AI tools explained simply
EU AI Act: What applies to your business – and what does not?
The world’s first comprehensive AI law has been in force since August 2024 and applies in stages – since August 2026, most of the obligations apply. Many reports sound as if every business now needs an AI officer. The reality for small businesses is considerably more relaxed – but a few things are worth knowing. Not legal advice, but an honest assessment.
- No legalese
- Timeline at a glance
- What really affects SMBs
- Last updated: October 2026
What the AI Act is about.
The AI Act regulates AI by risk: the greater an application’s risk to people, the stricter the obligations. Manipulative systems and social scoring have been banned since February 2025. High-risk applications – AI in recruitment or credit decisions, for instance – have been subject to strict requirements since August 2026. For everyday tools such as chatbots, text or image generators, transparency rules apply above all.
Crucially, the heavy obligations primarily target the providers of such systems – not the business using ChatGPT for quote texts.
What really affects small businesses.
- AI literacy (Art. 4): if you use AI in your business, you must ensure staff are sufficiently trained – proportionate to the use, no certificate course required
- Transparency: when customers interact with an AI (such as a website chatbot), this must be recognisable
- AI-generated content: deceptively real AI-generated images or voices must be labelled in certain cases
- High risk only for sensitive uses: AI that helps decide on applicants, credit or similar falls under the strict rules – which affects very few small businesses
If you use AI as a tool for texts, images, greetings or automation, you usually meet the requirements with common sense: brief your staff, label chatbots, and keep humans in charge of sensitive decisions.
Three things to do now.
First: get an overview of which AI tools are actually used in your business – often more than the boss knows. A simple AI policy for employees creates clarity here. Second: brief your team – what the tools can do, what must not go in (customer data!), how results are checked. Third: label AI wherever customers talk to it directly.
More on the data protection side – what may and may not be entered into AI tools – is in the guide ChatGPT and data privacy.
Frequently asked questions.
Do I need an AI officer as a small business?
No. The AI Act does not require an AI officer. What it requires is that staff using AI are adequately briefed – in small teams, a short internal training and clear rules cover that.
May I keep using ChatGPT, Claude and the like in my business?
Yes. Using such tools remains permitted. Mind what applies anyway: no sensitive customer data as input, check the results, and make sure employees know what the tools are meant for.
Do I have to label AI-generated texts on my website?
There is no general labelling obligation for normal texts. Labelling rules mainly target deceptively real media such as deepfakes and situations where people interact directly with an AI – a chatbot, for instance.
What are the penalties for violations?
The AI Act provides for substantial fines scaled by severity and company size – the highest rates apply to banned practices and large providers. For small businesses using AI as an everyday tool, the risk is low with sensible handling.
Prefer not to handle this yourself?
Tell me briefly what it is about – you get an honest assessment and a personal first conversation.
