What Article 4 actually requires of a 10-person company

If you run a small studio, agency, or SaaS with about ten people, the EU AI Act can feel like a problem for someone else. Most of it is written for big providers and high-risk systems, and most of it is phased in later, with transparency duties from 2 August 2026 and the heavier high-risk obligations not until 2 December 2027. But one duty already applies, it is short, and it names you directly. That is Article 4, the AI literacy obligation. This is a plain, practical guide to what it actually asks of a genuinely tiny team with no compliance function, and how to meet it without turning your week upside down.

What Article 4 actually says

Strip away the legal phrasing and Article 4 says something simple. Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and any other people who operate or use AI on their behalf.

Almost every small business is a deployer, meaning you use AI systems under your own authority in your professional work. You did not build the model, you use it. That still puts you squarely inside Article 4.

The important word is proportionate. The obligation is explicitly shaped by context. It takes into account the technical knowledge, experience, education, and training of the people involved, the way the AI is being used, and the people it is used on. A ten-person design studio using a writing assistant is not being asked for the same thing as a bank running credit-scoring models. The law knows the difference and tells you to scale your effort accordingly.

There is one thing Article 4 does not do, and it matters. It does not prescribe a specific course, a certificate, or an accredited exam. There is no official Article 4 badge you must buy. What it asks for is that the people using AI understand enough to use it responsibly and to spot its risks, and that you can show you made a reasonable, role-appropriate effort to get them there.

Who it covers, including your freelancers

This is the part small teams miss. Article 4 does not stop at your payroll. It covers your staff and any other person operating or using AI systems on your behalf.

For a ten-person studio, "on your behalf" usually pulls in more people than you think:

• The freelance copywriter who runs your briefs through a language model.
• The contract designer generating image drafts for a client project.
• The part-time virtual assistant using an AI tool to triage your inbox.
• The developer on a short contract who codes with an AI pair-programmer on your product.

If someone uses AI as part of work they do for you, they fall inside the duty. You do not have to enrol a freelancer in a full staff programme, but you cannot pretend they are invisible either. The proportionate answer is usually a short briefing, a link to your usage rules, and a note that you shared it. More on the evidence side below.

What "sufficient AI literacy" looks like for a ten-person team

Sufficient is a level, not a syllabus. For a small deployer using everyday tools, a genuinely sufficient level means the people using AI can do a handful of concrete things.

• Know what they are using. They can name the AI tools they use for work and roughly what each one does.
• Understand the limits. They know these systems can be confidently wrong, can invent facts and sources, and can reflect bias in their training data. They check important output rather than trusting it.
• Handle data sensibly. They know not to paste client secrets, personal data, or confidential material into tools that may reuse it, and they know which tools are approved for what.
• Be honest about AI output. They understand when AI use needs to be disclosed, for example a chatbot telling people they are talking to a machine, or synthetic media being labelled as such.
• Know when to escalate. They know which uses are off-limits and who to ask when something feels wrong.

That is it. You are not training machine-learning engineers. You are making sure the people in your studio use these tools with their eyes open. For most roles this is an hour of focused attention, not a semester.

A concrete step-by-step

Here is a plan a busy owner can run in an afternoon or two, no compliance department required.

1. Map the AI you use. List every AI tool in active use across the team: the writing assistants, the image generators, the transcription tool, the AI features baked into software you already pay for. For each one, note who uses it and for what. This single list does most of the work.
2. Sort each tool by risk. Most small-studio tools are minimal risk, which carries no special legal duties beyond this one. Flag anything that touches hiring, evaluating staff, or access to essential services, because those areas can be high-risk and deserve a closer look before 2 December 2027, the date to which the 2026 Digital Omnibus moved the high-risk obligations.
3. Brief each role. A designer, a writer, and an account manager use AI differently, so tailor the message. Keep it to the risks and rules that matter for what that person actually does.
4. Run a short training. One session, or a short recorded walkthrough, covering the limits, the data rules, the disclosure rules, and who to ask. Include freelancers who use AI for you, even if that just means sending them the same material.
5. Write down what you did. Dates, who attended, what you covered, the tool list, and your simple usage rules. This written record is what turns "we did something" into "we can show it."

The myths that trip up small teams

A few comfortable assumptions get small businesses into trouble here. All three are wrong.

• "We are too small for this." Article 4 applies regardless of company size or risk tier. There is no headcount threshold and no small-business exemption. A two-person team using AI is covered exactly like a two-thousand-person one. The effort scales down, the duty does not disappear.
• "We only use common, mainstream tools." Popular does not mean risk-free. The best-known assistants still hallucinate, still mishandle sensitive data if you feed it to them, and still produce output that may need disclosure. The duty is about your people understanding the tools, not about which brand is on them.
• "There is no audit, so it does not matter." Enforcement is national and still ramping up, but the obligation is live now, and the penalty framework and national authorities came into effect on 2 August 2025. More practically, the people most likely to ask what you did are not regulators. They are clients writing AI clauses into contracts, insurers, and partners doing due diligence. Being able to answer them is a commercial asset, not just a legal shield.

What evidence to keep

Because Article 4 asks for a reasonable, role-appropriate effort, your protection is being able to show that effort. For a ten-person team, four simple artefacts cover it comfortably.

• A risk-classified tool inventory. The list from step one, with each tool sorted by risk. This is the backbone of everything else.
• Role-based training with dates. A record of who was trained, when, and on what, including the freelancers who use AI for you. Dated certificates or a simple attendance log both work.
• An AI usage policy. A short, plain document setting out which tools are approved, what must never be pasted into them, and when AI use must be disclosed.
• A dated compliance record. A single bundle of the above that you can hand to a client, insurer, partner, or regulator without scrambling.

None of this needs to be elaborate. A shared folder with four up-to-date files beats a polished policy no one can find. The point is that on the day someone asks, the answer already exists.

This is the gap Klaar is built to close for small European teams: it helps you build the tool inventory, run role-based training, keep the usage policy current, and hold it all in one dated record you can actually hand over. But whether you use a tool or a shared drive, the shape of the job is the same. Map what you use, make sure your people understand it, write down what you did, and keep it current. For a ten-person studio, that is not a compliance project. It is an afternoon that makes the rest of the AI Act far less frightening when its bigger deadlines arrive.