The EU AI Act for small businesses: what applies to you

The short answer

The AI Act regulates artificial intelligence by role and by risk. The roles that matter most are provider, whoever develops an AI system and places it on the market under their own name, and deployer, whoever uses an AI system under their own authority. Almost every small business is a deployer: you use assistants, automation platforms and AI features inside software you already buy. The obligations are then concentrated by risk. Certain practices are prohibited outright. High-risk uses, which include employment and worker management and access to essential services, carry substantial obligations for both providers and deployers. Limited-risk uses carry transparency obligations, principally telling people when they are interacting with an AI system and marking generated content. Everything else is minimal risk with no specific obligations under the Act. Timing is phased: prohibitions and the AI literacy obligation applied from 2 February 2025, general-purpose model rules and governance from 2 August 2025, most high-risk rules from 2 August 2026 and a further tranche in 2027. Confirm current dates and national implementation before relying on them.

What applies to a deployer

Situation	Obligation
Any use of AI in the business	Ensure staff involved have sufficient AI literacy for their role
Any use	Do not engage in prohibited practices
Chat, voice or other interaction with people	Your supplier must design the system to disclose this under Article 50(1); check that it does, and say so yourself where it is not obvious
Publishing generated or manipulated content	Mark or disclose it where required
Emotion recognition or biometric categorisation	Inform the people exposed; strict limits apply
High-risk use, such as recruitment or access to services	Use according to instructions, ensure human oversight, monitor, keep logs, inform affected workers, cooperate with authorities
Rebranding or substantially modifying a system	You may become a provider, with far heavier obligations
Minimal-risk uses: drafting, summarising, classification, automation	No specific AI Act obligations; data protection still applies

A proportionate response

What businesses find

Running the classification exercise usually shows that almost everything is minimal risk: drafting, summarising, classification, extraction, scheduling and automation. The obligations that attach are the disclosure where customers interact with AI, and staff literacy. One or two uses, typically in recruitment or in decisions about customers, sit in a higher category and need either proper treatment or a decision not to use AI there. That is a manageable outcome, and the value of the exercise is knowing which is which rather than guessing.

What this means for you

As a deployer, your AI Act obligations are ensuring staff AI literacy, avoiding prohibited practices, disclosing under Article 50(3) and 50(4) where they apply, and treating any high-risk use, recruitment and access to services especially, with the full deployer requirements. The disclosure that a person is talking to an AI system is the provider’s duty under Article 50(1), so check it rather than assume it. Note also Article 25(1)(c): repurposing an ordinary system, including a general-purpose one, for a high-risk use makes you its provider, with all the provider obligations of Article 16. Classify your uses, document the classification, train your staff and take advice on anything high-risk. The phase dates are set in Article 113. This is general information rather than legal advice.