Article 4 of the EU AI Act has applied to anyone using AI professionally since 2 February 2025, freelancers included. On 27 July 2026 the Digital Omnibus rewrote it: you no longer have to "ensure a sufficient level" of AI literacy, only "take measures to support" it, and nobody has to guarantee a specific level for any individual. The duty itself stayed. Since 2 August 2026 national authorities, in Germany the Bundesnetzagentur, can enforce it. For a one-person business that means a one-page AI-use note and a short record of what you learned. No certificate, no course.
If you use ChatGPT, Claude, Copilot or Midjourney for client work, you are a "deployer" under the EU AI Act, and Article 4 has applied to you since 2 February 2025. Over the summer, headlines said Brussels had walked it back. Half right. The wording got softer on 27 July 2026. The obligation stayed, and enforcement began a week later.
What Article 4 asked in 2025
The original text required providers and deployers to "ensure, to their best extent, a sufficient level of AI literacy" among their staff and anyone using AI systems on their behalf. That "sufficient level" was the problem. Nobody defined it, and a training industry formed around the gap.
Two definitions in Article 3 decide whether this concerns you. A deployer is "a natural or legal person ... using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity". Drafting a client proposal with an AI assistant is professional. So a freelancer is a deployer, staff or no staff. AI literacy, in point (56), is the knowledge and skills to "make an informed deployment of AI systems" and to be aware of "the opportunities and risks of AI and possible harm it can cause".
What changed on 27 July 2026
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on 8 July 2026, published in the Official Journal on 24 July and, per White & Case, entered into force on 27 July. It replaced Article 4 with a three-paragraph version. The core sentence now reads: providers and deployers "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". And then the sentence that matters for small businesses:
"This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." (Article 4, Regulation (EU) 2024/1689 as amended)
Paragraph 2 obliges the Commission and Member States to support providers and deployers with guidance and examples. Paragraph 3 asks the AI Board for recommendations. The recital behind the change says openly that the old duty created "an additional compliance burden, particularly for smaller enterprises". As lawandtechnology.eu puts it, a results duty became a means duty. You have to do something reasonable. You do not have to prove an outcome.
One thing did not move: the date. The high-risk deadlines were pushed to 2 December 2027 and 2 August 2028. Article 4 is not in that chapter.
What did not change: enforcement started anyway
The Commission's AI literacy FAQ, updated 27 July 2026, is the closest thing to an official reading. National market surveillance authorities "will start supervising and enforcing the rules as of 2 August 2026", and they "could impose penalties and other enforcement measures to sanction infringements of Article 4". The FAQ adds that enforcement becomes more likely where an incident can be traced to a lack of training. In Germany the authority is the Bundesnetzagentur, since the German implementing act took effect on 29 July 2026, and it runs a KI-Servicedesk for small businesses.
Nobody is planning door-to-door checks of freelancers. But the duty is enforceable, and the FAQ's own example is close to home: a company whose staff use ChatGPT to write ad copy or translate texts is covered and should know about "the specific risks, for example hallucination". Swap "staff" for "you".
What a one-person deployer actually does
Conclusion first: the FAQ says there is "no one size fit all" and "no strict requirements or mandatory trainings". It says explicitly: "There is no need for a certificate. Organisations can keep an internal record of trainings and/or other guiding initiatives." For a solo business, two documents cover it.
1. A one-page AI-use note. Four questions in plain language. Which AI tools do I use for client work, and for what? What is my role (deployer, in almost every case)? What are the risks: hallucinated facts, copyright in generated material, client data in a third-party tool? What do I do about each: fact-check before delivery, no confidential client data in consumer tools, human review of everything that leaves the door. Date it. Update it when you add a tool.
2. A training record. A dated list: provider documentation you read, a webinar you watched, a test you ran. Half a page a year is plenty. The FAQ's minimum is a general understanding of AI, your role as deployer, and the risks of the systems you use. If you can explain why a language model invents sources, you are past the bar.
The FAQ notes that contractors working for a deployer "need to have the appropriate AI skills to fulfil the task in question", so expect larger clients to ask for exactly this note. Send it before they ask. If you deliver AI-generated content, the labelling rules in Article 50 and the question of whether to tell clients you use AI belong on the same page.
What you do not need: a paid certificate, an "AI officer", or a course with a badge. None of those appear in the law or the FAQ.
What to do on Monday
- Write the one-page AI-use note. Tools, role, risks, measures. Thirty minutes.
- Start the training record with what you already did this year. Back-date honestly.
- Add a "no confidential client data in consumer AI tools" line to the note. It is the risk clients ask about first.
- Save the Commission FAQ and the Bundesnetzagentur KI-Servicedesk link next to the note, so you can show your reasoning and its source.
- Diary a yearly review. Article 4 is now a means duty; a dated update is the means.
When a client asks how you work with AI, and more of them do, a free 9am profile is a good place to say it in one sentence. The note above is what backs it up.
This article is general information for practitioners and does not replace legal advice.
