EU AI Act for Small Businesses: What Applies and When
EU AI Act for small businesses: risk tiers, AI literacy, banned practices, chatbot transparency and the delayed high-risk dates, with a plain SME checklist.
Quick answer: The EU AI Act regulates AI by risk. For most small businesses that simply use AI tools, the duties are modest: AI literacy for staff (since 2 February 2025), avoiding banned practices, and transparency for chatbots and deepfakes (from 2 August 2026). High-risk rules, such as AI in hiring or credit decisions, now apply from 2 December 2027.
The AI Act is the first comprehensive AI law in a major economy, and it reaches far beyond big tech. If your business uses a chatbot on its website, an AI writing tool for marketing or software that filters job applicants, some part of the regulation probably applies to you. The good news is that the heaviest obligations fall on companies that build high-risk AI systems, not on the café that uses a chatbot to answer opening-hours questions.
This guide explains the risk tiers, which dates have passed and which have moved, what a typical small business actually needs to do, and the support measures for SMEs. Dates were checked against the European Commission's AI Act pages in October 2026, after the AI Omnibus amendments entered into force.
General information, not legal advice. The AI Act is detailed and is supplemented by guidelines, codes of practice and national rules; check the official texts or a qualified adviser for your situation.
How the EU AI Act works: four risk tiers
Regulation (EU) 2024/1689, the AI Act, sorts AI uses into tiers. The obligation depends on what the AI is used for, not on how advanced it is.
| Tier | Examples | What it means |
|---|---|---|
| Unacceptable risk (prohibited) | Social scoring, manipulative techniques that cause significant harm, emotion recognition in workplaces and schools (with narrow exceptions), untargeted scraping of facial images | Banned since 2 February 2025 |
| High risk | AI used in recruitment and worker management, creditworthiness of individuals, access to education, certain insurance pricing, safety components of regulated products | Strict requirements on providers and deployers, now from 2 December 2027 (Annex III) or 2 August 2028 (regulated products) |
| Limited risk (transparency) | Chatbots, AI-generated images, audio and video, deepfakes | Disclosure and labeling duties, mostly from 2 August 2026 |
| Minimal risk | Spam filters, writing assistants, spreadsheet helpers, most internal productivity tools | No specific obligations beyond AI literacy |
Separately, providers of general-purpose AI (GPAI) models, the large models behind popular chatbots, have had their own obligations since 2 August 2025. Those fall on the model developers, not on you as a user.
Key dates: what applies now and what was delayed
The original timeline set most obligations for 2 August 2026. In November 2025 the Commission proposed a "digital omnibus" package to simplify and delay parts of the regulation. The AI Omnibus was agreed politically in May 2026 and entered into force on 27 July 2026. According to the Commission's AI Act policy page, the timeline now looks like this:
| Date | What applies | Status in October 2026 |
|---|---|---|
| 1 August 2024 | Regulation enters into force | Done |
| 2 February 2025 | Prohibited practices and AI literacy | In force |
| 2 August 2025 | GPAI model obligations, governance and penalties framework | In force |
| 2 August 2026 | General application, including most transparency duties (Article 50) | In force |
| December 2026 | New prohibition on AI that generates non-consensual intimate content or child sexual abuse material, added by the Omnibus | Upcoming |
| 2 December 2027 | High-risk obligations for Annex III uses (employment, education, credit, essential services and others) | Delayed from August 2026 |
| 2 August 2028 | High-risk obligations for AI in regulated products (Annex I) | Delayed from August 2027 |
Commentators report a short transitional period for machine-readable marking of AI-generated content by systems already on the market before August 2026. Details like this are exactly where secondary sources disagree, so read the consolidated text on EUR-Lex before relying on any grace period.
Are you a provider or a deployer?
Your obligations depend on your role.
- Provider: develops an AI system or model (or has it developed) and places it on the market or puts it into service under its own name or trademark.
- Deployer: uses an AI system under its authority in the course of a professional activity.
Most small businesses are deployers. You become closer to a provider if you build an AI product and sell it, put your brand on a system built for you, or substantially modify a high-risk system. A web agency that builds a chatbot for clients, or a start-up selling an AI tool, should read the provider obligations closely. The same questions apply to software that acts on your behalf, such as AI agents in accounts receivable: you are usually the deployer, and you remain responsible for how you use it.
The law also has reach outside the EU. It covers providers placing AI on the EU market wherever they are based, and providers and deployers outside the EU where the AI's output is used in the EU. Freelancers outside the EU who serve EU clients should at least know the basics. Our overview of AI tools for freelancers covers the everyday tools most likely to be involved.
What a typical small business must do
AI literacy
Article 4 has applied since 2 February 2025. It requires providers and deployers to take measures on the AI literacy of their staff and others using AI on their behalf, taking into account their knowledge, experience and the context of use. The Omnibus reportedly softened the wording to a duty to support AI literacy, with more help from the Commission and member states. Either way, a proportionate response for a small team is:
- A short written note listing which AI tools are allowed and for what. Our guide to ChatGPT for small business covers the everyday uses most teams start with.
- Basic training on limits: AI can be wrong, can invent facts and can leak data.
- Rules for personal and client data. Our guide to AI and financial data privacy covers this, and the GDPR still applies alongside the AI Act.
- A record of what you did, in case anyone asks.
Avoid prohibited practices
Few small businesses would set out to break these rules, but some products drift close. Be wary of tools that claim to read employees' emotions from webcams or voice, rank customers by personal characteristics unrelated to the service, or use manipulative design to push vulnerable people into decisions. Personalized pricing is not banned by the AI Act, but consumer and competition law still apply; our guide to AI pricing tools explains the limits.
Transparency for chatbots and AI content
From 2 August 2026, Article 50 requires that people are told when they interact with an AI system, unless that is obvious. Providers of generative AI must mark synthetic output in a machine-readable way. Deployers must disclose deepfakes and, in certain cases, AI-generated text published to inform the public on matters of public interest. In practice:
- Label your website chatbot clearly, for example "Automated assistant".
- Disclose realistic AI-generated images or voices of real people, places or events.
- Keep human editorial review over published articles if you want to rely on the editorial exception.
Copyright in AI output is a separate question from the AI Act; see our guide to copyright and AI-generated work, and if you bill clients for AI-assisted deliverables, how to invoice AI-assisted work.
Check for high-risk uses before December 2027
The biggest trap for a small business is buying software that falls into a high-risk category without realizing it. Common examples are CV screening and candidate ranking, employee monitoring that feeds into promotion or dismissal decisions, and credit scoring of individual customers. Deployers of high-risk systems will need to follow the provider's instructions, assign human oversight, monitor operation, keep logs, and inform workers before using such systems at work. Note that AI used purely to detect financial fraud is excluded from the credit-scoring category; see our guide to AI fraud detection in payments.
Worked example: what the fine caps mean for an SME
The AI Act sets maximum fines as a fixed amount or a percentage of worldwide annual turnover. For SMEs and start-ups, the cap is the lower of the two; for larger companies, it is the higher. Take an illustrative small business with €2,000,000 annual turnover:
- Prohibited practice: 7% × €2,000,000 = €140,000, compared with €35,000,000. Lower figure: €140,000.
- Most other breaches (including transparency duties): 3% × €2,000,000 = €60,000, compared with €15,000,000. Lower figure: €60,000.
- Incorrect information to authorities: 1% × €2,000,000 = €20,000, compared with €7,500,000. Lower figure: €20,000.
These are ceilings, not typical penalties. National authorities consider the nature, gravity and duration of a breach, cooperation and the size of the business. The point of the calculation is perspective: for a small firm the cap is meaningful but proportionate, and the cheapest protection is avoiding prohibited uses and labeling chatbots clearly.
Support for SMEs
The regulation includes measures aimed at smaller businesses, and the Omnibus extended some of them to small mid-cap companies:
- Priority access to AI regulatory sandboxes, where businesses can test systems under supervision.
- Simplified technical documentation for SMEs that are providers of high-risk systems.
- Reduced fees for conformity assessments, proportionate to size.
- Awareness and training activities and dedicated communication channels in member states.
- Lower fine caps, as shown above.
The full legal text is on EUR-Lex (Regulation 2024/1689). Look for the consolidated version that includes the Omnibus amendments.
Common mistakes
- Assuming the AI Act only affects AI companies. Deployers have duties too, starting with AI literacy.
- Reading old articles. Many guides still give 2 August 2026 for all high-risk obligations; the EU AI Act timeline changed in 2026.
- Treating the delay as a cancellation. High-risk duties are deferred, not removed, and transparency rules already apply.
- Forgetting GDPR. Personal data rules apply alongside the AI Act, often more immediately.
- Buying HR or credit tools without asking the vendor how they classify the product and what deployer obligations follow.
- Hiding that a chatbot is automated to make it seem more personal.
EU AI Act checklist for small businesses
- List every AI tool in use, who uses it and for what.
- Decide for each whether you are a provider or a deployer.
- Check none of your uses is prohibited.
- Flag any use in hiring, worker management, credit, education or insurance as potentially high-risk.
- Put a short AI use policy and basic training in place, and keep a record.
- Label chatbots and AI voice agents as automated.
- Disclose deepfake-style images, audio or video.
- Review data protection for each tool, including where data is processed.
- Ask vendors for their AI Act documentation and classification.
- Set a reminder to revisit before 2 December 2027.
Next step
For most small businesses, the EU AI Act is manageable: know your tools, train your people, label your chatbot and avoid the banned uses. Keep high-risk areas such as hiring and credit under review as the December 2027 date approaches. For the everyday business side, the free invoice generator creates PDF invoices in your browser with no AI processing, and our tax and compliance guides cover the EU's other big digital change, e-invoicing mandates.
Frequently asked questions
Does the EU AI Act apply to my small business?
Probably, in a limited way, if you use AI tools in the EU or your AI outputs are used there. Most small businesses are deployers, meaning they use AI systems built by others, such as chatbots or writing tools. For typical uses like drafting emails or summarizing documents, the main duties are AI literacy and, from August 2026, some transparency rules. Heavier obligations apply only to prohibited or high-risk uses.
What is the difference between a provider and a deployer?
A provider develops an AI system or model, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its authority in a professional context. If you build a customer chatbot on top of another company's model and offer it under your brand, you may be treated as a provider of that system, so check the definitions carefully.
What is the AI literacy obligation?
Since 2 February 2025, Article 4 has required providers and deployers to take measures on the AI literacy of staff and others operating AI systems on their behalf. In practice this means people who use AI at work should understand how it works, its limits and risks. The 2026 AI Omnibus reportedly reworded the duty to supporting AI literacy development; check the consolidated text on EUR-Lex for the exact wording.
Was the EU AI Act delayed?
Partly. The AI Omnibus, which entered into force on 27 July 2026, moved the high-risk obligations for Annex III uses such as employment, education and credit scoring to 2 December 2027, and those for AI in regulated products to 2 August 2028. Prohibited practices, AI literacy and general-purpose AI model rules already apply, and most transparency obligations apply from 2 August 2026.
Do I have to tell customers they are talking to a chatbot?
Under Article 50, AI systems designed to interact directly with people must be built so that people are informed they are dealing with AI, unless it is obvious from the context. That duty sits mainly with the provider, but as a deployer you should make sure your website chatbot or AI phone assistant clearly says it is automated. These transparency rules apply from 2 August 2026.
Do I need to label AI-generated content?
In some cases. Deployers who create deepfakes, meaning realistic AI-generated or manipulated images, audio or video of people, places or events, must disclose that the content is artificial. AI-generated text published to inform the public on matters of public interest must also be disclosed unless it has undergone human review and someone holds editorial responsibility. Ordinary marketing copy you review yourself is generally treated differently, but check the guidance.
What are the fines under the AI Act?
The maximum fines are up to 35 million euros or 7% of worldwide annual turnover for prohibited practices, up to 15 million euros or 3% for most other breaches, and up to 7.5 million euros or 1% for supplying incorrect information to authorities. For SMEs and start-ups, the cap is whichever of the two figures is lower. Actual fines are set case by case by national authorities.
Does the AI Act apply to businesses outside the EU?
It can. The regulation covers providers that place AI systems on the EU market wherever they are based, and providers and deployers outside the EU where the output of an AI system is used in the EU. A non-EU freelancer who simply uses a chatbot to write emails is unlikely to be the focus, but a business offering an AI product to EU customers should take advice.
Is using ChatGPT or similar tools at work high-risk?
Not by itself. General-purpose tools used for drafting, summarizing or brainstorming are not high-risk. The use case decides the risk tier. Using AI to screen job applicants, evaluate employees, or decide whether a person gets credit or certain insurance falls into high-risk areas listed in Annex III, which carry obligations from 2 December 2027 under the amended timeline.
Does the invoice generator use AI?
No. The invoice generator builds PDF invoices in your browser using the details you type in. It has no AI features, does not make automated decisions about people and does not send data to an AI model, so it does not add AI Act obligations to your invoicing. You may still use AI tools elsewhere in your business, which is what this guide covers.
Invoice Creator Editorial Team
Guides on invoicing, cash flow and small-business finance from Invoice Creator, operated by Next Software Development Company. Content is reviewed for accuracy against the fields our own invoice generator produces.
Try the invoice generator