If you use AI in your company, whether it is a chatbot, a translation tool or automatic candidate screening, the European regulation on artificial intelligence, known as the EU AI Act, probably applies to you. It is not only a matter for big tech giants. Let's look at what it means for a small or medium company.
What is the EU AI Act
The EU AI Act is the first comprehensive regulation of artificial intelligence in the world. It has applied since August 2024 and introduces its obligations in phases. It does not try to ban AI. It sets rules based on how much risk a system poses to people.
Four levels of risk
- Unacceptable risk: banned practices, for example manipulative AI or social scoring of citizens. The ban has applied since February 2025.
- High risk: AI in sensitive areas such as hiring, creditworthiness assessment, education or critical infrastructure. Strict requirements apply here.
- Limited risk: systems where a person must be told they are interacting with AI, for example chatbots or AI generated content.
- Minimal risk: most everyday tools, such as spam filters. No special obligations apply.
Who is affected
The regulation distinguishes two main roles. A provider is the one who develops an AI system or places it on the market. A deployer (user) is a company that uses a finished system in its activities. Most small companies are deployers, so their obligations are lighter, but they exist. If, however, you develop AI for clients or adapt someone else's model into your own product, you may be a provider.
Deadlines to watch
The timetable was adjusted in 2026. According to the information available, the obligations for standalone high risk systems moved to December 2027 and for systems embedded in regulated products to August 2028. On the other hand, the transparency obligations, such as telling users they are communicating with AI, are meant to apply from August 2026. The ban on certain practices and the duty to ensure AI literacy among staff have applied since 2025.
The delay of the high risk rules does not mean you can relax. It only gives you more time to prepare.
A practical checklist for small companies
- Make an inventory of AI tools. Find out which AI tools your company uses, including the ones employees use on their own.
- Place them into risk categories. Most will be low risk, but watch out for hiring and assessing people.
- Be transparent. If a customer talks to a chatbot, tell them. Label AI generated content where the rules require it.
- Train your people. Employees who work with AI should understand its limits.
- Document. Write down what you use AI for, who is responsible and how you check the results.
- Check your suppliers. Make sure the providers of your tools meet their obligations.
How a consultation can help
The regulation is complicated and it is easy to get lost in it. We can help you map where you use AI in the company, assess the risks from a technical point of view and design practical solutions, so you can innovate and stay compliant at the same time. For legal interpretation we recommend working with a lawyer. We will take care of the technical side.
Conclusion
The EU AI Act is no reason to avoid AI. It is a framework meant to turn AI into a trustworthy tool. If you want to start preparing, write to us. You can find more about our advisory services on the pages IT consulting and AI and autonomous AI agents.