AI literacy plan for a marketing agency

This sample AI literacy plan for a marketing agency demonstrates a practical, lightweight approach to Article 4 of the EU AI Act. A typical 25-person agency using generative AI for client campaigns, social media content, ad copy, image generation, and brainstorming can implement role-specific awareness of prompt engineering, output validation, transparency obligations, bias risks, and disclosure practices. The plan uses short workshops, shared resources, sign-offs, and twice-yearly reviews instead of formal testing or dedicated compliance staff. It creates visible evidence of “sufficient level” literacy tailored to each role’s technical knowledge, experience, and context.[1][2]

This shows that real Article 4 work can start immediately with existing tools and team routines—no giant compliance team required. The example below is illustrative only and does not guarantee compliance.

Current law status (May 2026) Article 4 has applied since 2 February 2025. Providers and deployers must take measures to ensure sufficient AI literacy among staff and other persons (including contractors) dealing with AI systems, taking into account their technical knowledge, experience, education, training, and the specific context of use. There is no legal requirement for formal testing, certificates, or an AI officer. Enforcement sits with national market surveillance authorities and is expected to be proportionate.[1]

A November 2025 Digital Omnibus proposal would replace the mandatory obligation with a requirement for the Commission and Member States to promote AI literacy initiatives. That change remains under negotiation and is not yet law.[3]782651_EN.pdf)

A small marketing agency (22 full-time staff plus distributed freelancers) helps clients with digital campaigns, brand content, social media, SEO copy, and visual assets. The team uses generative AI daily: ChatGPT and Claude for copy and strategy, Midjourney and DALL-E for concepts, Descript or similar for video editing, and analytics tools with AI recommendations.

Who uses AI and for what

• Creative teams generate first drafts, headlines, social captions, and mood boards.
• Client managers incorporate AI insights into pitches and reports.
• Editors review AI outputs for accuracy, brand voice, tone, and compliance with advertising standards.
• Leadership decides which tools to adopt and sets policies on client disclosure.
• Freelancers contribute campaign assets on a project basis.

Public-facing work makes transparency critical—clients and audiences must know when content is AI-generated to avoid misleading claims. Risks include hallucinations in factual claims, unintended bias in imagery or targeting suggestions, copyright questions around training data, and failure to label synthetic content where required.

Why literacy matters even without a giant compliance team Article 4 exists to help people understand AI opportunities and risks so they can use systems responsibly and meet related obligations such as human oversight and transparency. For a marketing agency this means being able to spot when an AI suggestion conflicts with brand values, explain limitations to clients, and document decisions. A simple, role-based plan turns good intentions into demonstrable practice. The European Commission’s repository of AI literacy practices shows many organisations use short modules, workshops, and internal wikis—approaches small agencies can replicate without heavy overhead. Replicating published practices does not automatically prove compliance; records must show measures are tailored and kept up to date.[1]

The agency maintains one living document (a Notion page or shared drive folder) that lists each role, required knowledge, delivery format, and evidence. Training is short and practical—30–60 minute sessions, recorded for async access, plus quick-reference cheat sheets. Content is refreshed when new tools or client requirements appear.

Sample role matrix

This matrix is reviewed and updated at the same time as the wider policy (see below). Leadership assigns one person (often the operations lead) to track completion rates. Training emphasises practical marketing situations: “Does this AI-generated influencer image risk misleading consumers?” or “How do we disclose AI-written blog posts without harming SEO perception?”

All roles receive the same foundational 20-minute video on AI basics, risks, and opportunities, then role-specific modules. Freelancers are treated as “persons dealing with the operation and use of AI systems on behalf of” the agency.[1]

The agency keeps evidence lightweight and centralised so anyone (including a future auditor) can see activity at a glance.

What the internal record looks like

• Master “AI Literacy & Responsible Use” page containing the role matrix, current policy, links to all training recordings, and a log of updates.
• Folder of sign-off forms (leadership, permanent staff, and per-project freelancer acknowledgements).
• Campaign review template that includes a simple dropdown: “AI used? Y/N/Partially” plus reviewer notes.
• Quarterly summary note: “Q1 2026 – 19/22 staff completed refresher; updated prompt library with new bias examples; two client disclosure templates refined after feedback.”

No individual test scores are kept. The focus is on participation, awareness of context-specific risks, and visible application in client work.

Review cadence The full package is reviewed every six months or after any major event (new foundation model release, significant client complaint, or regulatory update). The operations lead spends half a day updating materials and confirming completion rates. Leadership signs off on the summary note. This cadence matches the fast-moving nature of generative AI tools used in marketing.

The agency also maintains a short “lessons learned” log—e.g., “Client X campaign: AI image required extra human retouching to match brand skin-tone expectations”—to feed future training.

• Small agency: The 25-person shop above runs everything in Notion and Slack. Total annual effort is roughly 40–50 staff hours plus leadership oversight.
• Distributed freelancers: The agency sends every new freelancer the onboarding video and a one-page policy before the first brief. Project folders automatically include the signed acknowledgement. Spot checks on 20 % of deliverables ensure the policy is lived.
• Public-facing campaign work: For a consumer brand launch, creatives flag AI-generated hero imagery in internal reviews. Client managers include a disclosure paragraph in the final deck. Editors run outputs through a short internal checklist covering accuracy, fairness, and labelling. The campaign report later notes these steps as evidence of responsible practice.

These examples show how Article 4 literacy supports rather than replaces good marketing hygiene.

Is this enough for Article 4? This sample illustrates one reasonable, proportionate approach for a low-risk marketing use case. Official guidance stresses that measures must be tailored to technical knowledge, experience, and context. The Commission’s repository of practices provides ideas but explicitly states that replicating them does not create a presumption of compliance. National authorities will look at whether you took appropriate measures. We recommend using tools like the AI Literacy Planner to adapt this template and keeping clear records. This is not legal advice.

Do agencies need formal certificates? No. The AI Act does not require formal certificates, accredited courses, or third-party validation of AI literacy. Sufficient internal measures, role-appropriate training, and records of activity are the expectation.[1]

• Treating literacy as a one-time checkbox instead of ongoing, role-specific awareness tied to real client work.
• Excluding freelancers and contractors even though they “deal with AI systems on behalf of” the agency.
• Keeping no central record—scattered Slack messages or email threads do not demonstrate systematic measures.
• Focusing only on technical prompt skills while ignoring marketing-specific risks such as misleading consumers or failing to disclose synthetic content.
• Assuming built-in tool disclaimers or platform terms satisfy the obligation without any internal training or review process.
• Waiting for “official templates” instead of starting with a simple matrix and iterating.

• Map every role that touches generative AI and list the specific tasks they perform.
• Draft a one-page AI responsible-use policy tailored to marketing outputs.
• Build the role matrix above (or customise it) and assign initial training dates.
• Create a central evidence folder or page with sign-off forms and review logs.
• Schedule the first all-hands session and the six-month review cadence.
• Add an “AI use” field to campaign review templates and client briefs.
• Review the latest entries in the Commission’s AI literacy repository for fresh ideas relevant to creative industries.
• Test the plan on one live client project and note what worked.

Ready to adapt this for your agency?

Try the free **AI Literacy Planner to generate a custom matrix in minutes. Upload existing policies or training records to the Evidence Scanner** and see where you already meet Article 4 expectations. Teams that want version history, automated reminders, and shared workspaces can explore options on our Pricing for Try AI Compliance page.

Sources

• European Commission AI Literacy Q&A (digital-strategy.ec.europa.eu)
• AI talent, skills and literacy policy page (digital-strategy.ec.europa.eu)
• AI Act regulatory framework overview (digital-strategy.ec.europa.eu)
• Eur-Lex Regulation (EU) 2024/1689

This sample report is for illustration and proof-of-value. It does not constitute legal advice or guaranteed compliance.