The EU AI Act, for small teams.

The EU AI Act is the world's first broad law on artificial intelligence. It entered into force in August 2024, and its duties switch on in stages. In November 2025 the European Commission proposed a package of simplifications called the Digital Omnibus. That is now law: Regulation (EU) 2026/1744 was signed on 8 July 2026 and entered into force on 27 July 2026.

The headline change is timing. Some deadlines that guides still quote have moved. We rely here on the Commission's AI Act Service Desk, which publishes the amended text and says it follows the consolidated version as at 27 July 2026.

1. 2 Feb 2025Banned AI practices and the AI literacy duty start to apply.
2. 2 Aug 2025Rules for general-purpose AI models and the governance structure apply.
3. 2 Aug 2026The general application date. The transparency duties in Article 50 apply from here.
4. 2 Dec 2026New bans on certain abusive content apply. Generative systems that were already on the market before 2 August 2026 get until this date to mark their outputs in a machine-readable way.
5. 2 Dec 2027High-risk obligations for uses such as employment screening, credit scoring and education. Previously 2 August 2026.
6. 2 Aug 2028High-risk obligations for AI built into products that are already regulated, such as medical devices or machinery.

The Commission's page describes four levels of risk: unacceptable (banned, for example social scoring), high risk (for example CV-sorting software or credit scoring), transparency risk (for example chatbots and deepfakes), and minimal risk (for example spam filters and AI in video games), where there are no new rules.

The Act gives different duties to different roles. Most small businesses are deployers.

• Deployer. You use an AI tool in your own business, for example an AI writing tool for marketing, a support chatbot you configured from someone else's product, or a hiring tool.
• Provider. You build an AI system, or put one on the market under your own name. If you build a custom chatbot or AI feature for your customers, or a software studio builds one for you under your brand, you are likely a provider.

Does it reach beyond the EU? Article 2 says the Act covers providers that place systems on the EU market whether they are in the EU or not, deployers located in the EU, and providers and deployers elsewhere where the output of the AI system is used in the EU. A US shop with a chatbot answering customers in Spain should pay attention.

1. AI literacy (Article 4)

Providers and deployers must take measures to support AI literacy among staff and others who use AI systems on their behalf. That can include contractors and service providers. The Commission's Q&A is reassuring: no strict requirements or mandatory trainings are imposed, you do not have to guarantee a particular level for any individual, and you need not test your staff. It does say that relying only on instructions for use may be ineffective, and that people using a tool such as a chatbot for ads or translation should know about specific risks, for example that it can make things up.

In practice: write a one-page policy on which AI tools are allowed and for what, give staff a short briefing on the main risks, and keep a note of what you did. National authorities can enforce this duty in a proportionate way.

2. Telling people when it is AI (Article 50)

• Chatbots. Systems meant to interact directly with people must be designed so that people are told they are dealing with AI, unless that is obvious to a reasonably well-informed person. This is mainly a provider duty.
• Synthetic content. Providers of systems that generate audio, image, video or text must mark outputs in a machine-readable format. There are exceptions for assistive editing.
• Deepfakes. Deployers must disclose that image, audio or video content is artificially generated or manipulated. Evidently artistic or satirical work has a lighter duty.
• Public-interest text. AI-generated text published to inform the public on matters of public interest must be disclosed, unless a human has reviewed it and someone holds editorial responsibility.
• Emotion recognition. Deployers must inform the people exposed.

In June 2026 the Commission published the final Code of Practice on transparency of AI-generated content. It is voluntary, and the Commission and the AI Board regard it as an adequate tool for showing compliance. About 190 organisations had signed by the end of July. The legal duties apply whether you sign or not.

3. Banned practices (Article 5)

Nine practices are prohibited, such as social scoring and emotion recognition in workplaces and schools. A typical small business will never come near these, but check any tool that claims to read emotions.

High-risk duties are heavier: risk management, logging, human oversight, registration and more. For deployers, Article 26 applies only to high-risk systems, and for business uses like recruitment screening or credit scoring that is now 2 December 2027. Public bodies and providers of public services also have an extra rights impact assessment.

That does not mean "ignore it". If you are choosing an HR or lending tool today, ask the vendor how they plan to meet the high-risk rules. Our guide to running AI agents safely covers sensible controls that also help here.

Fines

For large companies the higher figure applies. For SMEs, including start-ups, each fine is capped at the lower of the two, so a small firm's exposure is far below the headline number. The 2026 changes extended similar relief to some "small mid-cap" companies for the lower tiers. These are maximums, and authorities weigh how serious the breach was.

The AI Act sits next to the General Data Protection Regulation, which still applies whenever an AI tool handles personal data. Three points matter most for a small business.

• It reaches outside the EU. Article 3(2) applies to businesses outside the Union that offer goods or services to people in the Union, even if the service is free, or that monitor their behavior there. The European Data Protection Board says you must be targeting people in the EU. Merely having an EU visitor is not enough.
• Automated decisions. Article 22 gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. If you let a tool reject loan or job applicants with no human involved, this is a red zone. Keep a person in the loop.
• Impact assessments. Article 35 requires a data protection impact assessment where processing, in particular using new technologies, is likely to be high risk. That includes systematic and extensive profiling that leads to significant decisions.

On AI models themselves, the EDPB's December 2024 opinion says a model trained on personal data cannot always be treated as anonymous, that legitimate interest can be a legal basis only after a three-step test, and that unlawful processing during development can affect whether the model can be lawfully used. If you build on someone else's model, ask your vendor how it was trained.

If you operate in the UK: the UK has no equivalent of the AI Act, and the Information Commissioner's Office publishes AI and data protection guidance. A UK business selling to EU customers can still fall under both the AI Act and the GDPR.

• List every AI tool you useInclude free ones staff signed up for themselves. You cannot manage what you cannot see.
• Decide your role for eachDeployer or provider. Anything branded as yours and sold to customers makes you a provider.
• Write a one-page AI policyApproved tools, what data may never go in, and when a human must check the output.
• Brief your staffShort and practical. Cover hallucinations, privacy and bias. Keep a record.
• Label what needs labellingA clear "you are chatting with an AI assistant" line on chatbots, and a disclosure on synthetic images or video that could be mistaken for real.
• Keep humans in important decisionsHiring, credit, pricing and complaints should not be decided by a tool alone.
• Ask vendors the hard questionsHow was the model trained, where does data go and what is their plan for the high-risk rules?
• Review twice a yearThe guidance is still arriving, and dates have already moved once.