What the EU AI Act requires of a Small Business in 2026

The EU AI Act applies to a small business that uses AI at work, and size does not change that. What size changes is the amount of work. For most small businesses the Act comes down to a few duties that are already in force, a set of transparency rules that started in August 2026, and a high-risk regime that now starts in December 2027 for the uses most likely to catch you out.

This article sets out what the Act asks of a business that uses AI tools other people built, in the order the duties arrive. It covers who is covered, what has applied since 2025, what counts as high-risk, what you owe when you use a chatbot or publish AI-generated content, and what to do in the next quarter. It is a plain-English guide and not legal advice.

Key takeaways

• A small business that uses AI tools built by others is a deployer, and the Act applies to it by what the AI is used for and not by headcount.
• Two duties have applied since 2 February 2025: the banned practices, and the duty to support the AI literacy of the people who use your tools.
• Most everyday use, such as drafting, summarising and internal search, is not high-risk. Recruitment, staff evaluation and credit decisions about people are.
• The high-risk rules for stand-alone systems now start on 2 December 2027, after the Digital Omnibus postponed them from 2 August 2026. The classification did not change.
• Transparency rules for chatbots, deepfakes and some published AI-generated text apply from 2 August 2026.
• Fines for small and medium-sized enterprises are capped at the lower of the percentage or the fixed amount.
• If you configure a general tool for a high-risk purpose, you can become the provider and take on the heavier duties.

Does the EU AI Act apply to your Business?

Yes, if you use AI in the EU, or if the output of your AI is used in the EU. The Act gives two main roles their own duties. A provider builds an AI system or has one built and puts it on the market under its own name. A deployer uses an AI system under its own authority in a professional setting. A small business that logs into ChatGPT, Microsoft 365 Copilot, Claude or Gemini is a deployer of that tool.

The line is drawn at the use and not at the size of the company. There is no exemption for small firms. What the Act does for small firms is lighter treatment elsewhere: lower fine ceilings, simplified documentation for providers, and priority access to testing environments. The Digital Omnibus adopted in 2026 extended some of that relief to small mid-cap companies of fewer than 750 staff.

Most of the EU AI Act is about providers. A deployer’s list is shorter, and for a business using assistants for ordinary office work it is shorter still. The difficulty is that you cannot tell which end of the list you are on without looking at each use. That job is called risk classification, and it is the first step in the plan at the end of this article. If you are comparing the Act with data protection law, our comparison of EU AI Act vs GDPR sets out how the two sit together.

What has applied since February 2025

Two parts of the Act have applied since 2 February 2025, and neither was moved by the Digital Omnibus.

The first is the list of banned practices in Article 5. The second is the duty in Article 4 to support AI literacy. The penalty rules followed on 2 August 2025, which means a national authority can already enforce both. A third item, rules for providers of general-purpose AI models, also started in August 2025, but it lands on the companies that build models and not on the businesses that use them.

None of this is hidden in a future date. If your business uses AI today, these two duties are the ones to check today.

The AI Literacy duty: What it means in a Small Business

Article 4 says that providers and deployers must take measures to support the development of AI literacy among their staff and other people who operate or use AI systems on their behalf. The measures should take account of each person’s technical knowledge, experience, education and training, and the context the tools are used in.

The wording is softer than it first was. The original text asked organisations to ensure, to their best extent, a sufficient level of AI literacy. The Digital Omnibus changed that to supporting the development of it, and the amended article adds that it does not require a business to guarantee a specific level for any individual. The Commission and Member States are meant to help, in particular small businesses, with practical examples. The duty itself remains.

For a small business this does not mean a certificate for everyone. It means being able to show, if asked, that you took reasonable steps. A sensible standard has four parts:

1. A short session for everyone who uses an AI tool, covering what the tool is, what it does well and where it fails. Teach hallucinations with a real example from your own work, because a fabricated figure in a familiar document sticks in memory.
2. A rule on what goes in. Staff need to know what must never be pasted, and our guide on what is safe to paste turns that into three tiers they can apply in seconds.
3. A rule on what comes out. Anything that reaches a customer or affects a person is checked by a human first.
4. A record. The date, who attended and what was covered. One line each is enough, and it is the first thing a customer or authority would ask to see.

A short session built on ten real examples from your team’s inbox meets the purpose of the duty better than a long policy nobody opens. Role matters too: the person who screens candidates needs more than the person who tidies meeting notes.

Which AI uses are banned outright

Article 5 lists practices the Act prohibits for everyone, whatever their size. Most never touch an ordinary business, but a few are worth knowing because they can arrive inside a product you did not think of as risky.

• Manipulative techniques that use subliminal or deceptive methods to distort someone’s behaviour in a way that causes harm.
• Exploiting vulnerabilities linked to age, disability or social and economic situation.
• Social scoring of people based on their behaviour or personal traits, leading to unfair treatment.
• Untargeted scraping of facial images from the internet or CCTV to build recognition databases.
• Inferring emotions in the workplace or in education, except for medical or safety reasons.
• Biometric categorisation that infers sensitive traits such as political opinions or sexual orientation.

The emotion rule is the one a small business can trip over. A meeting tool or call-centre add-on that reports on how staff or applicants “felt” during a conversation is inferring emotion in a workplace. Ask your vendor in writing whether any feature does this, and switch it off if it does.

From 2 December 2026 the list also covers AI systems that generate non-consensual intimate imagery of identifiable people, and AI systems that generate child sexual abuse material. Those bans mainly concern providers, but they are a reason to keep image tools on the approved list only.

When your use counts as High-Risk

The Act treats a use as high-risk when it falls into a listed area and affects people’s access to work, money or essential services. For most small businesses, three of those areas matter:

• Employment. AI used to recruit or select people, including targeting job adverts, filtering applications and evaluating candidates, and AI used to decide promotion or termination, allocate tasks based on behaviour or personal traits, or monitor and evaluate performance.
• Credit and insurance. AI used to assess the creditworthiness of individuals, or to price and assess risk for life and health insurance.
• Essential services and education. AI used to decide access to essential public or private services, or to assess learners.

The tool is not the unit of classification, the use is. A chat assistant that drafts a job advert is minimal-risk. The same assistant asked to rank 200 CVs and produce a shortlist is a use in the employment area, and you should treat it as one of the high-risk AI systems from the day it starts to influence who gets an interview. Our review of EU AI Act vs GDPR uses the same example, because hiring is where small businesses most often cross the line without noticing.

The date matters less than the habit. The high-risk rules for stand-alone systems were postponed to 2 December 2027, and for AI built into regulated products such as machinery or medical devices to 2 August 2028. The Digital Omnibus changed when the duties start. It did not change what counts as high-risk. Use the extra time to find and classify the uses, not to ignore them.

What a Deployer must do with a High-Risk System

If a use is high-risk, the deployer has its own list in Article 26. The heaviest burdens sit with the provider, but these stay with you:

1. Use the system as the provider instructs. Keep the instructions for use and follow them.
2. Assign human oversight to people who have the competence, training and authority to do it, and who can override or stop the system.
3. Control the input data where you choose it, and make sure it is relevant for the purpose.
4. Monitor the system and tell the provider and the authority if you believe it presents a risk or has caused a serious incident, and stop using it if needed.
5. Keep the logs the system generates for at least six months, where they are under your control.
6. Inform workers and their representatives before you put a high-risk system into use in the workplace.
7. Tell the people affected when a high-risk system is used to make or help make decisions about them.

Public bodies, private companies providing public services, and deployers of credit scoring or life and health insurance pricing also have to assess the impact on fundamental rights before first use. Data protection duties under the GDPR sit alongside all of this, and a decision about a person that is fully automated has its own rules there.

Treat the list as a reason to ask your vendor for documentation now. A provider that cannot tell you what the system is for, how it was tested and what oversight it expects is a provider whose product you should not put in front of candidates.

Transparency duties when you use a Chatbot or generate Content

Article 50 sets out transparency rules, and apart from one marking requirement for older systems, they apply from 2 August 2026. Four of them reach a small business:

• Chatbots. People must be told they are interacting with an AI system, unless it is obvious from the context. The duty falls first on the provider, so check what your vendor’s chatbot already shows. If you build your own on a model, it may be yours.
• Deepfakes. A deployer that publishes AI-generated or manipulated image, audio or video that resembles real people, places or events must disclose that it is artificially generated or manipulated.
• Published text. A deployer that publishes AI-generated text to inform the public on matters of public interest must say so, unless a person has reviewed it and holds editorial responsibility for it.
• Emotion recognition and biometric categorisation. People exposed to such a system must be told that it is operating.

The marking duty in Article 50(2), which requires generated audio, image, video and text to be machine-readable as AI-generated, falls on providers. Systems placed on the market before 2 August 2026 have until 2 December 2026 to comply.

For a business marketing team the practical answer is a habit. Say when an image is generated, keep a person responsible for anything published, and do not pass off a synthetic voice or face as a real person. Routine drafting that a colleague reviews and edits sits well inside the exception.

When a Custom Tool makes you the provider

Article 25 contains a rule many small businesses miss. A deployer is treated as the provider of a high-risk system if it puts its own name or trademark on one, makes a substantial modification to one, or changes the intended purpose of a system that was not high-risk so that it becomes high-risk. The provider’s heavy duties then pass to you.

The common route is a custom assistant. You take a general chatbot, give it instructions and a folder of CVs, and ask it to score candidates. The vendor never intended its product for that, you have changed its purpose into an employment use, and you may now hold the obligations for risk management, documentation and testing. Those are heavy for a small business.

The simple response is to keep the rule in your policy: no general tool is used for hiring, staff evaluation or decisions about individuals unless the vendor documents the system for that use and the business has taken advice. It is cheaper to buy a product made for the purpose than to build and certify your own.

Dates that matter and the ones that moved

The Digital Omnibus on AI was adopted in 2026 as Regulation (EU) 2026/1744 and made the two high-risk changes above. Dates have moved once and could move again, so confirm the current position with your adviser before you rely on any single one.

Fines for a Small Business

Article 99 sets three main tiers: up to 35 million euro or 7% of worldwide annual turnover for banned practices, up to 15 million euro or 3% for most other operator duties including those of deployers, and up to 7.5 million euro or 1% for giving misleading information to authorities. For large companies the higher of the two figures applies.

For small and medium-sized enterprises, including start-ups, the rule is reversed. Each fine is capped at the lower of the percentage or the fixed amount. The Digital Omnibus extends this kind of tailored cap to small mid-caps. A business with 40 staff and a turnover of 5 million euro therefore faces a ceiling well below the headline figure.

These are ceilings and not typical outcomes. For a small business the more realistic consequences of getting this wrong are an order to stop using a tool, a complaint from an employee or applicant, or the loss of a client who asks how you control your AI and cannot be shown an answer.

What to do this quarter

You do not need a legal project. Six steps cover the duties that apply now and set you up for 2027.

1. List every AI tool in use, including the ones nobody approved. Staff who use unapproved accounts create shadow AI, and you cannot comply for tools you have not seen. The list is your AI tool inventory.
2. Classify each use. Mark it minimal, needs care or possibly high-risk. Anything touching hiring, evaluation, credit or other decisions about people goes on a separate list for advice.
3. Check for banned features. Ask vendors in writing whether any product infers emotions in the workplace, and switch off any feature that does.
4. Run the literacy session and keep the record. One short session, one line per attendee.
5. Write one page of rules. Approved tools, what may be pasted, who reviews output, and who to ask. That page is the core of AI governance for small and mid-sized businesses.
6. Put the high-risk cases to a qualified adviser before December 2027, and stop using general tools for them in the meantime.

If you want an outside view on which tools your staff use and which duties each carries, an AI audit maps the Act against your actual use and gives you the list, the classification and a checklist in one pass. An audit is a diagnostic and not a legal opinion, so it identifies the obligations without certifying them.

Sources

• Regulation (EU) 2024/1689, the EU AI Act: the text of the Act, including Article 5 (banned practices), Article 25 (responsibilities along the value chain), Article 26 (deployer obligations), Article 50 (transparency) and Annex III (high-risk areas).
• European Commission AI Act Service Desk, Article 4: the amended AI literacy duty, including the sentence that it does not require a guaranteed level of literacy for any individual.
• European Commission AI Act Service Desk, Article 99: the three penalty tiers and the lower-of-the-two cap for small and medium-sized enterprises.
• Orrick, EU AI Act update, Digital Omnibus finalises changes (July 2026): the postponed high-risk dates, the new bans from 2 December 2026 and the extension of relief to small mid-caps.
• Freshfields, EU AI Act unpacked, the final Digital Omnibus on AI: the Article 50 dates, including the 2 December 2026 grace period for systems already on the market.
• Gibson Dunn, EU AI Act omnibus agreement: the postponed high-risk deadlines under the Digital Omnibus.