The EU AI Act sorts artificial intelligence by what it does, not by the size of the business using it, and most of what a small business already runs lands in the lightest category once you know where to look.
The EU AI Act is the European Union's law for artificial intelligence. It sorts AI systems into risk categories and sets different rules for each one, from an outright ban on a handful of uses to a light transparency duty for most everyday tools. If your business has customers in the EU and uses AI anywhere in how you run it, the Act already reaches you in some form, even if nothing you use calls itself "AI" on the label.
That sounds bigger than it usually is. Most of what a small business runs, a booking assistant, a spam filter, a tool that drafts a first version of a social post, sits in the lightest category the law has, which asks for almost nothing. The businesses that need real advice are the ones using AI to decide things about real people: who gets hired, who gets a loan, who gets flagged as a risk. This guide separates the two, and sits alongside our wider AI strategy for a small business if you want the bigger picture.
The Act does not regulate industries or company sizes. It regulates what an AI system does. The same underlying technology, a language model that writes text, can be almost unregulated when it drafts a marketing email and heavily regulated when it screens a stack of job applications, because the risk is in the use, not the tool.
The heaviest duties in the Act, the documentation, the testing, the technical file, fall mainly on providers: the companies that build and sell an AI system. If you bought a chatbot, a scheduling tool or a writing assistant from someone else and use it as intended, you are almost always a deployer, and a deployer's obligations are much shorter.
Usually, yes, if your AI touches people in the EU. The Act follows the customer, not the company's home address: a business based outside the EU that serves EU customers with an AI powered tool, a chatbot on a website EU visitors use, an AI feature inside a product sold into the EU, falls under the same rules as a business headquartered in Brussels. Location shopping does not help here in the way it sometimes does with other rules.
Everything the Act covers falls into one of four buckets. Knowing which one your tool sits in tells you almost everything about what you need to do.
Not what you bought, what runs. The booking widget, the chatbot, the tool that shortlists CVs, the ad platform's automatic targeting. Owners are often surprised how much of this is already switched on somewhere in the business, quietly, as a default setting.
Use the four categories above. Most items land in minimal or limited risk, the same tools covered in our guide to small business automation. Anything touching hiring, lending, insurance pricing or similarly weighty decisions about a specific person deserves a second look and, honestly, a real conversation with someone who advises on this for a living.
If a visitor is chatting with software and might think it is a person, tell them. A line in the chat window or nearby on the page is usually enough. If you are building or buying an AI agent for customers, plan that one line in from the start rather than bolting it on later.
If software helps decide who gets hired, who gets credit, or anything of similar weight, keep a person reviewing the output before it becomes a decision. That single habit is the practical core of what "human oversight" means for a business your size.
This is the most common situation a small business is actually in, and it is the lighter side of the law. As a deployer, your main obligations are to use the tool the way it was meant to be used, to follow whatever instructions the provider gives you, and to disclose that it is AI where the transparency duty applies, mainly chatbots and AI generated content aimed at the public. If what you run is an AI agent taking the first customer conversation, that disclosure is most of the work. You are not expected to test the model, write technical documentation, or prove it meets standards a much larger company would need to demonstrate. That burden sits upstream, with whoever built it.
Where it gets more serious is if you feed a bought in tool with decisions about specific people and let it run unchecked: hiring, credit, insurance pricing. At that point who built the tool stops mattering as much, because the Act cares about the effect on the person. The single most useful line from the whole law: low stakes, light touch, high stakes, real oversight, whoever built the system.
For most small businesses, not to get started. If everything you use sits in the minimal or limited risk category, a plain read of the rules and a clear disclosure where you use a chatbot covers most of it. Get proper advice specifically when AI is involved in hiring, lending, insurance pricing or another decision the law names as high risk.
The legal definition is broad: software that generates outputs like predictions, recommendations or decisions from the inputs it receives, with some degree of autonomy. In practice this covers chatbots, recommendation features, automatic scoring tools and generative writing or image tools. A basic if-this-then-that rule set with no learning or generation involved usually falls outside it.
No, on its own it is not. A chatbot that answers questions or takes a booking normally sits in the limited risk category, which asks you to disclose that customers are talking to AI rather than a person. It only moves toward high risk if it is making decisions in one of the sensitive areas the Act names directly, which an ordinary customer service bot is not doing.
Yes, if the AI you use reaches people in the EU. The rule follows where the AI's output is used, not where your company is registered, so a chatbot on a website that EU customers use is generally in scope even for a business with no EU office at all.
Go to the European Commission's own AI Act pages rather than any single article, this one included. The phased dates and the thresholds for smaller companies have been adjusted since the law first passed, and an article written even a few months earlier can be describing an older version of the timeline without meaning to.
When a customer searches nearby and books the competitor with a faster site and instant replies, it isn't because they were better. It's because they were easier to find and faster to answer. That's fixable, and it starts with a 15-minute chat that costs nothing.