Does the EU AI Act apply to my small business? A 2026 guide

Yes: the EU AI Act applies to your small business if it develops, sells or uses an AI system in a professional context in the EU, and that includes using everyday tools such as ChatGPT. There is no size exemption, but for most SMEs the obligations are light: support AI literacy among staff and be transparent when people interact with AI or see AI-generated content. The demanding rules are reserved for high-risk uses such as recruitment screening or credit scoring.

Key takeaways

• The EU AI Act applies to almost every business that develops, sells or uses an AI system professionally in the EU, including SMEs using off-the-shelf tools such as ChatGPT.
• How much it asks of you depends on your role (provider or deployer) and the risk of the use case, not on company size.
• For most small businesses the duties today are AI literacy measures for staff and, where relevant, transparency towards people interacting with AI or seeing AI content.
• Heavy obligations apply only to high-risk uses such as recruitment screening or credit scoring, and those start on 2 December 2027.
• Non-EU companies are covered too when they place AI on the EU market or their AI output is used in the EU.

What is the EU AI Act, in one sentence?

The EU AI Act, Regulation (EU) 2024/1689, is a product-safety style law that sets rules for AI systems according to the risk of how they are used, from banned practices through high-risk systems to transparency duties, with no specific rules for minimal-risk AI. It entered into force on 1 August 2024 and applies in stages, as amended by the Digital Omnibus on AI.

Does my software count as an "AI system"?

It does if it infers from inputs how to generate outputs. Article 3(1) of the Act defines an AI system as a machine-based system designed to operate with varying levels of autonomy, which may adapt after deployment, and which infers from its input how to generate outputs such as predictions, content, recommendations or decisions. Large language models, image generators, machine-learning scoring and recommendation engines clearly qualify. Fixed rules written entirely by people, such as a spreadsheet formula or a hard-coded discount rule, generally do not.

How do I tell whether the AI Act applies to my business?

Ask three questions in order.

1. Is any of your activity in scope? Article 2 covers providers placing AI systems on the EU market, deployers located in the EU, and providers and deployers outside the EU whose AI output is used in the EU. Importers, distributors and product manufacturers are covered too.
2. What is your role? A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its authority, except for purely personal, non-professional use. Many SMEs are deployers; any company shipping an AI feature in its own product is usually a provider. Our guide to AI provider vs deployer explains the edge cases.
3. What is the risk tier of each use case? That determines the actual obligations.

Which obligations apply to a typical SME?

The table below maps common situations to what the Act asks, based on the Commission's summary of the risk tiers and the consolidated application dates in Article 113.

Your situation	Likely role	Main obligations	Applies from
Staff use ChatGPT, Copilot or similar for drafting and research	Deployer	Support AI literacy of staff (Article 4)	2 February 2025
Customer-service chatbot on your website	Deployer, or provider if you built it under your name	Tell users they are talking to AI unless obvious (Article 50)	2 August 2026
You publish AI-generated images, video or deepfakes	Deployer	Disclose that content is AI-generated or manipulated (Article 50)	2 August 2026
Your SaaS product includes a generative AI feature	Provider	Machine-readable marking of synthetic output (Article 50)	2 August 2026
AI screens CVs or ranks job candidates	Deployer (or provider if you built it)	High-risk deployer duties: human oversight, logs, informing workers	2 December 2027
AI assesses creditworthiness or prices life or health insurance	Provider and/or deployer	Full high-risk regime	2 December 2027
Spam filter, stock forecasting, product recommendations	Deployer	No specific obligations beyond AI literacy	n/a

What counts as high-risk, and why does it matter so much?

High-risk systems carry most of the Act's cost. Annex III lists eight areas, including employment, access to essential services such as credit scoring, education, biometrics and critical infrastructure. AI that is a safety component of a product covered by EU product legislation, such as machinery or medical devices, is also high-risk. Providers of high-risk systems need risk management, data governance, technical documentation, logging, human oversight, a quality management system and conformity assessment before they sell.

The Digital Omnibus moved these obligations to 2 December 2027 for Annex III systems and to 2 August 2028 for product-embedded AI. If you suspect one of your systems may fall into this tier, our high-risk AI checklist works through the classification tests.

What is excluded from the Act?

Three exclusions matter for small businesses, all in Article 2 of the Act:

• Personal use: individuals using AI in a purely personal, non-professional activity.
• Research: AI systems developed and put into service solely for scientific research and development, and research and testing before a system is placed on the market (testing in real-world conditions is not excluded).
• Open source: AI systems released under free and open-source licences, unless they are high-risk, prohibited or covered by Article 50.

Being small is not on the list.

What does it cost a small business to comply?

For a deployer with no high-risk uses, the cost is mostly time: an inventory of AI tools, a short AI literacy programme and checking disclosures on any chatbot or published AI content. The Commission's AI literacy Q&A confirms that no certificate is needed and an internal record of training is sufficient.

Providers of high-risk systems face real costs in documentation, testing and conformity assessment, which the Act tries to soften for smaller firms. SMEs get priority access to regulatory sandboxes and reduced conformity assessment fees, and those without partner or linked enterprises can implement parts of the quality management system in a simplified way. Fines are capped at whichever is lower of the fixed amount or turnover percentage, which our article on EU AI Act penalties for SMEs sets out in detail.

What are the common mistakes?

• Assuming "we just use tools" means out of scope. Deployers have obligations too.
• Missing a role change. Putting your own brand on a high-risk system, substantially modifying it, or repurposing a general AI system for a high-risk use makes you a provider under Article 25.
• Overlooking HR uses. Recruitment and performance-monitoring AI are among the most common high-risk uses in ordinary businesses.
• Forgetting GDPR. The AI Act sits alongside data protection law; it does not replace it.
• Treating the 2027 delay as a reason to wait. Classification and documentation take months.

Who should a business in Ireland talk to?

Ireland's model is distributed. The government designated 15 national competent authorities in September 2025, including the Data Protection Commission, the Central Bank, the Competition and Consumer Protection Commission and the Workplace Relations Commission. The AI Office of Ireland, established under the Regulation of Artificial Intelligence Act 2026, coordinates them and is the single point of contact for the EU AI Act.

Frequently asked questions

Does using ChatGPT or Copilot at work bring my business under the AI Act?

Yes. The Commission's AI literacy guidance gives the example of a company whose staff use ChatGPT to write advertising text or translate, and says that company must comply with the AI literacy obligation. Using a general-purpose tool for ordinary tasks does not, on its own, create high-risk obligations.

Is there a size exemption for micro-enterprises?

No. The AI Act has no general exemption based on headcount or turnover. Instead it offers SMEs proportionate treatment: lower fine caps, simplified technical documentation and quality management options, free access to regulatory sandboxes and reduced conformity assessment fees.

My company is in the UK or the US. Can the EU AI Act still apply?

Yes, if you place an AI system on the EU market or if the output your AI system produces is used in the EU. Article 2 extends the Act to providers and deployers in third countries in that situation.

What if I only use AI internally and no customer ever sees it?

You are still a deployer, so AI literacy applies. Customer-facing transparency duties may not, but some internal uses can still be high-risk, for example AI that screens job applicants or evaluates employee performance.

Who enforces the AI Act in Ireland?

Enforcement is distributed across sectoral regulators. Ireland designated 15 national competent authorities in September 2025, and the AI Office of Ireland, established in July 2026, coordinates them and acts as the single point of contact.

If you want help working out your role and risk tier for a specific product or tool, book a free 30-minute call.

Cover photo by RDNE Stock project on Pexels.