Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →A two-person studio is not exempt from the EU AI Act because it is small. What matters is whether the law applies to the studio’s activities, what role it has for each AI system, and the system’s intended purpose and risk category. In 2026, Article 4 also requires providers and deployers to take steps to support AI literacy among people using or operating systems on their behalf. If an AI workflow handles personal data, the studio must separately assess its GDPR obligations.
Does the AI Act apply to a two-person studio?
Headcount alone does not determine whether the Act applies or which duties follow. The analysis depends on the Act’s territorial scope, the studio’s role in relation to a system, and that system’s purpose and risk category. The information in the title is not enough to classify a particular product or feature as high-risk, prohibited, or subject to any complete set of system-specific requirements.
![AI Law and Policy: [Connected eBook]](https://m.media-amazon.com/images/I/41Y7jOay2eL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
Work out the studio’s role for each system
A studio may be a provider when it develops or commissions an AI system and places it on the market or puts it into service under its own name. It may be a deployer when it uses an AI system under its authority. Those roles are not mutually exclusive across a business: the studio could be a deployer for one tool and a provider for a product feature of its own.
Using a third-party AI service does not, by itself, answer every scope question. Identify what the tool does, how the studio uses it, whether the studio offers its own AI system, and where the system is offered or used. Then assess the applicable territorial and system-specific rules. A particular risk classification requires facts about the system and its intended purpose.
#1 Best Overall
What Article 4 requires in 2026
Article 4 requires providers and deployers to take measures to support the AI literacy of staff and other people operating or using AI systems on their behalf. Measures should reflect people’s technical knowledge, experience, education and training; the context in which the system is used; and the people affected by that use.
The European Commission says Article 4 has applied since 2 February 2025, and national market surveillance authorities began supervising and enforcing it on 2 August 2026. The consolidated Act dated 27 July 2026 makes clear that the obligation is to take suitable measures, not to guarantee a particular proficiency level for every individual. Article 4 states: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”
Rank #2
Make literacy support fit the work
For a small studio, a proportionate approach is to identify who uses each system, what they need to understand to use it responsibly, and what risks are relevant in that workflow. For example, the support for a person using an AI feature to draft internal text may differ from the support needed by someone operating a feature that affects customers. The law does not prescribe a particular course or record format. Keeping a sensible record of the measures taken is a practical way to show what the studio did, rather than a specific Article 4 format requirement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Third-party models and the studio’s own system are different layers
The Commission’s overview lists obligations for providers of general-purpose AI (GPAI) models, including technical documentation, a copyright policy, and publication of a summary of training content. It also lists additional requirements for GPAI models with systemic risk. These are model-provider duties; a studio that integrates a third-party model should not assume it has automatically inherited every obligation imposed on that model’s provider.
That distinction does not remove the studio’s own responsibilities. If it uses an AI system under its authority, it may have duties as a deployer. If it develops or commissions a system and offers or puts it into service under its name, it may have duties as a provider. Assess the studio’s role and the intended purpose of its own system separately from the obligations that apply upstream to a model provider.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.The database issue is a separate GDPR question
The AI Act does not replace the GDPR. If a studio’s database or AI workflow processes personal data, it needs to assess data-protection duties independently. The database issue is not a separate, specially named AI Act obligation; it is the often-overlooked work of understanding what personal data the product handles and how that processing is governed.
Rank #4
Map the personal data and its use
Identify what personal data enters the database or AI workflow, why it is processed, where it came from, and how it is used. The Commission’s GDPR guidance describes transparency duties, including providing information about data sources in relevant cases where personal data was obtained from somewhere other than the person concerned. The exact information owed depends on the processing and circumstances.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build privacy into database decisions
The Commission’s guidance also describes privacy by design and by default: limit processing to what is necessary, keep data only for as long as needed, and restrict access to people who require it. In practical terms, the studio should be able to explain why each category of personal data is stored, who can access it, and how long it remains. These are GDPR considerations, not a substitute for assessing any AI Act duties that apply to the system.
Quick Recap
A practical first-pass review
- List the systems and features. For each one, note its intended purpose, users, affected people, and where it is offered or used.
- Assign the studio’s role per use. Decide whether the studio is acting as provider, deployer, or both; do not use the number of employees as a proxy for that decision.
- Check for system-specific duties. Use the system’s purpose and actual facts to determine whether a risk-specific or other AI Act requirement applies. Do not infer a risk category from the studio’s size or the title of a product.
- Choose contextual literacy measures. Identify who operates or uses systems on the studio’s behalf and what support suits their knowledge, use context, and the people affected. Keep a sensible record of the measures without treating any particular record format as mandated by Article 4.
- Trace personal data through the workflow. Review transparency, data minimisation, retention, and access controls under the GDPR where personal data is processed.
- Verify the current rules for the specific case. Check the consolidated legal text and relevant national supervisory guidance before making a case-specific compliance decision, since implementation materials and law may change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
