EU AI Act: what every small business should know in 2026

Most small business owners think the EU AI Act only concerns companies that build artificial intelligence. Wrong. If your business uses a chatbot, tools like ChatGPT, or AI built into office software, the regulation already applies to you — as a deployer.

No need to panic, and no need for a lawyer from day one. But you do need to know where you stand. Here are the essentials, without the legalese.

What it is, in a nutshell

The EU AI Act is the European regulation that classifies AI systems by their risk and sets obligations for each category. It doesn't look at the technology itself — it looks at what you do with it.

The four risk categories

• Unacceptable risk: practices that are fully prohibited (e.g. social scoring of citizens).
• High risk: systems in sensitive areas (hiring, credit assessment, etc.) — strict requirements.
• Limited risk: this is where most chatbots fall — a basic transparency obligation.
• Minimal risk: the vast majority of tools — no special obligations.

What applies to you in practice

If you have a chatbot that talks to customers, two things are non-negotiable:

• The customer must know they're talking to an AI, not a human.
• There must be human oversight — someone responsible for what the system says.

Liability to your customer for what the bot says remains yours — not the platform provider's.

Even if you use an off-the-shelf platform, the compliance obligation as a deployer is yours. This is exactly where most SMBs are exposed without knowing it.

Three steps you can take this week

• Write down which AI tools you use and who operates them.
• Make sure every customer touchpoint clearly states the use of AI.
• Appoint someone responsible — even informally — for AI matters.

These three alone move you out of the "we didn't even know what applied" zone. The rest is built gradually.