Your agencies are inside your Article 4 scope
Every guide to Article 4 of the EU AI Act quotes the same phrase, and almost none of them stops on it. The literacy obligation covers your staff — and “other persons dealing with the operation and use of AI systems on their behalf” (Article 4, Regulation (EU) 2024/1689). The June 2026 amendments softened the duty from ensuring a literacy level to supporting its development — but they kept this scope. The people the measures are for were never just your employees.
Who is acting “on your behalf”
The freelance developer with access to your repository. The marketing agency drafting your campaign from a brief full of customer insight. The outsourced support team answering your tickets under your name. The consultant building your board deck. If they use AI systems while doing your work — and in 2026, they do — they are dealing with the operation and use of AI on your behalf.
Notice what that means: their AI habits are inside your obligation, even though they are outside your HR system, your onboarding, and usually your line of sight.
The same gap, seen from the GDPR side
The AI Act is not the sharp end here. If your agency pastes your customer data into a personal AI account, the bring-your-own-AI problem becomes a chain problem: you engaged a processor, and your processor quietly engaged another one — an AI vendor with no agreement in your chain. Article 28 GDPR requires your authorization for sub-processors, and personal AI accounts come with no processing agreement at all. Your data protection exposure travels with the data, whoever’s laptop it left from.
What “supporting” external literacy looks like
You cannot run an agency’s training program, and the amended Article 4 does not ask you to. It asks for proportionate measures. For externals, that looks like:
- Ask the question in selection. Before engagement: which AI tools do you use on client work, on which accounts, with what data-handling setup? An agency that cannot answer is telling you something.
- Put AI use in the contract. Approved tools and account tiers, data classes that never enter an AI system, disclosure when AI materially produces the deliverable, and your right to ask again. This doubles as your GDPR sub-processing authorization, made explicit.
- Brief them like staff, scaled down. Externals working with your data should see the same baseline rules your employees learn — what your organization pastes where, and why. One structured briefing, recorded, is a proportionate measure; silence is not.
- Keep the record. Who was briefed, on what, when. The obligation is effort — and effort is proven by records, for externals exactly as for staff.
The quiet upside
Most companies have not read the phrase, so most supplier conversations about AI are still awkward improvisation. Arriving with a one-page AI clause and a briefing your suppliers can complete in an hour is not bureaucracy — it is the professional version of a conversation that is coming either way, and it tends to impress the suppliers worth keeping.
Our readiness program covers the baseline that externals can complete alongside your staff — same policy, same rules, evidence per person, whoever employs them. If your delivery model leans on agencies and freelancers, book a walkthrough and bring your supplier list.
Ulern builds readiness and evidence. This post explains the obligation in plain terms — it is not legal advice.