Governance guide
Nightschool AI: which AI governance frameworks ask for staff AI training
A training record is evidence, not a finding. Here is where it fits.
Several frameworks ask for staff training or awareness: the EU AI Act's Article 4 on AI literacy, the NIST AI RMF's GOVERN 2.2, ISO/IEC 42001's competence and awareness clauses, HIPAA's security awareness and training standard, and SOC 2 criteria on competence. A training record maps to these; it does not settle them alone.
Published
Key Takeaways
- The EU AI Act's Article 4 on AI literacy, as amended in 2026, asks providers and deployers to take measures to support the development of AI literacy of their staff.
- NIST's AI RMF says personnel and partners receive AI risk management training; NIST describes the framework as intended to be voluntary.
- HIPAA requires a security awareness and training program for all workforce members, including management.
- A dated, per-person training record can support evidence for each; it is not proof of compliance on its own.
The full guide
Tap any section to open it.
About this guide
This page is for the compliance, security or HR lead asked whether staff need AI training and what proof to keep. It lists five frameworks, what each asks about workforce training or awareness, and how a dated training record can support the evidence an auditor or regulator looks for.
Framework, what it asks, and how a training record is used
| Framework | What it asks | How a training record is used as evidence |
|---|---|---|
| EU AI Act, Article 4 | Providers and deployers take measures to support the development of AI literacy of staff and others dealing with AI systems on their behalf (wording as amended in 2026) | Shows the measures taken: who was trained, on what, and when |
| NIST AI RMF, GOVERN 2.2 | Personnel and partners receive AI risk management training (framework intended to be voluntary) | Maps to GOVERN 2.2 by showing training against your AI policies |
| ISO/IEC 42001, clauses 7.2 and 7.3 | Clauses titled Competence and Awareness (text is paywalled) | One document an auditor can ask for under those clauses |
| HIPAA, 45 CFR 164.308(a)(5) | Security awareness and training program for all workforce members, including management | Part of the program's documentation, kept 6 years under 164.316(b)(2)(i) |
| SOC 2, CC1.4 and CC2.2 | General topics: commitment to competence; internal communication of objectives and responsibilities (AICPA text not reviewed) | Training logs and policy acknowledgements as supporting evidence |
EUEU AI Act, Article 4: AI literacy
Article 4 of Regulation (EU) 2024/1689, the AI Act, covers AI literacy. It was amended by Regulation (EU) 2026/1744 of 8 July 2026, and the consolidated text of paragraph 1 now reads as follows.
"Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used."
It continues: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." The amendment changed the original 2024 wording, "take measures to ensure, to their best extent, a sufficient level of AI literacy", to "take measures to support the development of AI literacy".
Paragraph 2 says the Commission and the Member States "shall support and facilitate the efforts of providers and deployers of AI systems, in particular SMEs". It adds that the Commission "shall publish practical examples of how to comply with that obligation".
A company that uses AI tools at work is usually a deployer. A training record, with dates, roles and content covered, can support showing the measures you took. Source: consolidated text, eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727.
US, voluntaryNIST AI RMF: GOVERN 2.2
NIST's AI Risk Management Framework (AI RMF 1.0) puts workforce training under the GOVERN function. GOVERN 2.2 reads: "The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements."
NIST AI 100-1 says: "The Framework is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic." A training record maps to GOVERN 2.2 by showing who was trained, on which policies, and when. Source: nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf.
International standardISO/IEC 42001: competence and awareness
ISO/IEC 42001 is the management system standard for AI. Its clause 7.2 is titled Competence and clause 7.3 is titled Awareness. The standard's text is sold by ISO, so this page describes the clauses by title only and does not quote them.
If you work toward 42001, a training record is one of the documents an auditor can ask for under those clauses. Check the exact requirements in your licensed copy of the standard.
US healthHIPAA: security awareness and training
45 CFR 164.308(a)(5)(i) reads: "Standard: Security awareness and training. Implement a security awareness and training program for all members of its workforce (including management)."
HIPAA's documentation rule, 45 CFR 164.316(b)(2)(i), reads: "Time limit (Required). Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later."
If staff use AI tools with protected health information, AI-tool training can sit inside that program and its records. Sources: ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308 and ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316.
AuditSOC 2: Trust Services Criteria CC1.4 and CC2.2
SOC 2 reports are assessed against the AICPA's Trust Services Criteria. In general terms, CC1.4 is about commitment to competence, and CC2.2 is about internal communication of objectives and responsibilities. We have not reviewed the AICPA text, which is registration-gated, so this page does not quote it.
Training records, policy acknowledgements and attendance logs can support evidence for these criteria. Read the criteria text on aicpa-cima.com, and agree the evidence with your auditor.
EvidenceWhat a useful training record holds
One record per person, per course, kept with the policy it covers.
Who
Name, role and team, so you can show coverage by role, including management.
When
Completion date and the date access to the AI tool was granted.
What
Course or module names, and the policy version the person signed.
Where it is kept
A named system and a retention period, such as six years where HIPAA documentation rules apply.
SourcesWhere each fact comes from
EU AI Act: Regulation (EU) 2024/1689, Article 4, as amended by Regulation (EU) 2026/1744 (OJ 24.7.2026), consolidated text at eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727. NIST: nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf.
HIPAA: ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308 and ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316. Our team read the EU, NIST and HIPAA texts on 2026-11-08.
ISO/IEC 42001: iso.org/standard/42001, clause titles only. SOC 2: aicpa-cima.com, Trust Services Criteria; we have not read the AICPA text, so the SOC 2 section describes the criteria by number and topic only. Check the current text of each before you rely on it.
Training your auditor can read
Nightschool AI's admin and governance courses train the admins who set up each tool, and its team training covers the people who use them, with per-person completion you can keep as a record.
Admin and governance courses, one per tool (sign up free to try the first lessons; the full course is paid)
Frequently Asked Questions
Does the EU AI Act require AI training for staff?
Article 4, as amended in 2026, says providers and deployers "shall take measures to support the development of AI literacy of their staff" and others dealing with AI systems on their behalf. It adds that the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual." It does not name a specific course.
Is the NIST AI RMF mandatory?
No. NIST AI 100-1 says "The Framework is intended to be voluntary". GOVERN 2.2 describes personnel and partners receiving AI risk management training.
Does HIPAA mention AI training?
Not by name. 45 CFR 164.308(a)(5) requires a security awareness and training program for all workforce members. If staff use AI with protected health information, that training can include it.
What do ISO/IEC 42001 clauses 7.2 and 7.3 cover?
They are titled Competence and Awareness. The standard is sold by ISO, so read the exact requirements in a licensed copy.
Is a training record enough on its own?
No record does that on its own. A dated training record can support evidence for these frameworks; the assessment depends on your whole program and your auditor.
How long should we keep training records?
Follow your own retention schedule. Where HIPAA documentation rules apply, 45 CFR 164.316(b)(2)(i) says six years from creation or last effective date, whichever is later.
Is this legal advice?
No. It summarizes public framework text for orientation. Confirm obligations with your counsel and auditor.
Train first, then keep the record
One dated record per person, per course, kept with the policy it covers.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Anthropic, Microsoft, OpenAI or Google. Claude, Microsoft 365 Copilot, ChatGPT and Gemini are those companies' products, named here only to describe them. This page is general information, not legal advice. EU AI Act, NIST and HIPAA texts read by our team on 2026-11-08; the AICPA SOC 2 text was not reviewed. Confirm current obligations with your counsel and auditor.