The EU AI Act for small businesses that use AI tools.

The short answer

The AI Act sorts its rules by what an AI system does and who is responsible for it. For a small business that drafts replies with ChatGPT, makes social posts with an image generator or runs a chatbot on its website, most of the Act is about someone else: the companies that build those tools.

What is left for you: make sure people know when they are talking to an AI, label realistic fakes and unreviewed AI text published for the public, help your staff use AI with care, check that no tool you use falls on the high-risk list, and keep following the GDPR. The rest of this guide takes them in turn.

This is general information about the Act as amended in July 2026, not legal advice. Ask your own adviser about your case.

Provider or deployer: which one you are

The Act gives most of its duties to two roles:

• A provider develops an AI system, or has one developed, and puts it on the market or into service under its own name or trademark.
• A deployer uses an AI system under its authority, except for purely personal, non-professional use.

A dental practice that uses an AI tool to draft replies is a deployer. So is a salon that uses an image generator for its posts. A business that has a chatbot built for it and runs it on its website under its own name can be the provider of that chatbot, which matters for the disclosure rule below. If you are not sure, write down for each tool who built it and whose name it runs under.

The Act also reaches businesses outside the EU. Providers and deployers based elsewhere are covered when the output of the AI system is used in the EU, so a US business whose chatbot talks to customers in Europe is in scope.

The dates that matter

• 1 August 2024: the Act entered into force.
• 2 February 2025: the bans on certain AI practices and the AI literacy duty began to apply.
• 2 August 2025: the rules for providers of general-purpose AI models began.
• 27 July 2026: the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force and changed several of the dates and duties below.
• 2 August 2026: most of the Act applies, including the transparency rules for chatbots and AI-generated content.
• 2 December 2026: a new ban applies to AI systems that generate non-consensual intimate content or child sexual abuse material, and providers of generative AI tools already on the market must have their machine-readable marking in place.
• 2 December 2027: the rules for high-risk systems in the areas listed in Annex III, such as recruitment and credit scoring, apply.
• 2 August 2028: the rules for high-risk AI that is part of products covered by EU product safety laws, such as medical devices, apply.

If something you read says the high-risk rules start on 2 August 2026, it was written before the Digital Omnibus moved them.

Chatbots: tell people at the start

Article 50(1) requires AI systems that interact directly with people to be designed so those people are told they are dealing with an AI, unless that is obvious to a reasonably well-informed, observant and careful person. The notice must be clear and distinguishable, given at the latest at the first interaction, and accessible.

The duty sits with the provider. If your chatbot is a product you use under the vendor's name, the vendor carries it. If the chatbot was built for you and runs under your name, it may be you. Either way the fix sits in one place, the first message: "Hi, I'm the automated assistant for Harbour Physio, an AI. I can answer questions about appointments and prices, or take a booking request."

US states have their own versions of this rule. Chatbot disclosure laws compares them, with wording to adapt.

Labelling what AI makes for you

Two labelling duties fall on deployers, which means on you:

• Deepfakes. If you use AI to make or alter an image, audio or video that resembles real people, objects, places or events and would falsely appear authentic, you must disclose that it is artificial. For clearly artistic, satirical or fictional work, a light disclosure that does not spoil it is enough.
• Text on matters of public interest. If you publish AI-generated text to inform the public on matters of public interest, you must disclose it, unless it has gone through human review or editorial control and someone holds editorial responsibility for it. The Commission's guidance says a spell-check does not count as review.

For most small businesses the second duty rarely bites. A salon's price list or a plumber's page about boiler servicing is not news. A clinic's blog post on a public health topic comes closer, and the safe habit is the one the exception describes: a named person reviews every AI-assisted post before it goes out, and the business stands behind it. Does Google penalise AI content? covers the search side of the same habit.

The separate duty to mark AI output in a machine-readable way, under Article 50(2), belongs to the providers of the generative tools, not to you. The 2 December 2026 deadline for tools already on the market is theirs.

AI literacy after the 2026 changes

Article 4 originally required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and others using AI on their behalf. That duty has applied since 2 February 2025.

The Digital Omnibus rewrote it. Since 27 July 2026, providers and deployers must take measures to support the development of AI literacy among their staff and others using AI on their behalf, taking into account their technical knowledge, experience, education and training, the context of use and the people the AI is used on. The new text adds that this does not oblige a business to make any individual reach a particular level. The Commission and the Member States must support businesses in meeting the duty, small ones in particular, and the Commission is to publish practical examples of how to comply.

For a small team, reasonable measures can be simple: a one-page policy that says which tools to use and what never goes in, a short briefing when someone joins or a tool changes, and a note of who attended. An AI policy for staff has the page, ready to copy.

The high-risk rules: who they reach

High-risk is decided by what a system is used for, whatever the tool. The Annex III areas a small business might meet:

• Recruitment: AI that places targeted job adverts, analyses and filters applications or evaluates candidates.
• Managing staff: AI that decides on promotions or terminations, allocates tasks based on behaviour or personal traits, or monitors and evaluates performance.
• Credit: AI that evaluates a person's creditworthiness or sets their credit score, apart from fraud detection.
• Insurance: AI used for risk assessment and pricing of life and health insurance for individuals.

From 2 December 2027, deployers of these systems must use them according to the provider's instructions, give human oversight to people with the competence, training and authority to exercise it, keep the system's logs for at least six months where the logs are under their control, tell workers before using such a system at work, and tell people when it is used to make or help make decisions about them.

Note what is not on the list: a chatbot that answers questions about your services, a writing tool, a scheduling assistant. The justice entry covers AI used by or for courts, or in a similar way in alternative dispute resolution, not a law firm's intake chatbot. The small businesses most likely to be affected are a recruitment agency that screens CVs with AI, a mortgage broker whose tools score applicants, and insurance agencies that price life or health cover with AI.

The bans, in case a tool offers them

Some uses have been banned since February 2025. Most are far from a small business, but one is not: AI that infers the emotions of people at work or in education, except for medical or safety reasons. A call-scoring tool that claims to read your staff's moods from their voices, or a camera system that rates employees' expressions, would fall under it.

Emotion recognition aimed at customers is not banned, but it is on the high-risk list from 2 December 2027, Article 50(3) already requires you to tell the people exposed to it that it is running, and the GDPR applies to the personal data it uses. If a sales pitch promises to tell you how your team or your customers feel, ask the vendor which article of the Act it relies on, and get the answer in writing.

Three businesses, three short lists

The same Act lands very differently depending on what you use AI for:

• A salon in Lyon uses ChatGPT to write captions and an image tool for seasonal posters. It is a deployer. Its list: a staff briefing and one page of rules, and a label on any realistic AI photo of a real person or place. Nothing else in the Act touches it.
• A physiotherapy clinic in Dublin has a booking chatbot built for it, running under the clinic's name. It may be the chatbot's provider, so the first message says the chatbot is an AI. Health details in chats fall under the GDPR's special category rules, which matter more here than anything in the AI Act.
• A recruitment agency in Rotterdam uses a tool that ranks applicants for its clients' vacancies. That is a high-risk use from 2 December 2027. It needs the provider's instructions, a trained person overseeing the rankings, logs kept for at least six months and a notice to candidates that the tool is used, and it should start planning now.

The GDPR has not gone anywhere

The AI Act sits beside data protection law and does not replace it. When staff paste customer details into an AI tool, or your chatbot collects a name and a phone number, the GDPR's usual questions apply: a lawful purpose, a processor contract with the tool's provider, a line in your privacy notice and a retention period. Health information and the other special categories have stricter rules.

Two guides cover this side: Is it safe to put customer data into ChatGPT? for staff use, and the GDPR checklist for your website.

Who enforces it, and what fines look like

Each Member State has market surveillance authorities that enforce the Act, and the Commission's AI Office supervises general-purpose AI models. Fines are capped as a share of worldwide turnover or a fixed amount. For small and medium-sized businesses, the lower of the two caps applies, and authorities must take all relevant circumstances into account when deciding whether to fine and how much.

The realistic risk for a small business that uses AI tools is less a headline fine than a complaint from a customer who felt misled by a chatbot, or a regulator asking what you did about staff using AI. A short written record of what you decided answers both.

A checklist for a small business

• List every AI tool the business uses, who uses it and for what, including AI features inside software you already pay for.
• For each, note whether you are the provider or a deployer.
• Make sure every chatbot or voice agent says it is an AI in its first message.
• Label realistic AI images, audio or video of real people, places or events.
• Have a named person review AI-assisted text before you publish it.
• Write a one-page staff policy and brief everyone on it.
• Check whether any tool screens job applicants, scores credit or prices life or health insurance. If one does, plan for December 2027 with your adviser.
• Check the processor contracts and your privacy notice for every AI tool that sees personal data.
• Look at the list again whenever you add a tool, and at least once a year.

The AI chatbots we build introduce themselves as an automated assistant in their first message, so that line of the checklist is covered from launch.