Article

EU AI Act for marketing agencies: what already applies to your team?

Marketing agencies are among the heaviest AI users. That means the AI literacy obligation hits your team harder than average — even though your tools do not fall under high-risk AI.

Written by Loek Delahaye, founder, Delahaye Solutions · ex-CTO with 10+ years in software and AIPublished:
Short answer
  • Creative AI tools such as Canva AI, Midjourney, and ChatGPT for copywriting do not fall under Annex III (high-risk AI) of the EU AI Act — so the obligation is simpler than for HR software or credit scoring.
  • But Article 4 (AI literacy) already applies to every team member who uses AI tools in their work. This has been mandatory since 2 February 2025.
  • As a deployer, you are responsible for AI use in your agency — even if you buy the tools from Adobe, Canva, or OpenAI.
  • Three steps: carry out an AI inventory of your tools, record it in an AI register, and provide documented role-specific AI literacy training to your team.

Marketing agencies are heavy AI users — with a matching compliance duty

No sector uses AI as broadly as marketing and communications. Copywriters work with ChatGPT and Jasper. Designers generate with Midjourney and Adobe Firefly. Marketers automate campaigns using AI tools in their platforms. Social media teams plan and optimise with AI features in Hootsuite, Buffer, or Meta Business Suite. That is good news for productivity — but it also means the EU AI Act hits your team harder than the average office. Article 4, the AI literacy obligation, already applies to everyone using AI tools. And because your team uses AI broadly, there are more people, more tools, and more roles you need to document.

What the Act requires from you

Three things marketing agencies need to know

The good news: creative AI tools are legally simpler than HR software or credit scoring. The consideration: your usage is so broad that your documentation obligation is proportionally larger.

Creative AI tools are not Annex III high-risk AI

Annex III of the EU AI Act lists high-risk AI systems. That list covers biometric identification, critical infrastructure, education, personnel selection (HR), credit assessment, law enforcement, and migration management. An AI tool that writes marketing copy, generates images, or optimises campaigns does not fall under any of these categories. That means you do not have to maintain a high-risk AI system register, designate human oversight per decision, or comply with the heavier Annex III obligations. Your compliance path is therefore simpler than for an HR agency using AI for CV screening.

Article 4 does apply — to everyone in your team who uses AI

Article 4 of the EU AI Act requires you to ensure that every employee who uses AI tools has adequate AI literacy: they understand how the tools work, know the limitations, and are aware of the risks. This obligation has applied since 2 February 2025 and is not limited to high-risk AI. A copywriter using ChatGPT for client content, a designer using Midjourney for campaign images, a strategist running AI analysis on campaign data — all of them fall under this obligation. And at a marketing agency, that is often many people at once.

As a deployer, you are responsible for AI use in your agency

You buy the tools from Adobe, Canva, or OpenAI — but as a deployer you are responsible for how that AI is used within your agency. That means ensuring your team is adequately trained, keeping track of which tools are used and for what purpose, and documenting this. The AI tool's supplier has its own obligations as a provider; you have additional obligations as a deployer. Fines for non-compliance with the AI literacy obligation can reach €15 million or 3% of worldwide annual turnover, whichever is higher. The EU is working on a possible deferral or simplification for smaller businesses via the 'Digital Omnibus' (November 2025), but that proposal has not yet been definitively adopted.

Three concrete steps

How to tackle AI literacy in your agency

The documentation obligation is larger for marketing agencies than average, but the steps are straightforward. (1) Carry out an AI inventory — map out which AI tools your team uses. That is not just the big names (ChatGPT, Midjourney, Canva AI); AI features within existing tools also count (Adobe Firefly in Photoshop, AI suggestions in Google Ads, sentiment analysis in your SEO tool). (2) Record this in an AI register — per tool: what does the AI do, who on your team uses it and for what type of work? (3) Provide role-specific AI literacy training — a copywriter faces different AI risks and opportunities than a media buyer or strategist. Document that you did this. With these three steps you comply with the core of what Article 4 requires, even for an agency with heavy AI use.

Frequently asked questions

Frequently asked questions about the EU AI Act for marketing agencies

Does Canva AI, Midjourney or ChatGPT fall under the EU AI Act?
Yes — but not as high-risk AI. These tools do fall under the EU AI Act (as AI systems), but not under Annex III (the high-risk categories). The obligation that applies to you as a user is Article 4: AI literacy. That means every team member using these tools must have documented training on how they work and what the risks are. The heavier Annex III obligations (human oversight, technical documentation, risk registration) do not apply to this category of tools.
What do creative employees need to know about AI — what counts as AI literacy?
Article 4 does not prescribe fixed content, but the obligation is role-specific. A copywriter using ChatGPT for client content needs to understand at minimum: how the model generates text, that output is not always factually correct, what the risks of copyright and hallucinations are, and how to critically evaluate the output. A designer using Midjourney: how image generation works, what licensing rules apply for commercial use, and how to use AI images transparently with clients. The training does not have to be extensive — but it must be documented and role-tailored.
We are a small agency with 3-5 people — does the obligation apply to us too?
Yes. Article 4 has no minimum size: it applies to every organisation that uses AI tools, from a sole trader to a multinational. For small agencies, the documentation is also lighter — an AI register and a short internal training per role is already a strong foundation. The obligation has applied since 2 February 2025; enforcement starts on 2 August 2026.
When does our agency need to have everything in order?
Since 2 February 2025. Article 4 (AI literacy) already applies, regardless of the enforcement start date. National supervisory authorities receive their enforcement powers on 2 August 2026. That is the moment when inspections can begin, not when the obligation kicks in. The more AI use in your agency, the stronger the reason to get this sorted now.
How quickly can we become compliant?
With Delahaye Solutions' AI Act Scan you can be compliant in about a week: we inventory your AI usage per role, draw up an AI register and AI policy, and provide tailored AI literacy training for your team. We deliver an audit-ready dossier. Fixed price: €750 for small agencies and freelancers; €1,500 for agencies with 10-50 employees.
Read more

Get AI literacy sorted for your agency?

Book a free intake for the AI Act Scan. We look together at your AI tools, the documentation obligation, and what your agency needs — no commitment.

Book a free AI Act intake →

Free and without obligation · Reply within one business day · Fixed price up front, no surprises