The EU AI Act for Small Businesses: What You Actually Have to Do

The EU AI Act is the world's first comprehensive AI law, and the headlines make it sound terrifying. For a small business that simply uses AI tools (rather than building high-risk AI systems), the real obligations are more manageable than they look.

Does it apply to you?

If your business or its output reaches the EU (EU customers, or EU-based staff using AI on your behalf) then yes, it can apply, even if you're based outside the EU.

You're probably a 'deployer', not a 'provider'

The heaviest duties fall on providers of high-risk AI systems. Most small teams are deployers of general tools like ChatGPT, so the practical duties are: don't use banned practices, ensure basic AI literacy among staff, and be transparent (tell people when they're dealing with AI or AI-generated content).

The AI-literacy duty

Since February 2025, you must ensure staff who use AI have a sufficient level of AI literacy. A written AI usage policy plus a short briefing is the simplest way to evidence this: you have a document and a record people read it.

What to do this quarter

Write an AI usage policy, keep a register of the AI tools you use, and make sure anyone using AI understands the basics. That covers the realistic first steps. See our EU AI Act guide for the detail.