Reviewed27.09.2026 InstrumentsSix covered StrongestISO/IEC 42001 Clause 7.2

Nobody is going to fine you for untrained staff. That is not where this lands.

The obligations that actually reach an organization are audit findings, examination questions and customer reviews, and there are more of them every quarter. None of them accept a completion rate as an answer.

See what each one asks for or read the methodology

Dec 2023

ISO/IEC 42001 published. Clause 7.2 requires documented evidence of competence. Certifiable, so it becomes an audit finding.

Feb 2025

EU AI Act Article 4 begins to apply to providers and deployers.

Feb 2026

US Department of Labor publishes its AI Literacy Framework. Voluntary, and it names five content areas.

Aug 2026

National market surveillance authorities begin supervising the EU AI Act.

Jan 2027

Colorado SB 26-189 takes effect, replacing the repealed SB 24-205.

The mapWhat each one asks

Five things ask about competence. Only one of them can audit you for it today.

The instinct is to start with the statute, because a statute sounds like the thing with teeth. In practice the statute is the weakest item on this list and the voluntary standard is the strongest, because the standard is the one with an assessor attached.

Instrument	Status	What it asks for	Asks for evidence?
ISO/IEC 42001 clause 7.2	Voluntary, certifiable	Determine the competence needed by people whose work affects AI performance, ensure they have it, and retain documented information as evidence of it.	Yes, explicitly
NIST AI RMF GOVERN 3.2	Voluntary framework	Proficiency standards for the people carrying out system operation and oversight tasks.	Implied
FINRA Rule 3110	Binding, sector	AI training sits inside the supervision obligation. This is the one US requirement with examination behind it.	Yes, on examination
EU AI Act Article 4, as amended	Binding, EU	Take measures to support the development of AI literacy. Since the July 2026 amendment it expressly does not require you to guarantee any level of competence in any individual.	Records suffice
US Dept of Labor AI Literacy Framework	Voluntary guidance	Five foundational content areas. Aimed at the public workforce system rather than at employers directly.	No
US state law CO, IL, CA, TX, CT, NYC	Binding, varies	Notice, bias audit and anti-discrimination duties around automated decisions.	No training duty

Read the last row carefully. No US state or local law currently imposes a workforce AI training or competence requirement. Anyone telling you Colorado or Illinois requires AI training is selling something. What those laws require is notice, bias auditing and non-discrimination, and a workforce that cannot recognize an automated decision is how organizations fail those duties in practice rather than in law.

The strongest hookISO/IEC 42001

The requirement with an assessor attached is the one that changes behavior

ISO/IEC 42001 is the management system standard for AI, and it is certifiable. That single property is what separates it from everything else on this page. A voluntary framework asks you to consider something. A certifiable standard sends a person to your office who asks to see it.

Clause 7.2 asks an organization to determine the competence necessary for people whose work affects AI performance, to ensure those people are competent, and to retain documented information as evidence of that competence. Clause 7.3 covers awareness of the AI policy and of what happens when it is not followed.

An assessor holding that clause and looking at a stack of course completion certificates is looking at evidence of attendance. The gap between what the clause asks for and what most organizations can produce is the entire reason this company exists.

A caveat we will state rather than hide. ISO does not publish clause text free of charge, so the wording above is a summary and not a quotation. Read it from a licensed copy before you rely on it, and have your assessor confirm how they interpret competence evidence for your scope.

The commercial routeBefore any regulator

Most organizations meet this through a customer, a board, or an auditor

The sequence is consistent. AI tools go in. A policy follows, usually quickly. Then someone above the program asks how anyone knows the policy is being followed, and the honest answer is that nobody does.

Board and audit committeeHow do we know our people can use these tools safely?Directors report AI capability as their largest gap, and most say the information they receive linking AI to risk and performance is fair or poor. The question comes down, not up.
Internal auditShow me the control, not the policyA policy with no test behind it is a documented intention. Audit treats it accordingly.
Customer security reviewDescribe your AI governance controlsVendor questionnaires increasingly carry an AI section. Today those sections ask about your product. Expect them to reach your workforce next.
Certification assessorEvidence of competence, per clause 7.2The only route on this list that produces a written finding you have to close.

CorrectionsCommonly repeated, and wrong

Four claims you will hear in this market

"Article 4 carries fines of up to 3% of global turnover."

No. The AI Act's penalty article lists the provisions that carry that tier and Article 4 is not among them. Member states set their own rules for it under a separate paragraph, so the real exposure is 27 national regimes rather than one EU fine. Article 4 functions in practice as an aggravating factor in another investigation.

"You have to test your employees to comply with the EU AI Act."

No. The European Commission has said organizations are not required to measure employee knowledge, that no format is mandated, that no certification is required, and that internal records of training and other initiatives are sufficient. We sell assessment and we will still tell you this. Measurement is the cheapest good evidence of effort, not a legal requirement.

"Colorado and Illinois now require AI training."

No. Colorado's original AI Act was delayed, enjoined, then repealed and replaced before it ever took effect, and neither version contained a training requirement. Illinois, California, Texas, Connecticut and New York City impose notice, bias audit and anti-discrimination duties. None of them requires training.

"Our certification satisfies Article 4."

It does not. The Commission's own repository of AI literacy practices states that replicating the listed initiatives does not grant a presumption of compliance. No certificate from any vendor, including anything we would ever sell you, confers Article 4 compliance.

EU detailIf Article 4 is your question

The Article 4 position in one paragraph

Article 4 has applied since 2 February 2025 and reaches organizations with no European entity, through customers, staff or output placed in the Union. The Digital Omnibus rewrote it in July 2026, converting a duty to ensure a sufficient level of AI literacy into a duty to take measures supporting its development, and adding an express statement that no specific level in any individual has to be guaranteed. The standard got softer. Because there is no longer an outcome to point at, the record of what you did became the only assessable thing.

We keep a longer treatment of the obligation, the timeline and who is in scope, and a scoping tool that produces a dated determination you keep.