The EU AI Act: Seven Steps for Small Businesses
By Dylan van der Merwe9 min read
In this article
If your team uses ChatGPT, Copilot, or the AI features that have quietly appeared inside your accounting, CRM, or HR software, the EU AI Act already applies to you. Not because you build AI, but because you use it. The Act calls you a deployer, and deployers have obligations too.
That surprises a lot of small businesses. The headlines have mostly been about the big model providers, and the news that some deadlines have been pushed back has given the impression that there's nothing to do yet. There is. Some duties have been in force since 2025, and the good news is that the first steps need nothing more than a spreadsheet and an afternoon.
What's in force and what's coming
The Act is being phased in, and the timeline moved in July 2026 when the EU's "Digital Omnibus" amendment (Regulation (EU) 2026/1744) came into force. The dates that matter to most businesses are:
| Date | Status | What it covers |
|---|---|---|
| 2 February 2025 | In force | Banned practices, and the AI literacy duty for staff who use AI |
| 2 August 2026 | In force | Transparency rules, including telling people when they're talking to an AI and labelling deepfakes |
| 2 December 2026 | Upcoming | New ban on AI systems that generate non-consensual intimate content |
| 2 December 2027 | Upcoming | Obligations for high-risk uses such as hiring and credit decisions (previously August 2026) |
The delay applies to the high-risk rules only. The AI literacy and transparency duties are not postponed. The literacy duty applies to every business using AI, whatever its size.
This is still early, and parts are unsettled
It's worth being upfront: the AI Act is young, and it's still being worked out in practice. Its first obligations only began to apply in 2025, and the timeline has already been rewritten once. Some of what follows will change.
- Dates can move. The high-risk deadline was pushed back by over a year, only weeks before it was due to apply. Further adjustments aren't impossible.
- Guidance is still arriving. The European Commission is still publishing guidelines and codes of practice, such as those on labelling AI-generated content, and national regulators are still setting up how they'll supervise and enforce the rules. How strictly the rules will be applied to small businesses isn't yet clear.
- Some definitions are untested. What counts as sufficient AI literacy, or exactly where a particular use sits on the risk scale, hasn't been tested by regulators or the courts yet. Reasonable advisers differ on some of the detail.
- Your vendors are still catching up. Software providers are still working out how to document their own compliance, so the answers you get today may be incomplete.
None of that is a reason to wait. The steps below are low-cost basics that hold up whichever way the details land, and the AI literacy and transparency duties apply today. Treat this as a starting point, and expect to revisit it.
Seven steps to get started
None of this requires specialist software. Work through these in order and write down the date you finish each one. The record is half the point.
1. List every AI tool your team uses
Start with an inventory, and make it honest. Include the obvious tools (ChatGPT, Copilot, Gemini), the AI features inside software you already pay for, and the free apps staff have signed up to with personal accounts. That last group is where most businesses are surprised. If nobody has the full picture, you can't manage the risk.
2. Note what each tool is used for
One tool can have several uses, so record each separately. "ChatGPT for drafting marketing emails" and "ChatGPT for screening CVs" are two different entries, and they won't be treated the same way in the next step.
3. Work out the risk level of each use
Risk depends on the use, not the tool. The same tool can be low-risk in one team and high-risk in another. Flag any use that involves:
- Decisions about people, such as hiring, performance reviews, or credit
- Personal or sensitive data
- Realistic content that people might mistake for the real thing, like synthetic images, audio, or video
Drafting an internal email is nothing like ranking job applicants.
4. Give your team practical guidance, and keep a record
This is the step that's required now. Help staff understand the tools they're using, what they're good at, where they go wrong, and what mustn't be put into them. Then record what guidance or training was given, to whom, and when.
It doesn't need to be a formal course. A short session and a written note of who attended is a reasonable start, as long as it's proportionate to how your team actually uses AI.
5. Put a short AI use policy in place
Set clear rules for staff. One to two pages is plenty. The most useful part is a simple rule for what data can go into which tools:
| Data type | Where it can go |
|---|---|
| Public | Approved tools |
| Internal | Approved business tools only |
| Personal or client-confidential | Only tools covered by a data processing agreement, or not at all |
If staff can't tell at a glance whether something is allowed, they'll guess — or use a personal account to avoid asking.
6. Ask your software providers about the Act and your data
Send each vendor a short list of questions:
- How are you meeting the AI Act?
- Do we have a data processing agreement in place?
- Are our inputs used to train your models?
- Is our data processed outside the EU?
Keep the answers. They are useful evidence if you're ever asked how you assessed a tool, and they often reveal settings you can switch off.
7. Name an owner and review at least quarterly
One person owns AI compliance. They don't need to be technical, but they do need the authority to say "not yet" to a new tool. Staff should flag new tools before using them, and someone should check vendor release notes and settings for new AI features at least once a quarter.
A worked example: two departments using Claude
To make this concrete, here's how it might look for a made-up 40-person company that has rolled out Claude (the same approach applies to ChatGPT, Copilot, or any similar tool) in customer support and HR. The details are illustrative, not a template to copy blindly.
Step 1: the register
Each use gets its own row, not each tool. Claude appears four times:
| Department | Use | Data involved | Risk | Controls |
|---|---|---|---|---|
| Support | Drafting replies to customer emails | Customer names, order details | Low | Agent reads and edits every reply before it's sent |
| Support | Summarising long ticket threads | Customer personal data | Low | Business account only; no personal accounts |
| HR | Drafting job ads and policy documents | Internal and public information | Low | HR lead reviews before publishing |
| HR | Summarising CVs for the hiring manager | Applicant personal data | Higher, treat as high-risk | See below |
The last row is the one that matters. Using AI to summarise, filter, or rank candidates touches decisions about people, which is exactly the kind of use the Act treats as high-risk. Those obligations start in December 2027, but it's far easier to decide your approach now than to untangle it later. This company decides that Claude may help draft job ads, but may not score, rank, or reject candidates. A person reads every CV and makes every decision, and the CV summary use is paused until the company has worked out its oversight process.
What to write down
The paperwork for both departments is small:
| Record | What it contains | Example |
|---|---|---|
| AI register | The table above, plus an owner and a "last reviewed" date | Reviewed 3 November; next review February |
| Use policy | One or two pages of rules, including the data table from step 5 | "Customer personal data only in the company Claude account. Never in free or personal accounts." |
| AI literacy record | Who was given what guidance, and when | "Support team (6 people): 45-minute session on how Claude works, where it gets things wrong, and what not to paste in. 12 October." |
| Vendor file | Answers to the step 6 questions, the signed data processing agreement, and the date you checked settings | "DPA signed; confirmed whether inputs are used for training; data location noted." |
| Decision note | Why a use was classed the way it was, especially anything you declined | "CV ranking not permitted. Reason: decisions about people. Revisit before December 2027." |
That last record is the one most businesses skip, and it's the one that best shows you thought about it.
Transparency: a customer-facing chatbot
Support agents using Claude to draft replies they check and send themselves is an internal tool. If the company later put a Claude-powered chat assistant on its website, the transparency rules would apply: customers must be told they're talking to an AI, unless it's obvious. That would be a new row in the register, with its own risk check, and a record of how customers are told.
Keeping it current
The company's compliance owner, say the operations manager, spends an hour each quarter on three questions: Has anyone started using a new tool or feature? Has a vendor switched on something new? Has a use changed in a way that affects its risk level? The answers update the register, and the date gets recorded. That's the whole routine.
Three patterns come up again and again:
- Hidden AI use. Free apps and personal accounts mean nobody has the full picture, so the register is wrong from day one.
- Classifying by tool instead of by use. A tool that is harmless for drafting social posts can be high-risk when it's used to shortlist candidates.
- Silent software updates. Vendors switch on new AI features by default, often without a headline announcement. Your register is out of date the moment an update lands, which is why the quarterly review matters.
The records to keep
For every business using AI, the core set is small: an AI register, your AI use policy, AI literacy records (who was given what guidance, and when), and, where you can get them, vendor responses.
If you have any high-risk uses, there is more to add ahead of the December 2027 deadline: a human oversight process, system logs kept for at least six months, notices to the people affected, and a data protection impact assessment under GDPR. If one of your uses is heading in that direction, start planning early. Oversight is much easier to design in than to bolt on, and we've written about how to do it in how to design human-in-the-loop AI workflows.
What it costs to ignore it
Fines under the Act can reach €35 million or 7% of worldwide turnover for banned practices, and €15 million or 3% for most other breaches. For SMEs, the lower of the two figures applies. Those are ceilings, and regulators are expected to take size and circumstances into account, but they're a reminder that this is a legal duty, not a best practice.
Where to start
Block out an afternoon. Build the inventory, note what each tool is used for, flag the uses that involve people or personal data, and book a short session with the team. That alone puts you ahead of most businesses and covers the part of the Act that is required today.
If you want to go further, we help businesses assess where AI is already in use, where it adds value, and how to build it with the right controls from the start. Our AI consulting engagements do exactly that, and you're welcome to get in touch if you'd like to talk it through.
For the authoritative detail, go to the source: the EU AI Act Service Desk, the European Commission's AI Act pages, and the Irish Data Protection Commission for the GDPR side.
This post is general guidance, not legal advice. For decisions specific to your business, consult a qualified adviser. The rules and official guidance are still evolving. This reflects the position as of November 2026, based on the EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744, and we'll update it as things change.