The EU AI Act: what small businesses must do

Last checked: 12 November 2026. This guide explains the law in plain language. It is not legal advice. For decisions about your business, read the official text and speak to a qualified adviser.

The short version

If your business uses a chatbot, an AI assistant on WhatsApp, or AI to write or create content for customers in the EU, parts of the EU AI Act already apply. The transparency rules in Article 50 have applied since 2 August 2026. The well-publicised 2026 delay, the Digital Omnibus, postponed the rules for high-risk AI. It did not postpone most transparency duties.

Does it apply to my business?

The AI Act covers organisations that provide AI systems and organisations that use them (the Act calls users "deployers"). It reaches businesses based outside the EU too, including in the UK and Serbia, when their AI systems are placed on the EU market or their output is used in the EU. If you serve customers in the EU with AI-powered tools, assume it is relevant and check.

Most small service businesses are deployers: they use a chatbot, AI assistant or content tool built by someone else.

What applies now

What the Digital Omnibus changed

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. For small businesses, three changes matter:

1. High-risk rules delayed. Obligations for stand-alone high-risk systems, such as AI used in hiring, credit decisions or access to essential services, moved from 2 August 2026 to 2 December 2027.
2. AI literacy softened. Article 4 changed from requiring businesses to ensure a sufficient level of AI literacy to requiring them to take measures to support it. It is still an obligation, but one of effort rather than outcome.
3. Transparency mostly unchanged. Article 50 duties applied on schedule from 2 August 2026, with only a short extension for marking by generative AI tools already on the market.

The Omnibus also asks authorities to keep penalties proportionate for smaller businesses. That is not a reason to ignore the rules.

What this means for a chatbot or AI assistant

If you use AI to answer enquiries on your website, WhatsApp, Viber or email:

• Make sure every conversation clearly shows the customer is talking to an AI assistant. We do this on every assistant we build.
• Give customers an easy way to reach a person.
• Keep the assistant to information you have approved, especially prices and professional advice.
• Remember the GDPR still applies to the personal data in those conversations. The AI Act adds to it rather than replacing it.

What this means for AI-written content

• Content you publish after human review, with a person responsible for it, is treated differently from unreviewed AI text on public-interest matters.
• Never publish AI-generated images or videos of real-looking people or events without labelling them.
• Keep a simple record of which tools you use and who reviews what they produce.

Your checklist

• List every AI tool your business uses with customers: chatbots, assistants, content and image tools.
• Confirm each customer-facing assistant tells people it is AI, and that a person is reachable.
• Label any AI-generated or manipulated images, audio or video that could be mistaken for real.
• Make sure AI-written public content is reviewed by a named person before it goes live.
• Give staff who use AI tools basic guidance and training, and keep a note that you did.
• Check whether any of your uses could be high-risk, such as AI in recruitment. If so, take advice now: the extended deadline is 2 December 2027.
• Review this list whenever you add a new AI tool, and at least every three months.

We build AI enquiry handling and AI chat assistants with disclosure, human handover and approved knowledge built in from day one.