EU AI Act for Small Businesses: What Actually Applies to You
Based on the European Commission's AI Act pages and the AI Act text, consulted on 24 October 2026. This is general information, not legal advice.
Headlines about the EU AI Act tend to lead with huge fines. For a typical small business using a chatbot or an AI writing tool, the reality is much calmer.
First: are you a provider or a deployer?
The AI Act defines a deployer as anyone "using an AI system under its authority," except for personal, non-professional use. If you use ChatGPT, Claude, Gemini or AI features inside your software, you're a deployer.
Providers develop AI systems or place them on the market, and they carry most of the obligations.
The four risk levels
The Commission describes four levels:
- Unacceptable risk: banned. For example, social scoring, harmful manipulation and emotion recognition in workplaces and schools. A ninth ban, on AI that generates non-consensual sexual content or child sexual abuse material, applies from December 2026.
- High risk: strict rules. This includes AI used in employment, such as CV-sorting software, and in credit scoring or education.
- Transparency risk: disclosure duties. For example, telling people they're talking to a chatbot, and labelling deepfakes.
- Minimal or no risk: no new rules. The Commission says "the vast majority of AI systems currently used in the EU fall into this category."
The timeline, after the AI Omnibus
The Commission's simplification package, the "AI Omnibus," entered into force on 27 July 2026 and moved some dates. According to the Commission and its AI Act Service Desk:
| Date | What applies |
|---|---|
| 1 Aug 2024 | AI Act enters into force |
| 2 Feb 2025 | Prohibitions and AI literacy |
| 2 Aug 2025 | Rules for general-purpose AI models |
| 2 Aug 2026 | Most rules, including transparency (Article 50); enforcement starts |
| 2 Dec 2026 | New ban on non-consensual sexual deepfakes and CSAM |
| 2 Dec 2027 | High-risk rules for Annex III areas, such as employment and education |
| 2 Aug 2028 | High-risk rules for AI embedded in regulated products |
What it means for a small business
Check you're not doing anything banned
For most businesses this takes five minutes. For example, emotion-recognition tools aimed at your staff are banned.
Be transparent where it applies
Under Article 50, people must know when they're interacting with an AI system, unless it's obvious. Deployers who publish deepfakes must disclose that the content is artificially generated or manipulated.
Look hard at hiring and credit
If you use AI to screen CVs or assess customers' creditworthiness, you may be using a high-risk system. Those rules apply from 2 December 2027. Ask your vendor now how they'll comply.
Build basic AI literacy
Article 4 requires attention to your staff's AI literacy. The AI Omnibus amended this article, and the Commission and Member States must support SMEs with practical examples. Check the current wording before you plan training.
The penalty numbers, in context
Article 99 sets maximum fines of up to €35 million or 7% of worldwide turnover for banned practices, with lower tiers for other breaches. But for SMEs, including start-ups, each fine is capped at whichever is lower of the amount and the percentage. These are maximums, not typical fines.
A one-afternoon action plan
- List every AI tool you use and what for.
- Flag anything touching hiring, credit, education or biometrics.
- Add a "you're chatting with an AI" notice to any customer-facing bot.
- Decide how you'll label AI-generated images or video you publish.
- Give your team a short briefing on how to use AI safely.
Go deeper
EU AI Act, Without the Scare Tactics separates the penalty myths from the real obligations, covers what's due now versus later, and ends with a one-afternoon action plan.
👉 Find it at bookpilot.org/books
Sources
All consulted on 24 October 2026.