Training evidence for the regulator: a report you print, not compile

In brief

Every training obligation ends in the same question: who has been trained, in what, and how was it verified. The GDPR expects the data protection officer to monitor staff training; the Cybersecurity Act requires training of management and regular cyber hygiene training for the staff; the AI Act requires measures to support staff AI literacy. CoreSkills answers the question with a report that is printed, not compiled: the training evidence gives, by learning path and for every person, the completions, the exam result and the certificate's identifier, and it is a CSV file on the day it is asked for.

First the assignment, then the evidence

Evidence begins with an assignment. An employee may start any learning path on their own, but a mandatory path is assigned: choose the path, a due date if you want one, and whom it concerns, the whole staff or one job role. Those who have already completed it are skipped.

The due date can be left empty, and then everyone gets the path's recommended time, 30 days by default. An assignment is therefore never without a due date, because without one the pace report could not say of anyone whether they are on schedule. If the time given is not enough for the path's content, the page says so: how many tasks the path has, how many working days remain to the due date and how long would suffice. The assignment is made anyway, because the deadline may come from the law.

The assignment covers future employees by default. Everyone who joins later gets the path automatically, and nobody has to remember to renew it. Someone who has just joined is not late for a deadline that expired before them: they get the recommended time from their own joining day. An assignment tied to a job role concerns those who have that role, and a person given the role later gets its paths with it.

While a path is assigned, everyone has at least one reminder that reaches them, email or Teams. For those who had neither on, the email reminder is switched on with the assignment, and the page says how many were switched on.

Four reports

The company portal has four views for following where the staff are.

The pace report sits beside the assignment. It shows, for assigned paths, who is on pace, who is behind and whose due date has already passed, with an estimate of completion. Remaining work counts the course steps of missing skills and finally the exam, and done is whoever holds a valid certificate. The report can be downloaded as CSV.

Completions shows every learning path: how large a share of the staff has completed it, certified on a certifying path; how many are certified, ready for the exam or have a certificate expiring; and every person's situation, what they still lack and until when their certificate is valid. A certificate shows as expiring when fewer than 60 days remain, and it is renewed by retaking the exam.

Training evidence is the report for a regulator or an auditor. By learning path and for every person it gives which of the path's courses they completed, whose courses they are and when they were completed, how many of the path's required skills have been demonstrated, the exam result and date, and the certificate's identifier and validity. A summary says how many completed the path, passed the exam and hold a valid certificate. The report can be downloaded as a CSV file named with the organisation's name and the date.

Skills mapping shows by job role which skills the work requires and where the staff stand against them: for every skill how many reach the target level, every person's gaps and the courses that would close the most gaps. It is covered in Skills mapping.

What the regulator asks and where the answer comes from

The questions are the same across the statutes, and the reports answer them the same way.

Who asks	What is asked	Where the answer comes from
The Data Protection Ombudsman or your own DPO	Has the staff been trained in data protection, and who	Training evidence: completions and certificates on the Data protection essentials path
The cybersecurity supervisory authority	Has management trained and has the staff had regular training	Training evidence: Management's cybersecurity duty and Cybersecurity essentials, completion dates and certificate validity
The AI Act market surveillance authority, a contracting entity or a customer	What has been done to support staff AI literacy	Training evidence: the AI literacy path, exam results, certificates with identifiers
Your own management or auditor	Are we on schedule and where are the gaps	The pace report and skills mapping

Every row is the same data from a different angle: who, what, when and with what result. The exam separates the trained from the viewer, and the certificate's identifier is what the regulator can check on the public page.

What the reports do not show

The reports show completions, the exam result and certificates. They do not show individual exam answers, conversations with the AI teacher or skills-mapping interviews. Skills mapping shows when a person mapped their competence, and for every level whether it was verified by training or self-assessed. A person's own development areas and recommendations are theirs.

This is deliberate. The employer needs evidence that the obligation was met, not the employee's learning process. The report gives the result and leaves the journey to the employee.

Before anyone asks

The idea of training evidence is that it is ready before it is asked for. Once a path is assigned to a job role with a due date and reminders are running, the pace report says every morning who is behind, and the evidence accumulates as people complete. When a request arrives, the report is downloaded; it is not compiled from emails and attendance lists.