Most marketing teams can produce the spreadsheet in about four minutes. Tools we use: the copy assistant, the image generator, the bid optimizer, the thing that writes product descriptions at scale, and the chatbot on the pricing page. Owner, license, and monthly cost. It looks like governance. It's an inventory.
Now ask a different question. If a generated ad claim, an audience segment, or a product recommendation goes wrong, who on the team can show they knew enough to stop it? A year ago that was a training-day icebreaker. Since February 2025, Article 4 of the EU AI Act has required organizations that use AI systems to take measures to support the AI literacy of the people using them, and since August 2026, national authorities have been able to supervise and enforce it. The tool list doesn't answer the question. A record of who can challenge the output does.
This isn't legal advice, and you'll see me say "ask counsel" more than once. It's a readiness audit for a marketing team that already uses AI every day and would struggle today to prove that anyone was qualified to say no.
The rule is about people using systems, not the systems list
Start with what the text actually asks, because most of the alarm around it comes from people who haven't read it. Article 4 takes about a minute, and the European Commission's own AI literacy Q&A is the plainest guide to it. Providers and deployers of AI systems have to take measures to support the AI literacy of their staff and of other people using AI on their behalf, which can include contractors and service providers. What counts as appropriate depends on the people's existing knowledge, the system, the context it's used in, and the people it's used on.
Two caveats, before anyone panics. The first is about what the rule doesn't demand. Since the Digital Omnibus amendments came into force in July 2026, there is no mandated level of literacy, no certificate, and no required governance structure; the Q&A says all three outright. The second is about who is watching. Enforcement belongs to each country's market surveillance authority, not the AI Office, which the Commission's AI skills and literacy page sets out, and any sanction has to be proportionate.
The line that matters most to marketers is buried in the middle of the Q&A. Asked whether a company whose staff use ChatGPT to write advertisement text has to comply, the Commission answers yes and says those people should be informed about the specific risks, and hallucinations among them. Read that as a description of the obligation. It attaches to the people using the tools: whether they understand what the output can get wrong, and whether you can show that they do.
Marketing has more AI decisions than it admits
Sit in on a Tuesday stand-up and count. A generated headline claims results. A lookalike audience quietly excludes a group nobody chose to exclude. Product-feed descriptions get rewritten at scale, and one of the three hundred invents a feature. The personalization engine has decided what a returning visitor is worth, the bidding tool has moved spend overnight, and at three in the morning an automation either paused a campaign or didn't. Each of those is a decision. "The AI suggested it" is not an approval, though it's doing a lot of work as one.
The numbers say the tools got there before the judgment did. Gartner's 2026 CMO Spend Survey found CMOs are putting 15.3% of budgets into AI, while only 30% report mature readiness, and 70% admit their processes aren't ready to scale it. Canva's State of Marketing & AI report puts daily AI use among marketing leaders at 97%. Nobody is waiting for the readiness to catch up.
TechWyse has made the point before, from the content side. Editing an AI draft for accuracy, tone, and misinformation is a skill of its own, and human-led AI workflows exist because a review step needs a reviewer who can tell accurate from plausible. Article 4 turns that editorial instinct into something a regulator can ask about.
A training receipt is weaker than a capability record
The first thing most teams do is book a course. Everyone completes the AI awareness module, the LMS emails a certificate, and a folder fills up with PDFs. A completion badge is comforting until someone asks what it proves. It proves attendance. Attendance says nothing about whether the paid-media lead can look at a segment the model built and see that it drifted toward a protected trait, or whether the content manager knows which product claims need a source before they ship.
The Commission is doing you a favour here. Because no certificate is required and no level is mandated, you don't have to invent a credential. You have to keep a record that fits your team, and the Q&A puts it plainly: organizations can keep an internal record of trainings and other guiding initiatives. The useful version of that record is about capability, not attendance. For each role, it says which AI tools the person uses and which decisions they make with them, what they need to understand to challenge the output, what guidance they were given, what evidence shows they've reviewed real outputs, and when the record was last refreshed.
That's a skills map, and it looks nothing like the tool inventory. The inventory lists systems; the map lists people and the judgment each one is trusted to exercise.
Map AI literacy to the decisions that can hurt someone
You can build the map in an afternoon with a spreadsheet, provided the list is honest about where AI output reaches a customer without a person reading it first. For each use case, write down the role that owns it, who is affected if it goes wrong, how it fails, what judgment the owner needs, who keeps the evidence, and how often it's checked.
Figure 1. Five common marketing AI decisions mapped to the role, the failure mode, the judgment required and
the evidence owner.
Source: Original table by Shanice Jones, adapted from the European Commission's AI Literacy Questions & Answers.
The rows aren't equally hard. Claims validation is the easy one: before generated creative goes live, the content lead needs to know which claims need substantiation and where the source lives, and most teams already half-do this. Targeting is harder, because reading an audience definition and spotting a proxy for a sensitive trait is a skill few paid-media people have been taught. Personalization is a policy question dressed as a technical one.
Somebody has to decide what the engine may infer about a visitor, and the Canva research found 58% of consumers don't want brands using AI to predict their needs, so "as much as it can" is not a defensible answer. Landing-page approval means one person reading the AI-written page for the offer that doesn't exist. Stop conditions are the row teams forget: a number at which the automation gets switched off, and a named person with the access to do it.
The riskiest row is rarely the fanciest system. More often it's the least visible approval step, the one that happens inside a tool nobody thinks of as AI. The Commission's guidance keeps pulling attention back to the context of use and the people affected, and that's the right lens for a marketing team: not "how clever is this model" but "who is on the other end of this decision, and who here would notice if it went wrong."
Keep the legal claim out of the marketing workflow
Here is the boundary I'd draw in thick marker. The marketing team keeps evidence; it does not declare the company compliant. Whether the organization is in scope, what counts as a high-risk use, and what the national authority will expect are questions for legal and compliance. A marketing lead who answers them from a skills spreadsheet has taken on a job they weren't hired for.
The team's job is narrower and more useful: keep the capability record current, document who approved what, avoid claims that can't be substantiated, and route the uncertain cases upward. A practical escalation rule covers most of it. If an AI-assisted decision affects a person's access to something, the price they see, their eligibility, a sensitive trait, a vulnerable group, or a legal claim, it doesn't stay inside the campaign team. The decision goes to whoever owns risk, with the record attached.
High-risk systems carry their own oversight duties under the Act, and deployers of those systems still have to train staff to exercise human oversight. Most marketing uses won't fall there. The escalation rule exists for the few that might, so that they reach someone whose job it is to decide. TechWyse's guidance on agentic campaign tools already asks for protocols for scenarios that need human judgment; this is the same idea with a compliance owner at the end of it.
What proof looks like before an AI campaign goes live
Write it down before launch, not after. The evidence is a record of this campaign, not the company's AI policy, and in practice it comes to nine items. Most teams have half of them scattered across tickets and chat threads already.
- The tool and the use case, named specifically. "Copy assistant, product-description rewrite for the autumn range," not "AI."
- The role that owns the decision, and the person in it today.
- The skill that role needs to challenge the output, in one sentence.
- Evidence that the person has the guidance or training the record says they need.
- The approval gate: who signs off before the output reaches a customer.
- The output review: what was checked, and the sample or the full set.
- The targeting check, where an audience was built or narrowed.
- The stop condition: the number, and who can pull it.
- The next review date, because the model, the tool, the campaign, and the person in the role will all change.
Figure 2. The pre-launch check: AI-assisted output, owner review, risk check, escalation where the decision affects access, price, eligibility or a sensitive trait, then launch or stop, with the record updated either way.
Source: Original diagram by Shanice Jones, based on the European Commission's AI Literacy Questions & Answers and TechWyse's human-led AI workflow guidance.
The record has to be kept alive, and that's the part teams underestimate. The Commission's guidance keeps returning to change: the speed of the technology, the differences between people, and the same tool used in a new context. A skills map built in January is wrong by June if two people moved roles and the tool shipped a new model. Teams that already keep role-based training records can extend them. Skills management software can keep the required skills, training status, and gaps visible across campaign roles in one place, which beats reconstructing them from inboxes when someone asks. The software organizes the evidence. It doesn't make the legal decision, and a full skills matrix is still not a certificate.
Make the human check visible
Strip the rest away and the test is small. AI literacy isn't the slide deck, and it isn't the tool list. It's the team's ability to look at an output in context and say "that claim needs a source," "that audience is a proxy," or "switch it off," and to have that moment leave a trace.
So, before anything AI-assisted goes live, know who approved the decision, what they checked, and where the evidence lives. With those three answers on file, the conversation with counsel starts from evidence instead of assurances. Without them, the campaign is running on a human check that nobody can see, and a human check nobody can see is the one thing this rule was written to end.
For the latest digital marketing news, check out our blog. To book an appointment, call 416-410-7090 or contact us here.
FAQs
Does Article 4 require an AI literacy certificate?
No. The Commission's Q&A says there is no need for a certificate, and since the July 2026 amendments, no specific level of literacy is mandated. Organizations can keep an internal record of training and guidance instead. What that record should contain depends on the tools, the context, and the people affected, which is why a role-specific capability record is more useful than a badge.
Is a tool inventory enough to prove AI literacy?
No. An inventory shows which systems exist. It says nothing about whether the people using them understand what the output can get wrong or have the judgment to challenge it. Keep the inventory, but treat it as one column in a record that also names the role, the decision, the required skill, the guidance given, and the review evidence.
What should a marketing team document before using AI in a campaign?
The tool and use case, the owner, the skill the owner needs, the guidance or training they've had, the approval gate, what was reviewed, the targeting check, the stop condition, and the next review date. Keep it per campaign, not per policy.
Does this apply to agencies serving EU clients?
Ask counsel, and don't assume the answer is no. The Commission's Q&A says the AI Act applies to actors inside and outside the EU where an AI system is used in the Union or affects people located there. It also says "other persons" acting on a deployer's behalf can include contractors and service providers. An agency running AI-assisted campaigns for EU audiences should expect the question.
