The EU AI Act affects small businesses too
Many businesses now use AI: ChatGPT for text, Copilot in Microsoft 365, AI features in accounting or recruiting. The EU AI Act has been in force since August 2024, with obligations phasing in. For most small businesses that only use AI, obligations are manageable, but one already applies. This is not legal advice.
Roles
- Providers develop and place AI systems on the market.
- Deployers use AI systems professionally. That's most SMBs, with far fewer obligations.
Timeline
- August 2024: entry into force.
- February 2025: prohibited practices banned; AI literacy duty (Article 4) applies.
- August 2025: rules for providers of general-purpose AI models.
- August 2026: most remaining rules apply, such as the transparency obligations.
- July 2026: with the so-called AI Omnibus, the EU postponed the high-risk deadlines: 2 December 2027 for stand-alone high-risk uses (such as recruiting), 2 August 2028 for AI embedded in products.
Duty 1: AI literacy – already applies
Ensure staff have sufficient knowledge to use AI. No specific certificate is required. Practical and provable:
- A short internal training: what AI can do, where it errs, what may go in and what may not.
- A written AI policy with approved tools and clear rules.
- Records of who was trained when.
Duty 2: Transparency
Customers must be able to tell when they talk to a chatbot. Realistic AI-generated or altered images, video or voices (deepfakes) must be labelled.
Duty 3: Care with high-risk uses
Using AI to select applicants, evaluate employees or assess creditworthiness is high-risk and brings extra duties: human oversight, logging, informing those affected. Ask your vendor whether a tool falls in this category.
And data protection?
The AI Act doesn't replace the GDPR:
- No customer, patient or staff data in free chatbots
- Use business versions with a data processing agreement and no training on your data
- Always review output before use
A simple five-point AI policy
- Approved tools
- Forbidden data
- Review duty
- Disclosure
- Contact person
FAQ
Do I have to ban ChatGPT? No, but regulate its use and train your team.
Are there fines? Yes, with adjusted caps for SMBs. A sensible, documented approach matters more than fear of penalties.
Conclusion
For most small businesses the AI Act means: train the team, write a short policy and look closely at sensitive uses. See also our article on Microsoft 365 Copilot or get in touch.
