AI Act Article 4: What Your SMB Must Do Now

Since February 2, 2025, Article 4 of the EU AI Regulation is in force. It requires any company using AI systems to ensure its personnel possesses a sufficient level of AI mastery.

Not a one-off. Not an annual training. A competency level adapted to each employee's actual usage. That's the exact wording of the regulation.

Most French SMBs are unaware. They let their teams use ChatGPT, Copilot, or Chrome extensions without training, without governance, without any follow-up. Article 4 puts them in non-compliance. And nobody told them.

What Article 4 actually says

The text is clear: providers and deployers of AI systems must "take the necessary measures to ensure that natural persons who use AI systems under their responsibility possess a sufficient level of AI literacy."

In practice, this means:

Every employee who uses an AI tool (even free ones, even personal use on company data) must have received training adapted to their usage.
Training must be regular, not one-off. The rapid evolution of models makes six-month-old knowledge obsolete.
The company must be able to prove it took these measures. In an audit, a signed acknowledgment or a training plan suffices. Complete absence of traceability is the risk.

Concrete risks for an SMB

The regulation provides for fines up to €15 million or 3% of annual turnover for companies that fail to comply. For an SMB, that's a ceiling, but the risk goes beyond fines.

The operational risk is more immediate. An employee who uses an LLM without understanding its limits can inject customer data into a prompt, share confidential information with a model trained on third-party data, or make decisions based on hallucinations without knowing it.

The legal risk also exists. If a client discovers their data was processed by an unframed AI tool, the company is liable. GDPR applies to data injected into models, and Article 4 of the AI Act creates a mastery obligation that strengthens this liability.

Reputation risk. Even a minor incident related to unmastered AI use spreads fast in professional networks. The "company that doesn't control its AI" tag is hard to erase.

What most SMBs do (and why it's not enough)

Three common reactions to AI in SMBs:

Total prohibition. Some companies ban ChatGPT and similar tools. It's the worst response. Teams use the tools anyway, secretly this time, with zero governance. Shadow AI proliferates, and the company loses all visibility.

One-off training. A three-hour workshop, an external trainer, a best-practices PDF. It costs between €2,000 and €5,000. The problem: within three weeks, 80% of participants have implemented nothing. Training without operational support is a theoretical exercise.

Subscribing to an "AI for all" tool. Copilot, a company chatbot, a prompt platform. The tool is there, but nobody knows if it's being used correctly, or if data is governed.

None of these three approaches satisfies Article 4. The text requires a mastery level adapted to actual usage, not generic training or simply providing a tool.

What actually works

The approach that satisfies Article 4 and produces concrete results rests on three pillars:

Micro-training by role. An accountant processing invoices doesn't have the same needs as a sales rep writing proposals. Training must target the tools each profile actually uses, not the same content for everyone.

Ongoing support. Not a single workshop, but a monthly rhythm where each team reviews its real use cases, shares results, and receives adjustments. This is the format that produces lasting behavioral change.

Simple traceability. A dashboard showing who was trained on what, when, and which tools are in production. In an audit, the company pulls out the document and the conversation is over.

How an external AI expert solves this problem

Hiring an internal AI training lead costs between €40,000 and €60,000 a year. And they still need to know the tools, the models, and the specifics of each business function.

An external AI expert works part-time to deploy these three pillars: they map existing usage, deploy targeted micro-training, and install traceability. The cost starts at €990 excl. VAT per month, with no hiring, no setup delay.

The difference with a traditional training course: the expert returns every month, observes what has changed, adjusts, and ensures real mastery keeps pace with tool evolution. This is exactly what Article 4 asks for: a sufficient and maintained level of mastery.