If you use a chatbot, generate content with AI, or have AI anywhere in your product, the EU AI Act has probably come up in a client call or a procurement questionnaire by now. The rules are real, but most of the panic is misplaced. Here’s what actually applies to a typical small or mid-sized business as of late 2026.
This is a practical overview, not legal advice. For anything high-stakes, talk to a lawyer who specialises in EU tech regulation.
Where Things Stand in 2026
Two things happened this summer:
- The Digital Omnibus on AI entered into force on 27 July 2026. It postponed the heaviest obligations for high-risk AI: to 2 December 2027 for Annex III systems (hiring, credit, education, essential services) and 2 August 2028 for AI in regulated products under Annex I.
- Transparency obligations under Article 50 started applying on 2 August 2026, as originally planned.
So the headline for most businesses is: the high-risk rules were delayed, but the transparency rules are live now.
Does It Apply to You?
The AI Act applies based on where the AI is used, not where your company is registered. If EU residents use your chatbot, receive your AI-generated content, or are affected by your AI-driven decisions, you’re likely in scope — even if you’re based in the US, UK, Canada, or Australia.
It also distinguishes between providers (who build or put an AI system on the market) and deployers (who use one in their business). Most small businesses using ChatGPT, Claude, or a vendor chatbot are deployers, which comes with lighter obligations.
The Four Risk Levels, Simplified
| Level | Examples | What you need to do |
|---|---|---|
| Prohibited | Social scoring, manipulative AI exploiting vulnerabilities, most emotion recognition at work | Don’t do it (banned since Feb 2025) |
| High-risk | AI screening CVs, scoring credit, grading students, deciding access to services | Risk management, documentation, human oversight — from Dec 2027 / Aug 2028 |
| Transparency | Chatbots, voice agents, AI-generated images/video/audio, deepfakes | Tell people it’s AI; mark synthetic content — from Aug 2026 |
| Minimal | Spam filters, internal productivity tools, AI search on your own docs | No specific obligations |
Most small business AI sits in transparency or minimal.
Your Practical Checklist
1. List every place you use AI. Chatbots, voice agents, content generation, internal tools, anything a vendor added to your software. You can’t assess what you haven’t listed.
2. Label AI interactions. If a customer talks to your support agent or phone assistant, say it’s AI at the start. A simple “I’m an AI assistant — I can help with orders and bookings, or connect you to the team” covers it.
3. Mark AI-generated media. AI-generated images, video, or audio that could be mistaken for real — especially of real people — need disclosure. Text published to inform the public on matters of public interest also needs disclosure unless it has had human editorial review.
4. Check for high-risk use. If you use AI to filter job applicants, assess creditworthiness, or make decisions about people’s access to services, start preparing now. December 2027 is closer than it looks for documentation and oversight processes.
5. Ask your vendors. If you use an AI tool in your product, ask the vendor for their AI Act position. Enterprise clients are asking you the same question.
6. Train your team. AI literacy has been part of the Act since February 2025, and clients increasingly ask about it. A short internal guide on approved tools, data rules, and when to involve a human is usually enough for a small team.
Why This Matters Beyond Fines
For most small businesses, the realistic risk isn’t a regulator knocking on the door. It’s losing deals. Enterprise and public-sector buyers increasingly include AI Act questions in procurement, and “we haven’t looked at it” loses contracts. The same thing happened with accessibility compliance and GDPR before it.
The businesses that document their AI use, label it clearly, and keep humans in the loop for important decisions are finding compliance is a sales advantage, not a burden. The enterprise AI deployment guide covers the governance side in more depth.
Building AI into a product used in the EU? Let’s talk. I build AI features with disclosure, logging, and human oversight designed in from the start — so compliance questions from clients have straightforward answers.