The EU AI Act for small and medium-sized companies: what applies, what does not

The AI Act (Regulation (EU) 2024/1689) has 113 articles and 13 annexes. By far the largest part addresses those who build and sell AI systems, and a few clearly named high-risk applications. For a normal company – metalwork, stonemasonry, tax firm, retail – three points remain: one for everyone, two only in certain cases. This page says which they are, what does not concern the company, and what applies since when. As of September 2026.

Not sure whether this applies to your company? Five short questions →

What the Regulation covers

It sorts AI by risk, in four tiers. The higher the risk, the more obligations – and most of them fall on the provider (whoever develops the system or sells it under their own name), not the deployer (whoever uses it professionally).

  1. Prohibited (Article 5): for example social scoring, manipulative systems, emotion recognition in the workplace. Applies to everyone, since 2 February 2025.
  2. High-risk (Annex III): AI in recruitment, credit scoring, critical infrastructure, education, justice. Extensive obligations, mainly for providers; deployers must use such systems according to the instructions, monitor them and inform affected persons.
  3. Transparency obligations (Article 50): customer chatbots must identify themselves, deceptively realistic AI-generated images, videos or audio must be labelled.
  4. Everything else – and that is the vast majority: drafting texts, translations, summaries, Copilot in Office. No product obligations apply. One provision remains that applies to all: the AI literacy of employees (Article 4).

What does not concern a normal company

  1. The provider obligations. Risk management, technical documentation, conformity assessment, CE marking – that is for those who make AI systems. Anyone using ChatGPT, Copilot or an AI tool in their ERP is a deployer.
  2. The high-risk provisions – as long as the company does not use AI in one of the Annex III areas. Writing texts, rewording quotations, having analyses explained: not high-risk. Pre-screening applicants by AI or evaluating employees by AI: then yes.
  3. Registration, notification, approval. None of these exist for using common AI tools.
  4. An AI officer. Unlike data protection, the Regulation does not require a named person.

What typically concerns a normal company

  1. AI literacy of employees (Article 4, since 2 February 2025). Whoever uses AI in their company must take appropriate measures to promote the AI literacy of their people – appropriate to task and tool. No prescribed training, no certificate; but the question “How did you make sure of that?” comes from insurers, customers and auditors. Article 4 in detail · What belongs in a training
  2. Transparency in certain cases (Article 50, since 2 August 2026). If the company uses a customer chatbot, it must be clear to users that they are interacting with AI – unless that is obvious anyway. AI-generated or manipulated images, videos or audio that could appear real must be labelled as such. For AI-generated texts on matters of public interest this applies only where there is no human review and editorial responsibility. The obligation for chatbots formally addresses the provider in the first place; a company with its own website chatbot nevertheless implements the labelling visibly.
  3. Prohibited practices (Article 5, since 2 February 2025). For companies above all one thing: no emotion recognition in the workplace, no evaluation of employees by facial expression or voice. That is prohibited, not just regulated.

What has not changed through the Regulation and is often confused with it: data protection. Customer data or other confidential information must not be entered unchecked into public or unapproved AI tools – that was true before; the AI Act is not the reason, the GDPR is.

What applies since when

  1. 1 August 2024 – the Regulation enters into force.
  2. 2 February 2025 – the prohibitions (Article 5) and AI literacy (Article 4) apply.
  3. 2 August 2025 – obligations for providers of large AI models (ChatGPT, Gemini, Claude and similar) apply.
  4. 2 August 2026 – the transparency obligations (Article 50) and most of the remaining provisions apply.
  5. High-risk: postponed with the July 2026 revision (“Digital Omnibus”) – the Annex III areas apply from 2 December 2027, product-integrated high-risk AI from 2 August 2028. Of no relevance to most companies.

What a company does now

  1. Clarify where AI is in use. Which tools, which people, for what. Usually: office, sales, costing, management.
  2. Check whether any of it is high-risk or a chatbot. Recruitment, evaluation of employees, customer chat: then look closer. Otherwise on to step 3.
  3. Rules and knowledge. One page of rules (which tools, what may go in, who checks), a talk or workshop – what belongs in an AI literacy training.
  4. Document. Document rules, instruction and participation. An assessment per employee can be a traceable part of that: at AI4Cert around 30 minutes, with a reference number, a summary record for the company and a seal for the website.

Register your company Why an AI literacy record?

Frequently asked questions

Does the AI Act apply to small companies too? Yes, as soon as the company uses AI tools professionally – including ChatGPT or Copilot in the office. Most of the Regulation, however, addresses manufacturers and high-risk applications. For a normal company three points remain: the AI literacy of employees (Article 4) for everyone, plus in certain cases the transparency obligations (Article 50, e.g. a customer chatbot) and the prohibited practices (Article 5).

Do I have to report or register the use of ChatGPT in my company? No. There is no registration, notification or approval for using common AI tools in the office.

Do I need an AI officer? No. Unlike data protection, the AI Act does not require a named person in the company.

Do I have to tell customers that a chatbot is answering? Yes. Anyone using a chatbot towards customers must make it clear that an AI is answering (Article 50) – unless that is obvious anyway. AI-generated or manipulated images, videos or audio that could appear real must also be labelled as such.

What is high-risk AI, and does it concern me? AI in areas such as recruitment, credit scoring, critical infrastructure, education or law enforcement (Annex III). A company that writes texts with AI or has analyses explained is not affected. Anyone using AI to screen applicants or evaluate employees should look closely.

Since when has the AI Act applied? In force since 1 August 2024. Prohibitions and AI literacy apply since 2 February 2025, obligations for providers of large AI models since 2 August 2025, the transparency obligations and most other provisions since 2 August 2026. The high-risk provisions were postponed with the 2026 revision: Annex III areas from 2 December 2027, product-integrated high-risk AI from 2 August 2028.