The EU AI Act: what small businesses should check

The AI Act concerns providers and users of AI systems in the EU. For a small business, the starting point is an inventory of systems, purposes and data. This guide supports the technical assessment; legal classification depends on the particular use case.

Role and intended purpose

Using an API does not by itself establish whether you are a provider or deployer. Consider how you develop, distribute, modify and present the system. Substantial modifications or a different intended purpose can change responsibilities.

Risk and transparency

The Act includes prohibited practices, high-risk systems and specific transparency requirements. A “productivity” label does not establish a system’s classification: assess its actual use. Chatbots must make AI interaction clear where required. Recruitment and other sensitive applications need a specific assessment.

Application dates to check

• 2 February 2025: general provisions, AI literacy and initial prohibitions.
• 2 August 2025: governance and general-purpose model obligations.
• 2 August 2026: most rules, including transparency, apply.
• 2 December 2027: rules for high-risk systems under Annex III.
• 2 August 2028: rules for high-risk systems embedded in regulated products under Annex I.

Transitional provisions also apply: check the date for the particular system. Sources: European Commission, AI Act Service Desk.

A practical checklist

1. Inventory tools, suppliers, owners and intended uses.
2. Document data flows, access and human oversight.
3. Review roles, risk and obligations with the person responsible for compliance.
4. Train the people using the system.
5. Check privacy information, contracts and personal-data safeguards: the AI Act does not replace the GDPR.
6. Keep the assessment and revisit it when the use changes.

Discuss your AI project with us.