The EU AI Act for small and mid-sized businesses

The short version

The EU AI Act sorts AI systems by risk. A handful of uses are banned outright. A defined list of high-risk uses, such as screening job applicants or deciding who gets credit, carries heavy obligations. Systems that talk to people, such as chatbots and voice agents, carry transparency duties: mainly, people must be told they are dealing with an AI. Everything else, which covers most back-office automation, has no specific new obligations beyond a general duty to make sure your staff understand the AI they use.

For most small and mid-sized businesses, that means the Act is manageable. The work is knowing which tier each of your systems sits in, and noticing when a new idea crosses into high-risk. This guide explains that in plain words. It is general guidance, not legal advice: take your own legal advice before you rely on it.

The four tiers

1. Prohibited practices

These are banned. They include social scoring, AI that manipulates people or exploits their vulnerabilities in harmful ways, untargeted scraping of facial images to build face recognition databases, emotion recognition in the workplace or in education (with narrow medical and safety exceptions), and biometric categorisation that infers sensitive traits such as religion or sexual orientation. Ordinary business automation is nowhere near these, but one example matters for SMEs: a tool that reads your staff's emotions from their voice or face at work is not allowed.

2. High-risk systems

The Act lists areas where AI decisions can seriously affect people's lives. The ones a small or mid-sized business is most likely to touch are:

• Employment. AI that screens or ranks job applications, places targeted job ads, decides on promotion or termination, allocates tasks based on personal behaviour, or monitors and evaluates staff.
• Access to essential services. AI that assesses the creditworthiness of individuals, prices life or health insurance for individuals, or triages emergency calls.
• Education. AI that decides admissions or grades students.
• Safety components of regulated products, such as machinery or medical devices.

There is an important exception. A system in one of these areas may not count as high-risk if it only performs a narrow procedural task, improves the result of work a person has already done, or prepares material for a human decision without replacing it, and does not profile people. Whether that exception applies is exactly the kind of question to put to a lawyer.

3. Limited risk: transparency duties

This is where most customer-facing AI sits. The core rules:

• Chatbots and voice agents must be designed so people are told they are interacting with an AI, unless that is obvious from the context.
• AI-generated content, such as synthetic audio, images or video, must be marked as such by the provider in a machine-readable way, and deepfakes must be disclosed by whoever publishes them.
• Emotion recognition or biometric categorisation, where it is allowed at all, requires telling the people exposed to it.

4. Minimal risk

Everything else. Reading invoices, forecasting demand, sorting support tickets, summarising documents, routing leads to the right salesperson: none of these carry specific obligations under the Act. GDPR still applies to any personal data they touch, and that is usually the bigger piece of work.

Where typical SME systems fall

• A customer support chatbot on your website: limited risk. Tell people it is an AI, and give them a route to a person. Our AI customer support assistants open with that disclosure by design.
• A voice agent that answers calls and books appointments: limited risk. The agent should say it is an AI at the start of the call. See our AI voice agents.
• Document processing, reporting, forecasting, lead routing: minimal risk under the Act.
• A tool that scores or filters job applicants: high-risk. Treat this as a different kind of project.
• A model that decides whether to offer a customer credit: high-risk if it assesses individuals' creditworthiness.
• A voice agent that analyses callers' emotions: be careful. Emotion recognition in the workplace is banned, and elsewhere it brings its own disclosure duties.

The timeline

The Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. As we understand the dates at the time of writing:

• 2 February 2025: the prohibitions and the AI literacy duty apply.
• 2 August 2025: obligations for providers of general-purpose AI models apply. These fall on the model makers, not on businesses that use their models through an app or API.
• 2 August 2026: the transparency duties for chatbots, voice agents and AI-generated content apply, along with most of the rest of the Act.
• Later dates for high-risk systems. The original deadlines were August 2026 and August 2027. An amending regulation adopted in 2026, known as the Digital Omnibus on AI, moved the stand-alone high-risk uses (such as hiring and credit) to 2 December 2027, and high-risk AI inside regulated products to 2 August 2028.

Dates in this area have changed once already. Check the current text on EUR-Lex or the European Commission's AI Act Service Desk before you plan around them.

Provider or deployer: which are you?

The Act gives different duties to different roles.

• Provider: whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name.
• Deployer: whoever uses an AI system in their business under their own authority.

If you buy a chatbot product off the shelf and switch it on, you are a deployer. If you commission a custom system and run it under your own name, you may count as the provider as well, even though someone else wrote the code. For a limited-risk chatbot or voice agent, that mostly means making sure the AI disclosure is built in. For a high-risk system it means a great deal more: risk management, technical documentation, logging, human oversight, a conformity assessment and registration. Agree in the contract who does what.

Deployers of high-risk systems have their own duties too: use the system as instructed, assign trained people to oversee it, keep the logs, tell staff before high-risk AI is used at work, and tell people when it is used in decisions about them.

What the Act does for small businesses

The Act includes specific measures for SMEs and start-ups:

• Priority access to AI regulatory sandboxes run by member states, where you can test a system with guidance from the regulator.
• Awareness and training activities and dedicated channels for SME questions, organised by member states.
• Conformity assessment fees reduced in proportion to company size.
• A simplified way for SMEs to provide the technical documentation for high-risk systems.
• Fines capped at the lower of the fixed amount or the turnover percentage, rather than the higher.

These help most if you are building or selling a high-risk system. For a business using a chatbot or a voice agent, the obligations are light enough that the relief matters less.

A practical checklist

1. List every AI system you use or plan to use, including AI features inside tools you already pay for.
2. Put each one in a tier. Most will be minimal. Customer-facing chat and voice will be limited risk. Flag anything that touches hiring, staff evaluation, credit or insurance.
3. Add the disclosure. Every chatbot and voice agent says it is an AI at the start, in the language the customer is using, with a route to a person.
4. Decide your role for each system: deployer, provider, or both. Write it down.
5. Train your people. A short session on what each tool does, where it goes wrong, and when to override it covers the spirit of the AI literacy duty.
6. Keep a human in the loop for anything that affects a person's job, money or access to a service, whether or not it is formally high-risk.
7. Do the GDPR work in parallel. See our guide on scoping GDPR-compliant AI automation.
8. Review the list when you add a new use, and when the rules change.

Mistakes to avoid

• Assuming the Act does not apply because you are small. The transparency duties apply to businesses of every size.
• Assuming everything with AI is high-risk. It isn't. Over-engineering a support chatbot as if it were a credit model wastes money.
• Adding HR features casually. "Let the assistant also rank the CVs" turns a minimal-risk tool into a high-risk one.
• Hiding the AI. A voice agent that pretends to be a person breaks the rule and loses customers' trust when they find out.

How we handle this

When we build for a business in the EU, we tell you on the first call which tier the system is likely to fall in, build the disclosure and the human handover into chatbots and voice agents, keep logs, and flag anything that edges towards high-risk so you can get legal advice before we build it. We don't give legal sign-off; your lawyer does. An AI strategy and readiness review is a good place to map your current and planned systems against the tiers. For how we work with European businesses more broadly, see AI automation in Europe.