AI Act for Service Companies and Agencies

The AI Act for service companies and agencies means that any marketing, consulting, design, translation, accounting, or IT service company whose employees use AI tools (such as ChatGPT, Copilot, Midjourney, or Claude) must take measures to support the development of AI literacy among their employees and relevant persons. This is governed by Article 4 of the EU AI Act (Regulation (EU) 2024/1689), which has applied since 2 February 2025 across the European Union, including the smallest service agencies. For service businesses, it is also important to clearly distinguish when AI is used for internal work and when it is used to create deliverables for clients. The measures required depend on employees’ knowledge, experience, training, the context of use, and the individuals affected by the AI usage.

The service sector is in a unique position because AI has often become an invisible part of daily work: copywriters write texts with ChatGPT, designers generate images, project managers create summaries, and programmers write code with Copilot. It is precisely because of this widespread adoption that the requirements are particularly relevant for service companies compared to many other sectors.

Does the AI Act even apply to my service company?

Yes - if your employees or contractors use any AI tool to provide services, you are considered a "deployer" of an AI system under Regulation (EU) 2024/1689. Deployer status applies regardless of company size: even a 2 - 3 person agency falls under the regulation. For more details on who and when the obligations apply, read the article Who does the EU AI Act apply to?.

It is important to understand the key dates that determine what and when needs to be done:

For most service companies, the most relevant date is the first one - AI literacy support is already mandatory. The remaining obligations mostly apply only to high-risk AI systems, which a typical agency does not use.

What are the common AI use cases in the service industry?

AI is used more widely in the service industry than most managers realise. A typical list includes:

• Marketing and content - text writing, idea generation, SEO, email drafting using ChatGPT usage in companies
• Design and creativity - generation of visuals, illustrations, layouts; it is important to understand the nuances of AI image generation in companies
• Programming and IT - code writing with Copilot and code tools
• Accounting and administration - invoice processing, data entry; see AI tools in accounting
• Customer service - response preparation, summaries, translations

Each of these use cases is legitimate, but each requires a minimum of order: employees must know what cannot be input into the AI tool (client confidential data, personal data) and how to verify the result before handing it over to the client.

What specific obligations apply to agencies?

For agencies and service companies, the AI Act practically means four things that should be documented. These documents are not mandatory legal requirements, but they are recommended as a practical way to demonstrate that measures to support AI literacy have been taken:

1. AI literacy support. Companies should support staff understanding of the tools they use, their limitations and risks; Article 4 does not require a guaranteed individual level. This can be achieved through structured AI literacy training for employees with knowledge checks. There is no requirement for a specific duration, certificate, or external trainer.
2. AI usage policy. An internal document specifying which tools are allowed, what can and cannot be input into them, and who is responsible. More on this in AI usage policy in companies.
3. AI tools register. A list of which AI tools are actually used, for what purposes, and what data is processed.
4. Compliance record. A practical description of literacy measures: who received training, when, and what internal rules were introduced. There is no requirement for a dedicated AI officer or external audit services.

These four elements are a recommended minimum set to help demonstrate that the company has taken the necessary measures under Article 4. For more details on technical requirements, see Who does the EU AI Act apply to? and the full list of articles.

It is worth noting that literacy does not mean academic knowledge of neural networks. For practical AI literacy development: employees must understand what a specific tool does well, where it makes mistakes, what data goes into it, and how to verify the result. For a three-person design studio, this could be a half-day session with a knowledge check - the important thing is that a record is kept.

What does a good AI usage policy example look like for a service company?

Many managers imagine that a policy must be a ten-page legal document. In reality, even a small agency can get by with a clear, one-to-two-page document that answers specific questions:

Such a policy not only aligns with the spirit of Article 4 but also practically protects the agency from costly mistakes - for example, leaking a client’s financial data into an external tool. You can find examples of specific formulations in the article on AI usage policy in companies.

How does the situation for service companies differ from other sectors?

A key feature of the service business is that AI is often used to create a product that is directly delivered to the client. For example, an e-commerce store uses AI for product descriptions (see AI Act for e-commerce), while an agency uses AI for the very deliverables presented to the client - text, design, code, or strategy. This raises two additional questions.

First - client data confidentiality. If an employee inputs a client’s trade secret or personal data into an AI tool, this may also constitute a GDPR violation. GDPR does not impose a blanket ban on AI use - it requires assessing lawful basis, data minimisation, the use of approved tools, and the implementation of adequate safeguards. For more on how AI and personal data interact under GDPR, see the dedicated article.

Second - authorship and quality. AI-generated results delivered to clients must be verified by a human. The essence of the AI literacy obligation is precisely that employees understand that AI can "hallucinate" and that final responsibility remains with the company.

Another common problem in the service business is so-called shadow AI in companies, where employees use unapproved tools without management knowledge. This is particularly common in service teams, where individual productivity is high and oversight is low.

What to do in practice: step by step

For small service companies, a clear sequence is sufficient. Here is a practical checklist:

• Inventory the tools. Ask the team which AI tools they actually use - the list often surprises.
• Prepare an AI usage policy. Define what can and cannot be input into AI (client data, secrets).
• Train people. Organise AI literacy training with knowledge checks and certificates.
• Record compliance. Keep a record of the measures taken, without treating the document itself as proof of full compliance.
• Update regularly. AI tools change rapidly - documents should be reviewed at least once a year.

The entire implementation process is described in detail in the AI deployment checklist.

A practical tip for service teams: do not start with bans. If the first step is "from tomorrow, AI use is banned until we sort out the rules", employees will simply use the tools in secret - and this is how shadow AI emerges, which you neither see nor control. A better approach is to quickly approve a few safe tools and train employees on how to use them responsibly. Transparency increases both productivity and compliance at the same time.

How much does this cost, and do I need a lawyer?

Service companies often overestimate the complexity of this obligation. For micro-enterprises, in many cases, a standardised, customised document package is sufficient without a separate consultation process. For more on how to achieve compliance without expensive services, see the article Do you need a lawyer for AI compliance?.

For this very purpose, nebedirbam.lt was created - an automated document preparation service for a fixed €149 + VAT (€299) that prepares the entire package: AI usage policy, AI tools register, compliance record, employee AI guide, and AI literacy training with knowledge checks and certificates. Documents are generated automatically from templates reviewed by a compliance specialist. The process is simple: fill out a questionnaire and receive the prepared documents.

If you first want to try the AI literacy training yourself, you can start with free AI literacy training - this is a good first step to help understand how much order your company really lacks. The free path is for one signed-in participant; team training is included in the paid documentation package.

Frequently asked questions from service companies

Does Article 4 apply if we only use the free version of ChatGPT? Yes. What matters is not whether the version is paid or free, but that AI is used in work.

Is one training session enough for the entire team? Measures should address the staff and other persons using AI on the company’s behalf. A shared session may be useful, with extra guidance for different roles and new starters. Records help explain the steps taken; Article 4 does not prescribe one training or documentation format.

Are fines realistic for micro-enterprises? Fines under the AI Act are significant, but the priority is high-risk systems. Nevertheless, the literacy obligation formally applies to everyone, so it should not be ignored. More on AI Act fines and risks.

The official regulation text can be found on the EUR-Lex portal (Regulation (EU) 2024/1689). For the current interpretation of Article 4 and the full AI Act implementation timeline, see the European Commission’s AI Act Service Desk portal ai-act-service-desk.ec.europa.eu and the official Commission website digital-strategy.ec.europa.eu. In the service sector, where AI usage will only grow, early documentation is not a cost but a competitive advantage: you can show it to clients who care about responsible data handling.