EU AI Act / Obligations
What you actually have to do
The concrete action list, in order, organised by your role and your risk level, with honest effort estimates. For most small businesses that simply use AI tools, this is a short, achievable list, not a compliance programme.
At a glance
Obligations by role and risk level
A quick scanning tool, not the full explanation, which follows below. Most small businesses only need the deployer column, and mostly the minimal and limited rows.
| Risk level | If you use AI (deployer) | If you build AI (provider) |
|---|---|---|
| Minimal risk | No specific duties beyond general good practice. | No specific duties beyond normal product safety. |
| Limited risk | Keep the vendor's AI disclosure in place; label AI-generated content you publish. | Build in the AI disclosure; for generative AI, mark outputs as machine-readable. |
| High risk | Use per the provider's instructions, keep competent human oversight, monitor and report problems, retain logs for at least six months, and inform the people affected. | Technical documentation and formal conformity assessment (from 2 December 2027). |
| Prohibited | Banned outright: do not deploy. | Banned outright: do not build or sell. |
Private-sector deployers have no EU-database registration duty; that one falls on providers of high-risk systems and on public bodies.
Not sure which column is you? Check whether it applies firstIf you use AI (most SMEs)
Your two duties, in plain terms
Almost every small business is a deployer. There are really only two things to know, and one of them is already live.
AI literacy (Article 4), live since February 2025
This applies to any AI system your staff use at work, not just high-risk ones. Providers and deployers must take measures to support AI literacy, taking account of people's knowledge and the context of use. It does not require a guaranteed level for any one person. In practice, for a small company, that is often some written or informal internal guidance on appropriate use, including the tools' limits and what data is safe to share. Enforcement powers have applied since 2 August 2026.
Transparency notices (Article 50), in force since 2 August 2026
Your AI vendor, as the provider, has to make sure users know they are dealing with AI and label AI-generated content. Your job is not to strip or hide the disclosure the vendor built into a customer-facing chatbot. And if you publish AI-generated or AI-manipulated image, audio, or video content, the human-facing 'this was AI-generated' notice is on you, as the one putting the content out, not on the AI vendor. This duty has applied since 2 August 2026, and the Digital Omnibus did not delay it.
If you build AI (fewer SMEs)
Mostly not youMostly not you
Most readers can skip this. If you do build or sell an AI product, here is the shape of it.
Minimal and limited-risk products: light duties
These carry mainly the same transparency rules as deployers, plus, for generative AI systems, a duty to mark outputs so they can be recognised as machine-generated.
High-risk products: the heavy duties, and only for a few
Technical documentation, a formal conformity assessment (an independent check that the system meets the rules), and EU-database registration only apply if your product is one of the eight defined high-risk categories. Those obligations apply from 2 December 2027 (or 2 August 2028 for AI embedded in already-regulated products), under Regulation (EU) 2026/1744.
General-purpose AI models: a separate track
If you provide a general-purpose AI model, which is not a typical SME situation, separate duties around documentation, training-data summaries, and a copyright policy have applied since August 2025.
How much effort, honestly
Effort scales with the tier
The work is not evenly spread. For most SMEs it lands in the bottom two tiers, which are genuinely light.
Relief for smaller companies
The Act goes easier on you on purpose
Smaller companies get real, concrete breaks. SMEs and start-ups get priority (and often free) access to national regulatory sandboxes, reduced conformity-assessment fees, and a simplified technical-documentation template aimed specifically at small and micro enterprises.
Penalties are scaled too. For a small business, a fine is calculated using the lower of the fixed-euro amount or the percentage-of-turnover figure, the opposite of the rule applied to large companies.
Regulation (EU) 2026/1744 extends some of this relief to small mid-cap enterprises. They may provide the technical documentation in a simplified way, and Member States take their interests and economic viability into account when setting penalties.
A realistic starting point
Three steps, in order
See your actual list
Take the Exposure Check to get your real obligations instead of the general ones. About five minutes.
Write a short AI-use note
Cover which tools staff can use and the basic dos and don'ts. For most small teams this alone substantially covers the AI-literacy duty.
Check your customer-facing AI
Make sure any chatbot or AI-generated content carries a visible disclosure that a person is interacting with AI, or that the content was generated by AI. Transparency duties have applied since 2 August 2026.
Get your obligations, not the general list.
The Exposure Check turns this general guidance into your personal action list in about five minutes. Free, 12 questions, no account needed.
Frequently asked questions
What do I actually need to do right now?
If you use AI at work, take measures to support a basic understanding of the tools' limits (the AI-literacy duty, live since February 2025). It does not require a guaranteed level for any one person. Check that any customer-facing AI is clearly disclosed. Transparency duties have applied since 2 August 2026. For most SMEs, a short internal note and a quick check of your vendor tools covers it.
Do I need to appoint someone like a Data Protection Officer, but for AI?
No. The Act does not require SMEs to appoint an 'AI officer' or an equivalent of a Data Protection Officer. What it expects is measures to support the people using AI, and that someone is accountable for sensible use. It does not require a guaranteed level of literacy for any one person. For a small team that can simply be an owner or a manager.
We use a chatbot from a vendor, not one we built ourselves. Who is responsible?
The vendor, as the provider, is responsible for building in the 'you are talking to AI' disclosure. Your duty as the deployer is not to remove or hide it. If you also publish AI-generated content yourself, disclosing that it is AI-generated is your responsibility.
How much will complying with this actually cost us?
For most small businesses that simply use AI tools, close to nothing beyond a little time: writing a short internal note and checking your tools disclose AI use. Real costs only arise if you build high-risk AI, which affects very few SMEs. For a figure specific to your situation, take the free Exposure Check or ask your cybersecurity consultant.
What happens if we get something wrong?
The duties already live, like the duty to support AI literacy, are real legal obligations. No fines had been issued for literacy gaps as of mid-2026, and formal enforcement powers have applied since 2 August 2026. Penalties for SMEs are scaled to the lower of the two figures. Doing a little now is far cheaper than catching up under pressure.
Your next step
Does the EU AI Act affect you?
Take the free check and get an indicative report on your exposure and where to start. If you work with a cybersecurity consultant, share it with them.
This page is general information, not legal advice. For an answer specific to your business, take the free Exposure Check or ask your cybersecurity consultant.