Who it affects
Almost any company that touches AI, from using ChatGPT at work to selling a product with AI inside. What changes is not whether it applies, but how much.
EU AI Act
The EU AI Act, in plain English
A European law about how AI can be built and used, in force since August 2024 and phasing in through 2028. If you run a small business, your duties are almost certainly modest and manageable. Here is what it is, who it affects, and what to actually do.
What it is
A risk-based rulebook for AI
A single EU-wide rule for how AI is built, sold and used. It sorts AI by how risky the use is, not by the technology, so most everyday tools carry light obligations or none.
Like GDPR: one EU-wide, risk-based law that also reaches companies outside the EU when they serve people inside it.
The four risk levels
From minimal to banned
The Act sorts AI into four levels. Most everyday tools sit in the bottom two.
High riskReal obligations
A defined set of sensitive uses, such as AI that screens job applicants or scores creditworthiness. Real obligations apply, but they reach a small minority of businesses and are not due until December 2027.
Screening job applicantsCredit scoringWhat you have to do
For most SMEs, hours not months
For most small businesses that simply use AI tools, this is a short, achievable list, not a compliance programme.
- Keep staff AI literateIf your team uses AI at work, you must take measures to support a basic working understanding of what the tools can and cannot do. This has been a live duty since February 2025, and for a small team a short internal guidance note usually covers it. It does not require a guaranteed level for any one person.in force
- Be transparent about AISince August 2026, if you run a customer-facing chatbot or publish AI-generated content, you have to make that clear to the people who see it. Often this just means not hiding a disclosure your vendor already provides.in force
- Heavier documentation, only if you build high-risk AIFormal risk management, technical documentation and independent checks apply only to the small number of businesses building high-risk AI products, and not until December 2027.confirmed
Where things stand
From 2024 to 2028, milestone by milestone
Updated September 2026
in forceconfirmed
- 1 August 2024in force
The AI Act enters into force
The regulation becomes EU law. The countdown to each set of duties starts here.
- 2 February 2025in force
Banned AI practices and the AI literacy duty apply
A short list of AI uses is prohibited outright. Any organisation whose staff use AI at work must take measures to support their AI literacy: how the tools work and where they fail. The duty does not require a guaranteed level for any one person.
- 2 August 2025in force
Rules for general-purpose AI models, plus governance and penalties, apply
Duties begin for the general-purpose models behind tools like ChatGPT, along with the EU bodies that oversee the Act and the framework for penalties.
- 2 August 2026in force
Transparency duties apply (chatbots and AI-generated content)
People must be told when they are dealing with AI or looking at AI-generated content. In force since 2 August 2026, and not delayed by the Digital Omnibus.
- 2 December 2027confirmed
Stand-alone high-risk systems (the eight high-risk categories) apply
The core rules for high-risk AI, such as hiring or credit-scoring tools sold on their own, apply from this date. Moved from the original 2 August 2026 date by Regulation (EU) 2026/1744.
- 2 August 2028confirmed
High-risk AI built into already-regulated products applies
High-risk AI embedded in products that already carry EU safety rules, like medical devices or machinery, applies from this date. Set by Regulation (EU) 2026/1744.
Regulation (EU) 2026/1744, the Digital Omnibus, delays only the high-risk dates (to December 2027 and August 2028). It does not move the August 2026 transparency duties.
In context
A few things worth knowing
Frequently asked questions
Does the EU AI Act apply to my small business?
Almost certainly, in some capacity. If your team uses AI tools at work, or you build or sell anything with AI in it, and you have customers or users in the EU, the Act applies. For most small businesses that only use AI tools, the duties are light. The Exposure Check tells you exactly which ones apply to you.
What happens if I do nothing about this?
The duties that are already live, like AI literacy, are real legal obligations even though no fines have been issued for them so far. For most SMEs the transparency duties have applied since August 2026, and for a few the high-risk rules come later. Doing a little now, like a short internal AI-use note, is far cheaper than catching up under pressure.
Is this basically GDPR again, but for AI?
The shape is similar: one EU-wide, risk-based law that also reaches companies outside the EU serving people inside it. But the AI Act is about how AI systems are built and used, not about personal data as such, and its duties scale with how risky the use is.
My company isn't based in the EU. Does it still apply to us?
It can. The Act reaches you if you place an AI system on the EU market, or if the output of your AI is used by people in the EU, wherever your company is based. A UK or US company with EU customers is often in scope. If you have no EU link at all, treat this as good practice rather than a legal duty.
How long does it actually take to get compliant?
For a small business that simply uses AI tools, the core steps are a matter of hours: write a short internal AI-use note and check that any customer-facing AI is clearly labelled. Building high-risk AI is a bigger project, but that affects very few SMEs. The Exposure Check gives you a realistic, personal list.
Your next step
Does the EU AI Act affect you?
Take the free check and get an indicative report on your exposure and where to start. If you work with a cybersecurity consultant, share it with them.
This page is general information, not legal advice. For an answer specific to your business, take the free Exposure Check or ask your cybersecurity consultant.