The EU AI Act for small businesses: what applies and when
BuildAIPolicy Research · Published 1 November 2026 · 2 min read
Most small businesses don't build AI; they use it, through tools like ChatGPT, Copilot, website chatbots or AI features in their software. In the EU AI Act's terms that makes them deployers, and a handful of the Act's duties apply to them already. Here's what applies, from when, after the changes made in 2026.
Already in force
- Banned practices (since 2 February 2025): a short list of AI uses is prohibited outright, such as manipulative techniques and emotion recognition in workplaces and schools, except for medical or safety reasons.
- AI literacy (since 2 February 2025, amended in 2026): organisations that provide or use AI systems must take measures to support the AI literacy of their staff and others using AI on their behalf. The amended text says no specific level has to be guaranteed for each person. Practical training and a simple record are a common way to do this.
- Transparency (since 2 August 2026): people must be told when they're talking to an AI system, such as a chatbot, unless it's obvious; realistic AI-generated images, audio or video must be labelled; and AI-generated text published to inform the public on matters of public interest must be disclosed unless a person has reviewed it and takes editorial responsibility.
These duties can apply to businesses outside the EU too, where their AI's output is used in the EU. Our EU AI Act checker works through the transparency duties in a few questions.
Coming later
The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the dates for high-risk AI. Obligations for high-risk uses listed in Annex III, such as AI used in hiring, credit, education and access to essential services, now apply from 2 December 2027. Obligations for AI in regulated products (Annex I) apply from 2 August 2028.
If you use AI in one of those areas, you'll have deployer duties such as following the provider's instructions for use, assigning human oversight to someone competent, and monitoring how the system performs. Providers of generative AI tools that were on the market before 2 August 2026 have until 2 December 2026 to mark their outputs as AI-generated; that duty falls on the tool's provider, not its users.
A practical starting point
- List the AI tools your business uses, including AI built into software you already pay for.
- Check none of your uses is a banned practice.
- Add a clear notice wherever customers talk to a chatbot or AI assistant, and label realistic AI-generated media.
- Give staff short training suited to their role, and keep a record of who has been trained.
- Note any use in hiring, credit or other Annex III areas, and plan for 2 December 2027.
- Write down the rules in an AI use policy, and review it when your tools change.
Our EU sample pack shows these steps for a fictional online retailer with a customer-service chatbot, and our guide to AI training for staff covers the AI literacy duty in more detail.
Related
Free checklist (PDF)
AI tools audit checklist
Find out which AI tools your team uses, how, and with what information. The first step in any AI policy.
- Where to look for AI tools, including ones built into software you already use
- What to record for each tool, from the data that goes in to who is responsible
- What to decide once you have the list
Free tools, no sign-up
- Free AI policy generatorA short AI use policy in a few minutes
- Australia: automated decisions checkerDoes the 10 December 2026 rule apply to you?
- US: Colorado and California checkerAutomated decision rules from 1 January 2027
- EU AI Act checkerWhich transparency duties apply to you
- AI regulations trackerAI rules by region, with email alerts
- Free checklistsAI tools audit and 10 December readiness, as PDFs
Sources
- European Commission, AI Act Service Desk: Article 50, transparency obligations
- AI Act Explorer: Digital Omnibus on AI
- Gibson Dunn: EU AI Act Omnibus agreement, postponed high-risk deadlines and other key changes
- Cooley: EU AI Act transparency obligations take effect 2 August 2026
- Cuatrecasas: The Digital Omnibus on AI and the amended AI literacy duty
This article is general information, last checked against these sources on 1 November 2026. It isn't legal advice. For advice on your situation, speak to a qualified adviser.