The EU Artificial Intelligence Act is the first comprehensive AI law from a major regulator, and it was written to reach well beyond Europe’s borders. If your business sells to customers in the EU, runs a website that EU visitors use, or deploys AI features that touch EU residents, the Act is relevant to you, even if your company is based in Texas, Manchester, or Brisbane.
The good news for most small businesses: the strictest rules target high-risk systems and the companies that build foundation models. A five-person agency using an AI writing assistant is not in the same category as a bank automating credit decisions. The law still asks something of you, though, and the cost of getting it wrong is reputational as much as legal.
How the Risk Tiers Work
The Act groups AI uses into four broad tiers. Your obligations depend on which tier a given use falls into, not on which tool you use.
| Risk tier | Typical examples | What it means for you |
|---|---|---|
| Unacceptable | Social scoring, manipulative techniques that exploit vulnerabilities | Prohibited outright |
| High | AI used in hiring decisions, credit scoring, access to education or essential services | Strict requirements: risk management, documentation, human oversight |
| Limited | Customer-facing chatbots, AI-generated or manipulated media | Transparency: people must know they are dealing with AI |
| Minimal | Spam filters, drafting assistants, internal analytics | No new obligations beyond existing law |
Most small-business AI use lands in the minimal or limited tiers. The one area to watch closely is hiring: if you use AI to screen CVs or rank candidates for roles open to EU applicants, that use may be classed as high-risk.
Transparency Duties for Chatbots and AI Content
If you run a website chatbot, an AI phone agent, or an automated support assistant that EU users can reach, you should make it clear that the user is interacting with an AI system. A short line such as “You’re chatting with our AI assistant. A human can take over at any time” is a sensible default.
Synthetic images, audio, and video that could be mistaken for real content also carry labelling expectations. If you publish AI-generated product imagery or deepfake-style marketing video, disclose it.
What Happens to General-Purpose AI Models
Providers of general-purpose AI models, the companies behind the large language models that power popular assistants, carry their own set of obligations around documentation, copyright policies, and, for the most capable models, systemic-risk assessments. As a business that uses these tools rather than builds them, those duties are not yours, but they shape the terms of service and data controls vendors offer you.
A Practical Checklist for Small Teams
- Inventory your AI uses. List every tool and workflow that uses AI, who it affects, and whether EU residents are involved.
- Flag any hiring or eligibility use. If AI influences who gets a job, a loan, or a service, get specialist advice.
- Label customer-facing AI. Add a clear disclosure to chatbots and AI-generated media.
- Keep a human in the loop. Document who reviews AI outputs before they reach customers.
- Review vendor terms. Check data-processing agreements and where your data is stored.
If you want a starting point for documenting your workflows, our prompt template library includes a reusable “AI use register” prompt.
The Bottom Line
For the typical small business, the EU AI Act is less about new paperwork and more about good habits: know where you use AI, be honest with customers when they are talking to a machine, and keep humans accountable for consequential decisions. This article is general information, not legal advice. If AI touches hiring or eligibility decisions in your business, speak to a qualified adviser.
