What is the AI Act, in short?
The AI Act (the European AI Regulation) sets rules for how AI may be built and used in the EU. It looks at the risk of an application. The greater the possible harm to people, the stricter the rules. The law applies not only to makers of AI, but also to companies that use it. The law calls such a user a "deployer". You already are one if your team uses ChatGPT, Copilot or an AI agent for work.
Which risk categories are there?
- Prohibited practices, such as social scoring of citizens or manipulating vulnerable people. These have been banned since February 2025.
- High risk, such as AI that selects job applicants, assesses creditworthiness or is part of a medical device. Strict requirements apply.
- Transparency obligations, for chatbots and AI that creates text, images or audio. People must know they are dealing with AI.
- Minimal risk, such as a spam filter or AI that summarises your own documents. No extra rules apply.
Most small business use falls into the last two groups.
What already applies?
AI literacy has applied since February 2025. You must take measures so that staff who use AI know enough about what it can do, where it goes wrong and how to check the output. Since the law was amended in 2026 (the "Digital Omnibus" package), this is a best-efforts obligation: you do not have to guarantee a fixed level per person, but you must be able to show you are working on it.
Transparency has applied since 2 August 2026. If a customer talks to a chatbot, it must be clear that it is not a person. If you publish AI-made images or video that look real (deepfakes), or AI text meant to inform the public on matters of public interest, you have to say so.
What has been postponed?
The Digital Omnibus package was published in July 2026 and postponed the rules for high-risk AI. For uses such as recruitment and credit scoring they apply from 2 December 2027. For AI in products already covered by EU product rules, such as medical devices and machinery, from 2 August 2028. If you use AI to select applicants or assess customers, now is the time to prepare.
What should a small business do now?
- 01List your AI use. Which tools does your team use, for what, and with which data? Do not forget AI features inside existing software.
- 02Determine the risk category per use. Usually it is minimal risk or transparency. If you are unsure about recruitment, credit or healthcare, look into it further.
- 03Arrange AI literacy. A short internal training and a few clear agreements are often enough: what may and may not go into an AI tool, and who checks the output?
- 04Be open with customers. State that your chatbot is AI, and explain in your privacy statement where you use AI.
Record what you have done. That is your evidence if a customer, partner or regulator asks. And do not forget the GDPR: if you put personal data into an AI tool, the existing privacy rules still apply.
In summary
- The AI Act also applies to companies that use AI, not only to those who build it.
- Already required: AI literacy (since February 2025) and transparency for chatbots and AI content (since August 2026).
- High-risk rules apply from December 2027; most small business uses do not fall under them.
Frequently asked questions
Yes, as a user you fall under the AI literacy rules. For ordinary office use few other requirements apply, but the GDPR still applies if you enter personal data.
Regulators can impose fines. For SMEs the lower of the two maximums in the law (a fixed amount or a percentage of turnover) always applies. Each EU country appoints its own supervisory authorities.
No, the AI Act does not require it. It is wise, though, to make one person responsible for keeping track of your AI use.