The EU AI Act for small businesses: what to do in 2026

The AI Act is the EU's regulation on artificial intelligence, and it applies directly in every member state. Most of its rules target companies that build AI models or high-risk systems. A small business still has a few concrete duties, and one of them started on 2 August 2026. Below is what applies, from when, and what to do.

How the AI Act works

The regulation sorts AI systems by risk:

Your role matters too. A provider develops a system or puts it into service under its own name; a deployer uses one in its business. A company using ChatGPT is a deployer. A company that commissions a chatbot and runs it on its site under its own name is, for that chatbot, a provider.

The timeline

The last three dates come from the Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026. It delayed the high-risk rules, which were due in August 2026, and left the transparency deadline where it was.

What it means for a small business

Your staff use ChatGPT, Claude or Copilot

Article 4 asks providers and deployers to take measures for their staff's AI literacy. The Omnibus rewrote it: businesses must take measures that support AI literacy, without having to guarantee a given level for each person. In practice that means:

• a list of the AI tools the business uses, and what for;
• a one-page written rule: what data never goes into AI (customers' personal data, trade secrets), and who checks AI output before it reaches a customer;
• short training for whoever uses the tools.

GDPR still applies alongside: customer data doesn't belong in plans that may use conversations for training. The differences between plans are in ChatGPT for small business.

You have a chatbot on your site, on WhatsApp or on the phone

Since 2 August 2026, Article 50 requires people to be informed that they're interacting with an AI system, at the latest at the first interaction, unless it's obvious from the context. The notice must be clear and accessible. In chat, the bot says so in its first message; on the phone, the assistant introduces itself as AI in its first sentence. Worked examples: WhatsApp chatbot for business and AI phone answering service.

You publish AI-generated images, video or voices

Article 50 requires deployers to disclose when AI-generated or manipulated image, audio or video content resembles real people, objects, places or events and could pass as authentic (a deepfake). For evidently artistic, creative or satirical work, the disclosure can be made in a way that doesn't spoil it. An AI illustration that doesn't imitate reality isn't covered; a photo of "happy customers" who never existed is, and would mislead consumers anyway.

AI-generated text published to inform the public on matters of public interest must also be disclosed, unless a person has reviewed it and holds editorial responsibility. A blog post checked and signed by someone in the business falls in the second case.

Technical marking of generated files, such as invisible watermarks, is the job of the generative tool's provider, not yours.

You use AI to screen CVs or assess staff

AI used for recruitment, promotion or evaluating employees is high-risk. The duties for deployers apply from 2 December 2027: human oversight, informing staff and candidates, keeping records. Emotion recognition of employees at work has been banned since 2 February 2025, with exceptions for medical or safety reasons.

Fines

Large companies face the higher of the two amounts; SMEs, including start-ups, the lower.

Enforcement runs through national authorities, and not all member states were ready by August 2026. Romania, for example, named its telecoms regulator ANCOM as market surveillance authority in March 2026, but the national law giving it inspection and sanctioning powers was still being drafted in August 2026. The duties apply regardless, because the regulation is directly applicable.

If your business is outside the EU

The AI Act covers providers and deployers established outside the EU when the output of their AI system is used in the EU. A US business with a chatbot on a site that serves European customers, or an AI voice agent answering calls from the EU, should follow Article 50 for those users. At home, US rules are patchier: California, for example, already requires bots that try to sell something or influence a vote to disclose that they're bots.

What to do, in short

1. List the AI tools in use and who uses them.
2. Write the one-page internal rule and run a short training.
3. Check your chatbots and voice assistants: do they say they're AI straight away?
4. Label images, video and voices that imitate reality.
5. Don't use AI to read employees' emotions.
6. If you screen CVs with AI, prepare for December 2027.
7. Check AI providers' plans and contracts for GDPR.

The chatbots, voice assistants and AI agents we build say they're AI in the first message or sentence, hand over to a person, and keep data under the consent and contracts GDPR requires. Details on our AI automation page.