this morning is genuinely “literate” in that specific model’s risks — and not just the holder of a generic webinar certificate from 2024? Article 4 of the EU AI Act has been enforceable since February 2025. Most enterprises still cannot answer the question.

The obligation is straightforward: organisations must ensure staff possess a “sufficient level of AI literacy.” The technical reality is harder. You need to prove, per employee and per model, that the people actually invoking AI today have the specific competence the regulation demands.

---

Undocumented and Irrelevant Training

• The attendance fallacy. Traditional training relies on completion certificates for generic videos. Regulators require role-specific literacy — an HR manager screening applicants must demonstrate understanding of those risks, not awareness that AI exists.
• The evidence gap. Organisations have no way to prove which employees are using which models. Without that data, targeted training is impossible.
• The enforcement failure. A written policy asking employees to be “literate” before using AI cannot technically prevent an untrained staff member from invoking an LLM.

This is the same root cause as the Shadow AI inventory gap — you cannot enforce what you cannot observe.

---

Linked Literacy Logs

NordClaw uses its position in the traffic path — running on Sovereign Container Infrastructure in Frankfurt — to transform AI literacy from an HR task into a security control.

Usage-based targeting

Our audit_logs table on the Dedicated PostgreSQL 15 Cluster identifies exactly which users are calling which models via Enterprise Identity Federation (OIDC SSO). The user_id and tenant_id claims link every request to a named individual in your org chart.

The result: literacy training is targeted at actual employee behaviour, not self-reported tool usage.

• An employee who has called a DeepSeek model 47 times this month should have completed a DeepSeek-specific literacy module.
• An HR manager whose requests contain redacted PERSON and SSN PII categories should have completed an Annex III High-Risk AI literacy certification.

Technical gatekeeping

The interceptor can restrict access to specific high-risk endpoints until the user’s SSO identity is matched with a literacy_completed flag in the compliance database. A technical gate, not a policy reminder:

Request arrives at api.nordclaw.eu
  ↓
OIDC JWT validated → user_id extracted
  ↓
Compliance DB lookup: literacy_completed(user_id, model)
  ↓
  ├─ TRUE  → request proceeds through PII redaction pipeline
  └─ FALSE → 403 response with training link

The one-page evidence report

By combining usage logs with training metadata, NordClaw generates a unified report showing that every active AI user has completed the legally required literacy modules for the models they actually use. Export as a signed PDF and hand it to a national supervisory authority — satisfying the technical documentation requirements of the AI Act.

---

Regulatory Alignment

Obligation	NordClaw mechanism
Article 4 — AI literacy	Usage-based training targeting from the Immutable Ledger
Article 26(6) — Log retention	6-month append-only retention (INSERT-only permissions)
Article 9 — Risk management	Automatic high-risk flag on HR-sensitive PII categories
DPA audit evidence	Exportable PDF linking identity, usage, and training

For HR-specific enforcement of these obligations, see our high-risk HR oversight deep dive.

---

From Attendance Lists to Technical Proof

AI literacy compliance is not achieved by issuing certificates. It is achieved by proving that the people who use AI tools understand the risks of those specific tools.

NordClaw bridges the gap by combining the technical reality of proxy-level observation with the organisational reality of HR training records. The result withstands regulatory scrutiny: not “we trained everyone on AI,” but “we can prove every employee currently using DeepSeek for HR screening has completed the mandatory high-risk certification for that workflow.”