The EU AI Act for small businesses: what to do now

The EU AI Act (Regulation (EU) 2024/1689) applies to small businesses too, but what it asks depends on your role. For most small businesses the answer is short: you use AI that others make, so you are a deployer, and your duties are AI literacy, a few transparency rules and extra care if you ever use AI on people's jobs or credit.

The act separates two roles. A provider develops an AI system, or has one developed, and puts it on the market or into service under its own name. A deployer uses an AI system under its own authority. Using ChatGPT, Copilot or the AI features in your accounting software makes you a deployer. Having a chatbot built for your website and running it under your brand can make you the provider of that chatbot.

One business can hold both roles. An online store that uses Copilot internally is a deployer of Copilot, and if it also sells an app with an AI feature it built, it is the provider of that feature. A deployer can also become a provider: by putting its own name on a high-risk system, or by changing what a system is used for so that it becomes high-risk.

The AI Act sorts AI by the harm it can do. A few practices are banned outright, a defined list of uses is high-risk and tightly regulated, AI that talks to people or makes realistic content carries transparency duties, and everything else is minimal risk.

The level depends on the use, not the tool. ChatGPT drafting a newsletter is minimal risk. The same model ranking job applicants is a high-risk use under Annex III, and from 2 December 2027 that brings duties for you as the deployer: human oversight by someone competent, keeping the logs, and telling staff and applicants. An Annex III system that only does a narrow procedural task, and does not materially influence the decision, can fall outside the high-risk rules.

A small business rarely comes near a banned practice, with one exception worth checking: software that reads employees' emotions from their face or voice at work has been prohibited since 2 February 2025, unless it is used for medical or safety reasons.

Article 4 has applied since 2 February 2025. The original text asked providers and deployers to "take measures to ensure, to their best extent, a sufficient level of AI literacy" of their staff. The Digital Omnibus on AI, Regulation (EU) 2026/1744, rewrote it from 27 July 2026: providers and deployers "shall take measures to support the development of AI literacy" of their staff and others who use AI on their behalf, and the duty "does not require providers or deployers to guarantee any specific level of AI literacy of any individual".

So the duty is softer, but it has not gone away. You still have to take measures, fitted to your people's knowledge, the context the tools are used in and the people they affect. You are judged on the measures you took, not on whether every employee reached a set level. The Commission and the member states must now support businesses, especially SMEs, and the Commission publishes practical examples.

For a small business, reasonable measures look like this:

• A short session for everyone who uses AI: what the tools can and cannot do, why they make things up, and which data must never go in.
• More depth for people whose AI use affects others: whoever answers customers with AI help, reviews applicants or publishes AI content.
• Written rules people can find: which tools are approved, what data stays out, and when a person checks the output.
• A refresher when tools or tasks change, and an introduction for every new colleague.

Article 50 has applied since 2 August 2026. Unlike the high-risk rules, it was not postponed: the Omnibus only gave makers of generative tools already on the market until 2 December 2026 to mark their output. These are the duties, and who carries each one:

• Chatbots and voice assistants must tell people they are dealing with AI, unless that is obvious. The duty sits with the provider, so if you had a chatbot built and run it under your name, it is yours (article 50(1)).
• Tools that generate images, audio, video or text must mark their output in a machine-readable way. That is the tool maker's job, not yours (article 50(2)).
• If you use emotion recognition or biometric categorization, you must inform the people exposed to it (article 50(3)).
• If you publish deepfakes, realistic AI images, audio or video of people, places or events that could pass as real, you must say they are AI-made. For evidently artistic, satirical or fictional work a light notice is enough (article 50(4)).
• AI-generated text published to inform the public on matters of public interest must be disclosed, unless a person reviewed it and someone holds editorial responsibility (article 50(4)).

The notice must be clear, come at the latest at the first interaction, and be accessible (article 50(5)). For a website chatbot that means an opening message such as "Hi, I am the AI assistant of Bakker Installaties. Ask for a colleague at any time.", not a line hidden in the privacy statement. Whoever built your chatbot, check that it does this.

Planning a chatbot? Our guide to what an AI chatbot for your website costs also covers privacy and this duty to say it is a bot. Through AI & automation we build assistants that answer from your own documents, from €2,500, starting with a pilot on your own data.

The AI Act entered into force on 1 August 2024 and applies in steps. The Digital Omnibus on AI, published in the Official Journal on 24 July 2026 and in force since 27 July 2026, moved the high-risk dates back and added two prohibitions. It did not move the transparency date.

In the Netherlands, the cabinet proposed in April 2026 that the Autoriteit Persoonsgegevens (AP) supervise prohibited practices, the transparency duties and most high-risk uses. Sector regulators keep their own domains, such as the AFM and DNB for financial institutions and the product inspectorates for AI in machines and medical devices. The Rijksinspectie Digitale Infrastructuur (RDI) becomes the central contact point, and the AP and RDI coordinate. The implementation act that gives them these powers was consulted on until 1 June 2026 and had not been adopted when we checked in October 2026. As the cabinet itself wrote, a late Dutch act does not pause the obligations: the regulation applies directly.

The fines are set in article 99: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other duties, including transparency and deployer duties, and up to €7.5 million or 1% for misleading information to authorities. For SMEs and start-ups the lower of the two amounts is the cap. The act sets no fixed fine for AI literacy; national law sets proportionate penalties for that.

None of this needs a compliance department. A business of five to fifty people can get through these six steps in a few weeks, alongside normal work.

If the inventory turns up AI that screens applicants, monitors staff or rates customers' creditworthiness, flag it: those are high-risk uses with more duties from 2 December 2027. And remember that the AI Act sits next to the GDPR, not in its place: personal data in prompts still needs a legal basis and, with an outside vendor, a data processing agreement.

Want help? Through Advise, our IT consulting, we help you list your AI tools and write a usage policy that fits how your team works. The first 15-minute call is free; after that it is €110 an hour, or a fixed-price advice project from €750. You can also ask us a question about AI first.