What a DigComp 3.0 Competence Report Contains and Why a Certificate Is Not Equivalent
A training certificate records that someone was present for a course. A DigComp 3.0 competence report records what they can actually do. For Article 4 of the EU AI Act, only the second document answers the regulatory question.
Most Lithuanian public sector institutions do not know what a competence report looks like because most training providers do not produce one. This post shows exactly what it contains, what it proves to a regulator, and what it cannot prove.
Key points
- A completion certificate proves attendance. Article 4 requires evidence of role-appropriate AI literacy. These are not the same thing.
- A DigComp 3.0 competence report names specific competences, proficiency levels, assessment basis, and the AI use context. It is the artefact that makes compliance defensible.
- The report does not permanently discharge the Article 4 obligation. It documents competence at a point in time and must be kept current.
- Institutions that produce competence reports per learner have evidence that is significantly harder to challenge than a folder of completion certificates.
Why a certificate is not enough
A course completion certificate typically records: the learner's name, the course title, the date of completion, and sometimes a pass mark on a final quiz.
It does not record: which competences the course targeted, at what proficiency level, for which AI systems, assessed through what method.
Article 4 of the EU AI Act (Regulation (EU) 2024/1689, Article 4) requires deployers to take measures to support the development of AI literacy, "taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in." The measures must be proportionate to role and context.
A certificate cannot demonstrate that the training was proportionate to a specific role and AI use context. It records what course was delivered. It does not explain why that course was appropriate for that person using those AI systems in that job.
That is the evidentiary gap. A regulator reviewing your compliance documentation is not looking for proof that training happened. They are looking for proof that the training was appropriate. A certificate provides the first. It does not provide the second.
What a DigComp 3.0 competence report contains
A genuine competence report, structured around DigComp 3.0 (JRC144121, November 2025), contains the following components.
Learner profile
- Institution type and primary function
- Supervisory responsibility — this determines whether Module 7 (AI leadership) is required. Where a learner has supervisory responsibility, Article 4 obligations extend to their team's literacy, not just their own.
- AI system categories in use: the types of AI systems the learner's organisation deploys (for example: document-processing, content-generation, data-analysis)
- Starting DigComp level: self-assessed at intake, which determines pathway routing and proficiency level targets
Pathway and rationale The report records the recommended learning path and the reasoning behind it. This is not a generic recommendation: it is generated from the learner's institution type, role, and AI system exposure. The rationale section explicitly links the training scope to the learner's context. For a regulator, this is the proportionality argument in writing. It shows the training was not an off-the-shelf course applied uniformly — it was scoped to a specific person in a specific role using specific AI systems.
Deployer context
- AI system categories in use in the learner's role
- The relevant regulatory context: which Article 4 obligation the training addresses
- The report footer states explicitly: this constitutes "evidence of engagement with a structured Article 4(1) EU AI Act literacy measure"
DigComp 3.0 competence areas addressed
The core of the report. For each DigComp 3.0 competence addressed across the modules completed, the report records the competence code, full name, and the modules in which it was developed. Proficiency level is set at pathway level (for example: Advanced, DigComp Levels 5-6) based on the intake assessment, and applies across the competences addressed.
The following is from an actual Kelias competence report generated after completing three modules:
| DigComp Area | Competence | Modules |
|---|---|---|
| 1. Information and data literacy | 1.1 Browsing, searching and filtering data | Module 1 |
| 1. Information and data literacy | 1.2 Evaluating data, information and digital content | Modules 1, 3 |
| 1. Information and data literacy | 1.3 Managing data, information and digital content | Module 2 |
| 2. Communication and collaboration | 2.1 Interacting through digital technologies | Module 2 |
| 2. Communication and collaboration | 2.3 Engaging in citizenship through digital technologies | Modules 2, 3 |
| 4. Safety | 4.2 Protecting personal data and privacy | Module 3 |
| 5. Problem solving | 5.1 Solving technical problems | Module 1 |
A completed seven-module report adds further competences from DigComp Areas 4 and 5, depending on the learner's pathway. The table above represents three modules. It already addresses seven distinct competences across four DigComp areas.
Modules engaged record Each module the learner completed is listed with its DigComp area codes and the date of completion. This creates the audit trail: content delivered maps directly to competences recorded.
Framework reference and disclaimer The underlying framework is DigComp 3.0 (JRC144121, European Commission Joint Research Centre, November 2025, CC-BY 4.0). The report states this explicitly, which is what allows a regulator or reviewer to verify the competence descriptors against a recognised EU source. The report also notes: Kelias is not an official DigComp certification scheme. No official certification scheme exists (JRC Q&A, 2026). The report is evidence of engagement with a structured Article 4 literacy measure — not a certified qualification.
What the report looks like
Below is an actual Kelias competence report, generated on 13 September 2026 after completing three of seven modules. Every learner generates one automatically on completion — no additional steps required.
Three modules completed. Seven DigComp competences recorded across four framework areas. The pathway rationale explains why those modules were recommended for that learner's role and AI system context. The footer states the regulatory basis explicitly: evidence of engagement with a structured Article 4(1) EU AI Act literacy measure.
What the report proves to a regulator
When a national market surveillance authority or supervisory body reviews your institution's Article 4 compliance, a per-learner DigComp 3.0 competence report makes four things demonstrable.
1. Specificity. Training was targeted at specific competences, not AI concepts in general. The report names which competences.
2. Proportionality. The training was assessed at a proficiency level appropriate to the learner's role and AI use context. The report records which level.
3. Context. The competences developed are directly relevant to the AI systems the learner uses. The deployer context section makes this link explicit.
4. Assessment. Competence was assessed, not just taught. The report distinguishes between content delivered and competence demonstrated.
These four properties correspond directly to what Article 4 requires: measures that are proportionate, role-differentiated, and contextually appropriate. The certificate version of this record proves none of them.
What the report does not prove
A competence report is not a guarantee of future competent behaviour. Documenting that a learner demonstrated Level 3 proficiency in DigComp Area 4.2 in September 2026 does not guarantee they will handle every data protection question correctly thereafter. Article 4 does not require that guarantee. The Digital Omnibus amendment was explicit: institutions must "support the development of AI literacy," not "guarantee any specific level of AI literacy of any individual."
The report also does not permanently discharge the obligation. Article 4 is a continuing obligation. As AI systems change and new systems are adopted, competence records need updating. A 2026 competence report for a staff member who now uses a different AI system does not cover the new context.
Additionally, the report is not a substitute for GDPR compliance. Training records have their own legal basis requirements under GDPR. Maintaining competence records about staff requires a clear legal basis, an appropriate retention period, and alignment with your institution's data protection policy.
How to keep the report current
A competence report should be reviewed:
- At least annually, as part of a programme review cycle
- Whenever the learner's role changes and they interact with different AI systems
- Whenever a new AI system is deployed that the learner will use
- When the DigComp 3.0 framework itself is updated (though JRC144121 is current)
Building a reassessment trigger into your institution's AI literacy programme from the start is more efficient than managing it ad hoc. Tie it to your AI system procurement process: when a new system is onboarded, flag which roles will use it and trigger a competence assessment for those roles.
How institutions should store and maintain these records
Competence records should be held in a system that:
- Links each record to a specific learner and their current role
- Tracks which AI systems are covered by each record
- Shows assessment dates and reassessment schedules
- Allows the institution to produce aggregate reporting (how many staff at what DigComp level, across which competences)
This aggregate view is particularly valuable for a compliance audit. It allows an institution to answer not just "does individual X have a competence record?" but "across the roles that use AI System Y, what proportion of staff are at Level 3 or above in the relevant DigComp competences?"
A spreadsheet works as a starting point. An institutional admin dashboard that produces both individual and aggregate reports is more robust.
The difference in practice
An institution with certificate-based documentation and an institution with competence report documentation look quite different when an enforcement inquiry arrives.
The certificate institution produces: a list of staff who completed training, the course title, and the dates.
The competence report institution produces: a per-learner record of DigComp 3.0 competences demonstrated, at specified proficiency levels, assessed against a recognised framework, with dates, linked to the specific AI systems each person uses in their role.
The second institution can answer the regulatory question. The first one cannot, not because the training was necessarily inadequate, but because the documentation does not make the case.
Article 4 enforcement focuses on whether institutions can demonstrate that their measures were proportionate and role-appropriate. Competence reports produce that demonstration directly. Certificates do not.
Kelias generates exactly this report for every learner. Mapped to DigComp 3.0 at block level. Role-specific, assessment-backed, dated. Free 6-month access for Lithuanian public sector at kelias.tech or joseph@kelias.tech.
Ikpong Joseph Alexander holds an MSc in Artificial Intelligence and is the founder of Kelias. The regulatory source for this post is Regulation (EU) 2024/1689, Article 4, as amended by the Digital Omnibus (Regulation (EU) 2026/1744, July 2026). The DigComp 3.0 source is JRC144121, available from the JRC publications repository. This post does not constitute legal advice.