The EU AI Act is relevant to more SMEs than the phrase “AI regulation” suggests. A small business may not train a foundation model, but it may deploy AI in recruitment, customer support, document processing, credit decisions or employee management. The regulation distinguishes between providers that develop or market systems and deployers that use them professionally, and obligations depend heavily on the use case.
This guide is a practical starting point, not legal advice. The official European Commission guidance and the final regulation should be used for formal decisions, particularly because the implementation timeline has evolved. As of June 2026, the Commission states that prohibited practices and AI-literacy duties have applied since 2 February 2025, rules for general-purpose AI models since 2 August 2025, and transparency rules are scheduled for August 2026. Following the May 2026 political agreement on simplification, certain stand-alone high-risk rules are scheduled for 2 December 2027 and product-integrated high-risk rules for 2 August 2028.
The core idea: regulate the use, not the buzzword
The Act uses a risk-based structure. Most everyday AI uses are minimal or limited risk. A spam filter and an internal writing assistant do not receive the same treatment as a system deciding whether a person gets a job, loan or essential service.
The first compliance task is therefore an inventory: what systems are used, for what purpose, with which data, and who is affected by their output?
Four practical risk levels
Unacceptable risk
Certain practices are prohibited, including harmful manipulation, social scoring, some forms of biometric categorisation and emotion recognition in workplaces and educational institutions. These prohibitions have applied since February 2025. An SME should not assume a purchased product is automatically safe to use; the deployer still needs to understand what the product does.
High risk
High-risk categories include certain AI uses in employment, education, essential services, critical infrastructure, biometrics, law enforcement, migration and justice. A recruitment tool that ranks candidates can be far more regulated than a chatbot answering product questions.
High-risk obligations can include risk management, data governance, logging, technical documentation, human oversight, accuracy, robustness and cybersecurity. SMEs should obtain specialist legal advice before building or deploying systems in these areas.
Transparency risk
Some systems are allowed but must be transparent. The Commission gives chatbots as a clear example: people should know when they are interacting with a machine. Generative content and deepfakes can also trigger marking or disclosure requirements. Transparency should be designed into the interface rather than added as an afterthought.
Minimal or no risk
The Commission says the vast majority of AI systems used in the EU fall into this category. That does not remove obligations under GDPR, consumer law, employment law, copyright or confidentiality agreements. “Minimal risk under the AI Act” does not mean “no governance needed.”
What AI literacy means for a small business
AI literacy obligations are already applicable. In practice, staff should understand the capabilities and limits of systems they use. A generic annual presentation is not enough for every role. Customer-support staff need to recognise hallucinated answers and escalation conditions. HR staff need to understand bias and when automated recommendations must not replace human judgement. Developers need secure data-handling and evaluation practices.
Keep training proportionate and record what was provided, to whom and for which tools.
Chatbots: the common SME use case
A customer-facing chatbot is usually not high risk merely because it uses AI. It does, however, need clear disclosure unless the AI interaction is obvious from context. A responsible implementation should also:
- identify itself as automated at the start of the conversation;
- provide a reliable route to a human;
- restrict answers to approved knowledge where appropriate;
- avoid collecting unnecessary personal data;
- log sources and confidence for internal review;
- define retention and deletion rules for conversations.
These controls improve the product even where the law does not prescribe the exact interface.
A proportionate SME compliance checklist
- Create an AI inventory. Include embedded AI features inside SaaS products.
- Record purpose and affected people. Risk depends on context.
- Identify your role. Provider, deployer, importer and distributor duties differ.
- Classify the use case. Escalate employment, credit, education, health and biometric uses.
- Document human oversight. Define who can override, stop or review the system.
- Add transparent notices. Make AI interaction and generated content clear.
- Train staff. Tailor literacy to actual responsibilities.
- Review vendors. Request documentation, security terms, data locations and change notices.
- Monitor incidents and quality. Governance continues after launch.
Do not treat AI Act and GDPR as the same project
The two frameworks overlap but answer different questions. The AI Act focuses on system risk and market obligations. GDPR focuses on personal data and individual rights. A chatbot may be transparent under the AI Act while still collecting excessive personal data under GDPR. A lawful data-processing basis does not automatically make a high-risk AI system compliant.
Use privacy, security and AI governance as connected workstreams with clear ownership.
Build for evidence, not only functionality
Responsible AI software should make it possible to explain which model and prompt version produced an output, what source data was used, who reviewed the result and what changed over time. Logs, evaluation sets, approval workflows and fallback paths are product features. Retrofitting them after deployment is slower and more expensive.
FKT Software can help SMEs design AI workflows with disclosure, human review, auditability and secure data handling built in. See our AI and automation services, privacy information, and the European Commission’s official AI Act overview.