The EU AI Act, in plain language
A field guide for small and medium businesses. Five questions, the answers the law actually gives, and no treatise. Written by the people who run the readiness check, not by a law firm.
Does this law apply to me at all?
Probably, if you do business with the Union. The EU AI Act does not care where your company sits; it cares where the AI is used. If you are established in the EU, or your AI system's output is used inside the Union by somebody else, you are in scope. A tool used only by customers outside the EU usually is not, until one of them moves.
The second thing that decides everything: your role. A provider builds an AI system, has one built under their name, or changes an existing one substantially and puts it on the market. A deployer uses a system someone else built, in their own organisation. Most small businesses are deployers, and deployers carry fewer duties, but not zero, and the duties they do carry are the ones small organisations actually fail.
If you do both, the law treats each system separately. Your own product may be minimal risk while the screening tool in your hiring stack is not.
What is banned outright?
Article 5 lists practices with no compliance path. They have been prohibited since 2 February 2025, and the only remedy is to stop. The ones a small business is most likely to stumble into:
- Social scoring: rating people's general trustworthiness across unrelated parts of their life.
- Emotion inference at work or in education: attention tracking, mood scoring, frustration detection on your staff or students.
- Biometric categorisation inferring sensitive traits: ethnicity, political opinion, religion, sexual orientation.
- Real-time biometric identification in public spaces: mostly a state activity, but know it exists.
- Manipulative techniques that cause significant harm, and exploiting vulnerabilities to deceive.
The pattern worth noticing: vendors sell several of these as features. Engagement analytics, trust scores, audience insights. The ban does not care what the brochure called it.
The check flags these directly, with the option to say "we would have to check" →
What counts as high-risk for a business like mine?
The Act's risk tiers attach to what a system is used for, not to how clever it is. Annex III lists the use cases that are automatically high-risk, and for an SMB the list is shorter than it looks:
- Employment: sorting, screening, ranking applicants; evaluating and monitoring staff.
- Credit, pricing and insurance: scoring customers or applications.
- Essential services: eligibility for utilities, housing, benefits.
- Biometric identification: matching faces, voices or gaits to identities at scale.
- Safety components in regulated products (machinery, medical devices, vehicles), which follow the Annex I route a year later.
One filter matters. Where a human genuinely reviews each case and has real authority to change the outcome, the provider may assess the system as not high-risk under Article 6(3). That assessment is theirs to make and document: ask for it in writing rather than assuming your review practice settles it.
What do you have to do, and by when?
This is where most guides mislead small businesses, by listing every duty in the Act as if it were yours. Duties split by role.
If you are a deployer of a high-risk system, your duties sit in Article 26: use the system following the provider's instructions, assign human oversight to people with the competence and authority to intervene, keep the automatically generated logs for at least six months, tell affected workers before you use the system at work, tell the people subject to a decision that AI was involved, and report serious incidents. None of these require you to build a risk-management system. That is your vendor's job, and your contract is where you demand the evidence of it.
If you are a provider, Articles 8 through 17 are yours: the intended-purpose statement, data governance, technical documentation, the quality management system, conformity assessment and registration where classification requires it.
Whatever your role, two duties arrive before all of the above: AI literacy (Article 4, in force since February 2025: one good session plus a one-page policy is proportionate for a small team), and knowing what you use. The inventory is not a numbered article, but every duty in this guide attaches to a system on that list.
The deadlines, after the 2026 Omnibus moved the high-risk ones:
- 2 February 2025Prohibited practices (Article 5) and AI literacy (Article 4). Already binding.
- 2 August 2025Obligations for providers of general-purpose AI models. Mostly model builders, not tool users.
- 2 August 2026The Act applies in general, including the Article 50 transparency duties: chatbot disclosure, synthetic content marking.
- 2 December 2026Legacy synthetic-content tools must comply with Article 50(2). The grace window closes.
- 2 December 2027High-risk obligations for Annex III systems: employment, credit, insurance, essential services, biometrics. The date that matters to most deployers.
- 2 August 2028High-risk obligations for AI as a safety component of regulated products (Annex I).
How does this touch the GDPR I already deal with?
The EU AI Act does not replace the GDPR, and it does not hand you a new authority to report to: market surveillance authorities enforce it, your data protection authority keeps doing what it does. What changes is the overlap.
Biometric data is special-category data under the GDPR regardless of the EU AI Act's risk tiers: face recognition for your own office door needs a lawful basis and probably a DPIA whether or not the system counts as high-risk. The EU AI Act leans on that overlap deliberately: deployers of high-risk systems are told to feed the provider's documentation into their GDPR impact assessment, not to run two parallel processes.
The practical read for an SMB: if your AI use touches personal data, the GDPR work you already know how to do (lawful basis, data processing agreements, impact assessments) covers more of the EU AI Act than you would expect. Start there, then add the AI-specific pieces the check surfaces.
This guide is a map, not advice on your specific systems. The readiness check is the next step: it asks what you actually use and tells you which of the above reaches you.
Last reviewed 13 October 2026 against the Commission's implementation timeline. Dates move; this page carries a verify-by note in its source and is re-checked when the law does.