EU AI Act Article 4: What Creator Agencies and Small Teams Owe

If you run a solo AI-assisted content operation, EU AI Act compliance depends mostly on your own choices. If you add a freelancer, editor, or contractor to your team, this changes. Article 4’s AI literacy provision covers anyone who deals with the operation and use of AI systems on your behalf. As of 27 July 2026 that provision is lighter than it was, and most coverage of it still describes the old version.

Article 4: what it says now, and what it used to say

As originally enacted, Article 4 required providers and deployers of AI systems to ensure “a sufficient level of AI literacy” among staff and other people who operate those systems on their behalf.

That wording has changed. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and simplified the company-level requirement. In the Commission’s own description, the “previous AI literacy requirement for companies is simplified, with the Commission and the Member States taking a stronger role in promoting AI literacy.” The primary duty to drive AI literacy now sits with public authorities rather than landing on every deployer as a hard obligation of result.

What has not changed is who is in the frame when something goes wrong. The people who operate AI systems on your behalf are still your responsibility in practice, because the obligations that carry real penalties sit elsewhere:

• Employees using AI tools as part of their role
• Freelancers and contractors you bring in for specific projects
• Any collaborator who touches an AI tool while working under your direction

If someone on your team uses an AI voice cloner, script generator, or thumbnail tool for a client project, Article 4 treats that as your organization’s use. It does not treat it as only the individual’s use.

Why the February 2025 date still matters

Most conversation about the EU AI Act for creators focuses on the 2 August 2026 enforcement date for Article 50 disclosure. Article 4 works differently. It sits in Chapter I (general provisions), one of the two chapters that became directly applicable first. The Omnibus changed what the article demands, not the date from which Chapter I applied.

Dates per Article 113 — entry into force and application and Regulation (EU) 2026/1744.

If an untrained freelancer on your team causes harm using an AI system, the exposure lands on your agency, not on them. Examples include leaking client data, publishing an undisclosed deepfake, or presenting a synthetic persona as real. That exposure does not come from Article 4, which carries no standalone fine and is now lighter than it was. It comes from Article 50 disclosure, Article 5’s prohibitions, GDPR, and your client contracts. A freelancer who does not understand the tools is how you end up breaching one of those.

What “sufficient AI literacy” actually means in practice

There is no required training course or certification, and there never was. The Commission’s guidance on the original wording set out a minimum floor that remains the sensible bar to work to, whatever the simplified text now demands:

1. A general understanding of what AI is and how it works across your team
2. Awareness of which specific AI tools your organisation uses and what they do
3. Basic understanding of the opportunities and risks those tools carry, including disclosure and manipulation red lines

There is no legal requirement to test literacy levels formally. What matters is that you can show you took measures, for example a short onboarding note, a shared tool-use policy, or a recorded briefing. Any record is better than no record.

Where agencies specifically get exposed

Three patterns show up repeatedly in agency and small-team AI workflows:

• Freelancers using unapproved tools. A contractor generates a synthetic voiceover using a tool the agency never approved. Nobody discloses this and nobody keeps a record that anyone reviewed it. If that voiceover appears in a client deliverable and the client’s audience flags it, the agency is the deployer of record, not the freelancer.
• No audit trail on client-facing AI content. Work goes out under the agency’s name with AI involvement that nobody documented. This makes it impossible to demonstrate that the agency took measures, if a client or regulator asks. This is the most common gap I see. Many agencies use AI extensively but cannot produce a simple record of what was used, when, or by whom.
• Assuming platform compliance covers the agency. Article 50 disclosure obligations belong to the deployer, the agency. They do not belong to TikTok, Meta, or YouTube’s own labeling systems. A platform auto-tag does not discharge your obligation. This applies if the content moves off-platform, if someone reuses it for a client’s own channels, or if someone removes the watermark during editing.

The common thread across all three examples: the agency carries the exposure, even when a freelancer made the actual AI-tool decision. None of these three failures is an Article 4 problem. Each is an Article 50, contract, or data-protection problem that an untrained freelancer walked you into. That is why the literacy work is worth doing whether or not the Act still requires it of you.

What this means if something goes wrong

Article 4 itself does not carry a standalone fine. The exposure comes through the obligations underneath it. If an AI-related failure also breaches Article 50 disclosure, or if it enters Article 5’s prohibited-practice territory, regulators and clients look to the agency first. They do not look to the individual freelancer who ran the tool.

For most small agencies, the realistic risk is not a Commission investigation. The real risk is a client contract dispute or reputational damage. This happens when undisclosed AI use becomes public and the agency has no internal record of oversight.

This asymmetry combines a low probability of formal enforcement with a high cost if enforcement happens. A one-page policy and a simple log are cheap insurance against this risk.

What small teams get in return

The Act is not uniformly heavier for smaller operations. SMEs get real concessions under Article 62:

• Simplified technical documentation using a Commission-provided template, where documentation obligations apply at all
• No requirement to appoint a formal AI officer or governance board. Article 4 does not demand a new organisational structure. It requires only demonstrable measures.
• Built-in proportionality. Obligations scale with the technical knowledge, context, and risk level present in your operation. They do not follow a fixed enterprise-grade bar.

What agency owners who get ahead of this actually do

1. Write a one-page AI tool-use policy. State which tools are approved, what disclosure is required, and who signs off before client delivery. This document is your best evidence that you took measures. It takes an afternoon to draft, not a compliance consultant.
2. Brief every freelancer before they start a client project, not after. A five-minute documented onboarding conversation meets the literacy bar far better than silence. The standard is “sufficient,” not “certified.”
3. Keep a simple log of AI-assisted work for each client project. One spreadsheet row per deliverable is enough: the tool used, who ran it, and whether the agency disclosed it. If a client or regulator asks what was AI-generated and who reviewed it, you want an answer that takes minutes, not days.
4. Add disclosure to the delivery checklist, not the freelancer’s memory. If disclosure only happens when someone remembers to add it, someone will eventually miss it on a rushed project. Build disclosure into whatever template or process closes out a piece of work.

None of this requires new headcount or a formal AI governance function. Article 4 never demanded that, and demands less now. It is basic documentation discipline that protects the agency regardless of how enforcement develops as the Act matures.

If you are building this for your team, get in touch →

Related reading on The Science Talk

This piece pairs with EU AI Act Article 4: What AI Literacy Requirements Mean for European Research Institutes. It covers the same obligation, applied to a different kind of organisation, with more detail on documentation practices that transfer directly to a small agency.

Browse all Perspectives or get in touch →