The EU AI Act: what it means for small businesses
The EU AI Act applies to a business outside the EU when the output of the AI system it uses is used in the EU. For a small business using ChatGPT or similar tools, the duties are light: support your staff’s AI literacy and, since August 2, 2026, disclose deepfakes and some published text. The Digital Omnibus, adopted in July 2026, moved the main high-risk rules to December 2027.
What the EU AI Act means for a small business
If your team uses AI tools and any of the results reach people in the EU, the AI Act probably covers you, but as a user its demands are modest. This page completes the rules for using AI at work for businesses with European clients, based on the regulation as amended in July 2026 and on the European Commission’s AI Act pages. It is not legal advice.
Does it apply to you?
The Act applies to providers, who build or sell AI systems, and to deployers, who use them under their own authority in a professional activity. Article 2 extends it to businesses established outside the EU when the output of the AI system is used in the EU. Purely personal, non-professional use is excluded. A design studio in Leeds or an agency in Toronto that writes ads for a client in France with ChatGPT is, in the Act’s terms, a deployer whose output is used in the EU. When a business uses a tool, the business is the deployer, not its employees or freelancers.
The dates that matter
| Date | What applies |
|---|---|
| August 1, 2024 | The regulation enters into force |
| February 2, 2025 | Prohibited practices and the AI literacy rule (Article 4) |
| August 2, 2025 | Rules for providers of general-purpose AI models |
| August 2, 2026 | General application, including the transparency rules of Article 50, and national enforcement |
| December 2, 2026 | New bans on generating non-consensual intimate images; deadline for marking outputs of generative systems already on the market |
| December 2, 2027 | High-risk systems in Annex III, including deployers’ duties |
| August 2, 2028 | High-risk AI built into regulated products |
The later dates come from Regulation (EU) 2026/1744, the “Digital Omnibus on AI,” adopted on July 8, 2026 and in force since July 27, 2026. Many articles written before July 2026 still give August 2026 for the high-risk rules; that date no longer applies.
Article 4: AI literacy
Since the Omnibus, providers and deployers must take measures to support the AI literacy of their staff, without having to guarantee a specific level for each person. The Commission’s AI literacy FAQ gives the small-business example directly: a company whose staff use ChatGPT to write advertising text or translate is covered and should inform them of the risks, such as hallucinations. No certificate is needed; an internal record of the training is enough. National authorities have been able to enforce the rule since August 2, 2026, with penalties set by each country.
Article 50: telling people about AI
Most of Article 50 falls on providers: chatbots must be designed so that people know they are talking to an AI, unless it is obvious, and generated audio, images, video, and text must carry a machine-readable mark. Deployers have two duties:
- Deepfakes. If you publish an image, audio, or video that resembles real people, places, or events and could pass as authentic, you must disclose that it was generated or manipulated. For clearly artistic, satirical, or fictional work, a discreet mention is enough. The Commission says you cannot rely only on the provider’s invisible marking.
- Text on matters of public interest. AI-generated text published to inform the public on such matters must be disclosed, unless a person reviewed or edited it and takes editorial responsibility. A spelling or grammar check does not count as review.
The disclosure must be clear and appear at the first interaction or exposure at the latest. If you put a chatbot on your website under your own name, check the Commission’s guidelines on Article 50: depending on the setup, you may be treated as its provider. A voluntary code of practice, finalized on June 10, 2026, offers EU icons for labeling, and the Commission judged it adequate on July 8, 2026.
High-risk uses to approach with care
Annex III lists uses considered high-risk, including AI that screens job applications or evaluates candidates, and AI that assesses people’s creditworthiness. From December 2, 2027, a deployer of such a system must follow the provider’s instructions, assign trained people to oversee it, monitor it, keep its logs for at least six months, and inform workers and their representatives before using it at work. For a small business hiring in the EU, the simplest course is to keep AI out of hiring decisions until you are ready for those duties.
Fines
Breaches of the deployer and transparency duties can cost up to €15 million or 3% of worldwide annual turnover; for small and medium-sized businesses, the lower of the two amounts applies, and authorities can start with warnings. Article 4 is not in that list of fines; its penalties depend on national law.
What to do now
- Give everyone who uses AI a short briefing on its risks, and keep a note of it.
- Label realistic AI images, audio, and video of people or places that reach EU audiences.
- Have a person review AI-written public-interest text before you publish it.
- Keep AI out of hiring and credit decisions about people in the EU unless you have prepared.
Who owns the output
Labeling is one question; ownership and copyright are another. See who owns AI-generated content.
The GDPR side
The AI Act sits alongside data protection law, which applies whenever personal data is involved. See privacy law for AI tools, by country.