Safety and compliance
The EU AI Act for small businesses
The EU AI Act in plain language: what already applies, what's coming and what it means for a small business using AI. Status November 2026.
6 min read
The AI Act is the European law that sets rules for those who develop and use AI systems. Most small businesses are users, not developers. Their obligations are more limited, but they do exist.
Status November 2026, after the amendment by Regulation (EU) 2026/1744. General information, not legal advice.
The principle: the higher the risk, the stricter the rules
- Prohibited practices, such as social scoring and emotion recognition in the workplace. Prohibited since 2 February 2025.
- High risk, such as AI that decides on recruitment, creditworthiness or access to education. Strict rules for these uses apply from 2 December 2027.
- Transparency obligations, including for chatbots and AI-generated or AI-manipulated images, audio and video. Applicable since 2 August 2026.
- Minimal risk, such as having text written or summarised. No specific extra obligations, apart from AI literacy.
What it means for your business
- AI literacy: anyone deploying AI systems takes measures to support their staff's AI literacy. This has applied since 2 February 2025, including to small businesses.
- Be honest: if customers talk to a chatbot, make it clear it's AI. If you publish realistic AI-generated or AI-edited images, audio or video that appear authentic, disclose it.
- No prohibited practices.
- Care with high risk: if you use AI in recruiting or assessing people, get properly informed now.
What you can do today
- List the AI tools used in your business.
- Check whether any of them falls into a higher risk category.
- Adopt an AI policy and provide basic training.
- Make AI use visible where customers come into contact with it.
Test yourself
Which AI Act obligation already applies to a small business that only uses AI assistants to write text?
Prompt to copy
These are the AI tools and uses in our business: [list]. Sort them according to the EU AI Act's risk categories (prohibited, high risk, transparency obligation, minimal risk) and briefly explain why. Flag any borderline cases. Don't give legal advice.
