EU AI Act for small businesses: plain-English guide
For most small businesses the Act is three live duties: AI literacy since 2 February 2025, transparency from 2 August 2026, and staying clear of the banned practices in Article 5.
Drafted with AI help and checked against the official EU text before publishing.
For most small businesses the Act is three live duties: AI literacy since 2 February 2025, transparency from 2 August 2026, and staying clear of the banned practices in Article 5. High-risk product rules were put back to December 2027 and August 2028; SMEs get the lower of two fine caps, not a free pass.
If you only use everyday tools as the deployer, you are not asked to sign a Union register.
Extra high-risk product rules were put back to 2 December 2027 (Annex III uses) and 2 August 2028 (Annex I product-safety systems) by the Digital Omnibus on AI. That is extra time, not a pause on literacy or transparency. SMEs get the lower of two fine caps in each band — that is a ceiling, not a free pass.
This is general information, not legal advice.
What the law actually says
"It shall apply from 2 August 2026. However: (a) Chapters I and II shall apply from 2 February 2025."— EU AI Act, Article 113 (Regulation (EU) 2024/1689) · eur-lex.europa.eu
"Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I."— Article 113 as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI) · eur-lex.europa.eu
In plain words
- Chapter I includes Article 4 literacy — in force from 2 February 2025.
- Article 50 transparency — tell people they are talking to AI, and mark listed AI-made content — applies from 2 August 2026.
- Article 5 banned practices have applied since 2 February 2025. Almost no shop using a writing assistant is in that list; the page on prohibited practices explains how to be sure.
- If you only use everyday tools as the deployer, you are not asked to sign a Union register.
Timeline that actually bites a small shop
- 2 February 2025 — Article 4 literacy duty (Article 113(a); Chapters I and II).
- 2 August 2026 — Article 50 transparency, and the general application date in Article 113.
- 2 December 2027 — extra high-risk duties for Annex III uses, after the Digital Omnibus on AI (Regulation (EU) 2026/1744).
- 2 August 2028 — extra high-risk duties for Annex I product-safety systems, same Omnibus amendment.
Deployer versus provider, in plain words
"‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;"— EU AI Act, Article 3(4) (Regulation (EU) 2024/1689) · eur-lex.europa.eu
- Provider = the firm that puts the tool on the market (OpenAI, Microsoft, a vendor with its own named system).
- Deployer = you, when your business uses that tool under your authority. A sole trader counts.
- Personal, non-professional use is carved out. Serving customers is not personal use.
Reliefs that apply to small businesses — not a free pass
"In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower."— EU AI Act, Article 99(6) (Regulation (EU) 2024/1689) · eur-lex.europa.eu
- Article 99(6) is a lower cap, not a promise that nobody will ever be asked questions.
- The later high-risk dates are extra time for those systems. They do not pause Article 4 or Article 50.
- Article 62 asks Member States to help SMEs (including sandbox access). The exact help on offer is national — see the country guides.
Every answer in this Q&A
- Do I need to register my business somewhere for using AI tools?
- What are the fines, realistically, for a small business?
- When did the EU AI Act start applying to my business?
- Do I have to tell customers when AI wrote something?
- What counts as an "AI system" for a small business?
- Do my staff need AI training, and what counts as enough?
- What is a "deployer" — is that me?
- Does the EU AI Act apply if I'm outside the EU?
- What records should I keep, exactly?
- Does using free AI tools like ChatGPT create duties?
- I use my own personal AI account at work — do I have duties, or just my employer?
- Does the EU AI Act apply to sole traders?
- Do I need a lawyer to get ready for the EU AI Act?
- What happens at a border control or audit — what do I show?
- Can I use AI for hiring?
- Can I use AI to write customer emails?
- Do chatbots on my website need an AI notice?
- Is Excel-with-AI-features an AI system?
- What if I only use AI internally, never for customers?
- Do freelancers count as staff for training?
- What's the difference between the EU AI Act and GDPR?
- What AI practices does the EU AI Act ban?
- The EU AI Act in Germany
- The EU AI Act in France
- The EU AI Act in the Netherlands
- The EU AI Act in Spain
- The EU AI Act in Poland
What GlassBots does for this
- Will look for signs of AI use in the folders you choose, and write them down for you.
- Will write a plain-language readiness report. No evidence reads "Not assessed", never a green tick.
- Will run as a free Windows program on your own computer and send nothing from it.
Get notified
free · local · sends nothing
- Coming with Guard: a check every month, kept so you can see your history and what changed since the last one.
- Coming with Guard: a printable readiness pack built from your check results — AI use found, training notes, disclosure checklist.
See sample reports →
Guard is coming
Did this answer your question?
Readiness guidance, not legal advice. The Free Toolkit sends nothing from your computer.