The EU AI Act for small business owners: what actually applies to you, and when

The EU AI Act for small business: the short answer

The EU AI Act applies to small businesses, with no exemption for size, but for most it asks little. If your staff use AI tools such as ChatGPT or Copilot, the Act calls you a deployer. Your main duty is to help those staff understand the tools. The heavy rules cover high-risk uses, such as screening job applicants, and after the July 2026 amendments they start on 2 December 2027.

This guide is for the owner or operations lead of a small business of 5 to 50 people in the UK or the EU. You use AI already, or plan to, and a supplier has told you the AI Act is now in force. Guides written before July 2026 give dates that no longer hold.

Most guides also miss one point. If you have an AI agent built for you and run it under your own name, the Act treats you as its provider, not the developer. We build AI agents that run in our clients' own accounts, and advise firms on what to automate and what to leave alone, so the question comes up often. For most agents, being the provider adds little.

Does the EU AI Act apply to your business?

It applies if you use AI systems for work in the EU, or if you sit outside the EU and your AI's output is used there. There's no threshold of staff or turnover. Purely personal, non-professional use is outside it; use for your business is not.

Three tests decide it, all in the consolidated text of the Act:

1. You use or build an AI system. Article 3 defines one as a machine-based system that infers from its input how to produce outputs such as content, predictions or decisions. Recital 12 excludes systems that follow rules written solely by people. A rule that sends every invoice above a set amount to a manager isn't an AI system. A step where a language model reads the invoice is. Our comparison of AI agents and workflows explains the difference.
2. You are in the EU, or your AI's output reaches people there. Under Article 2(1)(c), a UK company whose chatbot answers customers in France is covered.
3. You use it for work. The Commission's AI literacy questions and answers give the example of a company whose staff use ChatGPT to write advertising text or translate. That company is covered.

The UK has no equivalent law. It still had no comprehensive legal framework for AI in September 2026, as Lewis Silkin noted on 14 September. A UK firm serving only UK customers answers to existing law, such as the UK GDPR and consumer law.

Deployer or provider: find your role first

Your duties depend on your role, not your size. A deployer uses an AI system under its authority. A provider develops an AI system, or has one developed, and puts it on the market or into service under its own name. "Putting into service" includes your own use, so a firm that has a tool built for itself is that tool's provider.

The third row surprises people. The developer writes the code, but you put the system into service. When we build an agent, the code, the accounts and the documentation are in the client's name, so the client is its provider. An agent that reads invoices adds nothing a deployer doesn't already owe; one that talks to customers or produces content adds the transparency duties below.

The companies behind the models are providers of something else: general-purpose AI models, with their own rules since 2 August 2025. Building on a model through an API doesn't make you a model provider, and most fine-tuning doesn't either. The Commission's guidelines for general-purpose AI providers draw the line at changes that use more than a third of the original model's training compute.

The dates, as amended in July 2026

The EU changed the AI Act's timetable in July 2026. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published on 24 July and entered into force on 27 July 2026. It moved the high-risk rules back, softened the AI literacy duty and added a new ban.

These dates come from Article 113 as amended, and match the Commission's AI Act page. If a supplier says the high-risk rules applied from August 2026, their material predates the change.

If you only use AI tools: what applies to deployers

A deployer of everyday AI tools has three duties today, and a fourth only if a use is high-risk.

1. AI literacy. Take measures so that the people using AI for you understand it well enough for what they do with it. The next section covers what that means.
2. Stay clear of banned practices. Most small firms are nowhere near them, but one catches people out. Since 2 February 2025, the Act has banned AI that infers the emotions of staff at work, except for medical or safety reasons. The Commission's guidelines on prohibited practices count hiring as work, so a video interview tool that reads candidates' emotions is out. Reading mood from written text isn't covered.
3. Label deepfakes. AI-made images, audio or video that look like real people, places or events, and could pass as genuine, must be disclosed as AI-made (Article 50(4)). So must AI-written text published to inform the public on matters of public interest, unless a person reviewed it and someone holds editorial responsibility.
4. From 2 December 2027, meet the Article 26 duties for any high-risk use. Say you use a tool to sort job applications. You follow the provider's instructions, monitor the tool and keep its logs for at least six months. Oversight goes to people with the competence, training and authority to overrule it. You tell staff before using it on them, and tell people when it helps make decisions about them.

A deployer of everyday tools needs no registration, certificate, conformity assessment or AI officer. The Commission's literacy guidance says "no specific governance structure is mandated". A fundamental rights impact assessment is required only of public bodies, firms providing public services, and firms that score credit or price life and health insurance (Article 27).

Oversight that counts is a design job. Our guide to human-in-the-loop AI shows how to build a review step that isn't a rubber stamp.

AI literacy after the amendments: what it means for a 20-person firm

Since 27 July 2026, Article 4 has asked providers and deployers to "take measures to support the development of AI literacy" of their staff and anyone using AI on their behalf. It adds that this "does not require providers or deployers to guarantee any specific level" of literacy in any individual.

The original text asked for "a sufficient level of AI literacy". The Commission's November 2025 proposal would have moved the duty off businesses and onto governments. The final law kept a duty on businesses, in the lighter form.

National market surveillance authorities have supervised the duty since August 2026. The Commission's guidance says there's "no need for a certificate", and an internal record of training or other guidance is enough. Its answer for staff using ChatGPT to write advertising text: they "should be informed about the specific risks, for example hallucination".

For a 20-person firm, the measures fit on one page:

• A list of the AI tools in use, who uses each one and for what.
• For each tool, the failures that matter to you: invented facts, invented sources, confident wrong numbers, customer data pasted where it shouldn't go.
• What a person checks before an AI output leaves the building.
• A short session when someone starts using a tool, and a dated note that it happened.

The same items make up most of an AI policy. Our guide to writing an AI policy for a small company has an outline you can copy.

If you build AI, or have it built: what applies to providers

A provider's duties depend on what the system does. For most systems a small firm commissions, three questions decide them.

Does it talk to people? Since 2 August 2026, Article 50(1) has required it to tell them they are dealing with an AI, unless that's obvious, at the first interaction at the latest. The Commission's guidelines of 20 July 2026 set out what counts. Our guide to putting an AI chatbot on your website applies them to a chat window.

Does it generate content for others? Under Article 50(2), what an AI generator produces must be marked, in a machine-readable way, as AI-made. Tools that only assist with standard editing are exempt. Generators on sale before 2 August 2026 have until 2 December 2026. If you're commissioning a tool whose job is producing content for other people, ask your developer how its output will be marked.

Is it high-risk? From 2 December 2027, the provider of a high-risk system must run risk management and data governance, and keep technical documentation and logs. The system needs human oversight, a quality management system, a conformity assessment and an entry in the EU database.

SMEs get lighter paperwork, not lighter duties. They can provide the technical documentation in a simplified form (Article 11) and meet parts of the quality management system in a simpler way (Article 63). They also get priority access to regulatory sandboxes (Article 62).

Agents we build for small firms usually sit outside the high-risk areas. We build them the way the Act asks of high-risk systems anyway, because that's how an agent should work. Each one gets a defined scope, a person approving anything expensive, escalation with context, and logs of what it did and why.

Is your use high-risk? The list that matters to small firms

Annex III lists eight areas. For a private firm, five come up.

All five apply from 2 December 2027. Two rules then cut in opposite directions.

First, a system in an Annex III area isn't high-risk if it only performs a narrow procedural task or improves work a person has already finished. The same goes for one that does preparatory work, or flags departures from past decisions without replacing human review (Article 6(3)). A system that profiles people is always high-risk. A provider who relies on this filter must document why and register the system.

Second, under Article 25(1)(c), a deployer who changes an AI system's intended purpose so that it becomes high-risk is treated as its provider. On our reading, pasting job applications into a general chatbot and asking it to rank them is the likeliest way for a small firm to walk into that. It's one reason our checklist of what not to automate with AI keeps hiring decisions with a person.

The Commission published draft guidelines on classifying high-risk systems on 19 May 2026, with worked examples. When we wrote this, the final version had not been adopted.

Fines: tiered, and capped lower for small firms

Article 99 sets three tiers of fines. Banned practices sit in the top tier. A middle tier covers most other duties, including the deployer and transparency duties. Giving authorities incorrect or misleading information sits in the lowest.

Each tier's cap is a fixed sum or a share of worldwide annual turnover. A large firm faces whichever is higher; an SME faces whichever is lower. Since July 2026, small mid-caps get the lower figure for the two lower tiers as well. Each EU country sets its own penalty rules within those caps, and must weigh an SME's economic viability.

The tiers don't list the AI literacy duty. National rules decide how it's enforced, and the Commission's guidance says any sanction must be proportionate. National market surveillance authorities enforce the rules for AI systems, while the Commission's AI Office supervises general-purpose models and the assistants their makers build on them, such as ChatGPT.

When you don't need a compliance project, or us

Most small firms need a short record and a conversation. Few need a project.

• If your AI use is staff using mainstream tools, plus a vendor's chatbot that says it's an AI, your AI Act work is a one-page record and a short session. You don't need a consultant or software for that.
• There's no AI Act certificate for everyday use. The Commission says so for AI literacy, so be wary of anyone selling one.
• The EU's AI Act Service Desk has a free compliance checker and answers questions.
• If you plan to use or build AI for hiring, credit or insurance, talk to a lawyer before a developer. We can build the oversight and the logs; we can't tell you whether your system is lawful.
• If your question is really about personal data, the AI Act doesn't change the GDPR. Ask your data protection adviser.

Some plans sit in between. If you're planning a system and can't tell which role you'd hold, get a second opinion from people who build these systems before you commission one.

Your one-afternoon AI Act check

1. List every AI tool and AI feature your team uses, including the ones inside software you already pay for, and who uses each.
2. Mark your role for each: deployer, or provider if it was built for you and runs under your name.
3. Mark any use that touches hiring, staff management, credit, insurance or biometrics. Those need a closer look before 2 December 2027.
4. Check that anything customers talk to says it's an AI, and that AI-made images of real people or places are labelled.
5. Write down what staff should know about each tool, run a short session, and date the note.
6. Put 2 December 2026 and 2 December 2027 in your calendar, and check the Commission's AI Act page on both dates. The rules have moved once already.

If step 3 comes back empty, you are in the group the Commission calls minimal risk. The list from step 1, with its dated note, is then most of your AI Act compliance.

Questions

Does the AI Act replace the GDPR for AI tools?

No. Article 2(7) says the Act doesn't affect the GDPR. If an AI tool handles personal data, the GDPR applies in full, and in the UK the UK GDPR does. A customer's details pasted into a chatbot are a data protection question first.

Do we need to register our AI tools anywhere?

Usually not. Under Article 49, providers of high-risk systems listed in Annex III register them in an EU database, and so does a provider that decides such a system isn't high-risk after all. Public bodies register their use of high-risk systems. A firm using ChatGPT, Copilot or a vendor's chatbot registers nothing.

Could the dates move again?

Only through another change to the law. The July 2026 amendments wrote the new dates into the Act itself, and the European Commission keeps the current timeline on its AI Act page. Plan for the dates in force today, and check that page as each one approaches.

How we wrote this: drafted with AI, then checked and edited by the people who build our projects. Figures come from our own work or from the linked sources.