The EU AI Act Is Here. What It Actually Asks of a Small Business.

Most of what you have heard about the EU AI Act is fear. Fear sells consulting.

Here is the calmer version. The Act has been phasing in since 2024, and its main obligations now apply. For most small businesses, what it actually asks is modest. The businesses that get hurt will not be hurt by the Act's complexity. They will be hurt by ignoring basics they were already supposed to have under GDPR.

Let me separate what the rules say from what the fear says. This is orientation, not legal advice, but it will put the picture straight.

The Act sorts AI by risk, and most of you are at the bottom

The AI Act does not regulate AI. It regulates uses of AI, sorted into risk tiers.

A short list of uses is banned outright. Social scoring, manipulative systems that cause harm, scraping the internet for faces. If any of that is in your business plan, the problem is not compliance.

High-risk covers AI used in things like hiring decisions, credit scoring, and essential services. Real obligations live here. Documentation, human oversight, registration. If your AI screens job applicants or decides who gets a loan, take it seriously and get proper advice.

Then there is everything else, which is where most SME use of AI actually sits. Chatbots, content drafting, summarising, forecasting, internal automation. The duties here are mostly transparency. Do not pretend a bot is a human. Do not pass off AI-generated media as real. That is common sense with a legal backbone.

GDPR did not go anywhere

The AI Act gets the headlines. GDPR is still where small businesses actually get caught.

The moment customer information goes into an AI tool, you are processing personal data. The same rules as always apply. You need a lawful basis. You should not feed the tool more than the task needs. And the vendor behind the tool is your processor, which means you need a data processing agreement with them, not just a subscription.

The classic failure is not a company doing something evil. It is an employee pasting a customer list into a free AI tool that trains on its inputs. No agreement, no basis, no control. That is a GDPR problem you created in thirty seconds.

What you actually have to do

Strip away the noise and the practical list is short.

Know what AI you use. Most businesses cannot name every AI tool their team touches, and the free tools nobody mentions are the risky ones. Make the list.

Tell people when it matters. If customers are talking to a bot, say so. If AI produced the content or the decision support, be able to say so.

Keep a human on decisions that affect people. Pricing for a customer, rejecting an applicant, closing an account. AI can prepare the decision. A person should own it, and you should be able to explain it afterwards.

Check your vendors. Where does the data go, is it used for training, is there a processor agreement, is it hosted somewhere sensible. Four questions, one email.

None of this needs a compliance department. It needs an afternoon and a bit of discipline.

Why being early is cheap

Everything above costs almost nothing when you do it while your AI use is small. An inventory is a page. Transparency is a sentence in the right place. A human checkpoint is a workflow decision.

Retrofitting is the expensive version. Untangling personal data from a tool it should never have entered. Explaining to a regulator, or an angry customer, how an automated decision was made when nobody can reconstruct it. Rebuilding a workflow because compliance was bolted on last.

We build products and automations for European businesses, so these rules are constraints we design with from day one, not a review at the end. It is genuinely easier that way.

If you want to know where you stand, start by measuring it. Our free EU AI and GDPR readiness check takes three minutes and tells you which of these basics you have covered and which need attention.

The AI Act is not coming for your business. Being unprepared is. And the preparation is smaller than the fear.