EU AI Act for small businesses: rules and dates in 2026

What does the EU AI Act mean for small businesses?

Small businesses should assess their AI role and intended use rather than assume a size-based exemption. Certain transparency obligations apply from 2 August 2026 [2]. Start with the systems your team develops, sells or uses, and distinguish the legal assessment from survey evidence about adoption, borrowing costs or business enthusiasm.

In my published work, I describe AI-assisted content workflows with compliance requirements and human QA [8]. That supports a practical starting point: record what the tool does and who reviews its output.

Which EU AI Act dates should your business track?

The EU AI Act has a phased timeline, so there is no single deadline for every small business or system. The Commission’s current overview lists 2 December 2027 for Annex III high-risk use cases [1]. Track each date against your role and application, and recheck the official timeline when your intended use changes.

Why does the AI use case matter more than the tool label?

The Commission describes four broad risk levels in its AI Act overview checked in 2026 [1]. A product marketed as a general assistant can still support a sensitive business process, so assess the intended use and your role. Check recruitment, worker management and other potentially high-risk decisions before treating a familiar tool as low risk.

Distinguish drafting an internal document from using a system to assess people. The official Service Desk provides a role-and-scope checker [5]; a vendor’s general marketing description cannot replace your application assessment.

How should you organise your small-business AI action plan?

Make the action plan specific to the tools, users and people affected. AI literacy duties began applying on 2 February 2025, and the Commission’s guidance checked in 2026 explains the amended requirement [3]. Support staff literacy in context, document the measures you take and keep oversight responsibilities clear as your workflows change.

List uses and owners

Record purpose, supplier, data and reviewer.

Assess roles and risks

Use the official checker [5]; escalate uncertain cases.

Review output and data

My published framework includes human QA [8]. Apply that discipline before using outputs or personal data [6].

Track readiness

• List tools.
• Assign owners.
• Check roles.
• Assess risks.
• Review disclosures.
• Record literacy measures.

Which AI Act risks need a separate legal check?

Check prohibited practices, high-risk classification and transparency requirements separately. The Commission’s transparency guidance identifies 2 August 2026 as the application date for the relevant duties [2]. A chatbot disclosure, a provider’s machine-readable marking duty and a deployer’s content-labelling duty address different situations, so assign the rule to the correct actor and activity.

Avoid: treating “small business” or “human review” as a blanket legal exemption.

What should your AI Act self-check include?

Match each system to an accountable owner, intended use and scope decision. The Commission’s 2026 overview uses four broad risk levels [1], but the detailed legal assessment depends on your circumstances. Use this self-check to identify gaps and evidence, then take unresolved classification or duty questions to an appropriate specialist.

• List AI systems.
• Record intended uses.
• Identify your role.
• Check prohibited practices.
• Assess high-risk scope.
• Review transparency duties.
• Document literacy measures.
• Assign review ownership.

Check personal-data workflows with our GDPR checklist.

Where can you check which AI Act obligations apply?

Use the European Commission’s Service Desk checker as a starting point for your role and scope assessment. The platform describes the Act’s entry into force on 1 August 2024 [5], and offers tools for exploring its requirements. Keep the answers and supporting evidence, then review them when the system, supplier or intended use changes.

Open the official AI Act self-check

Which EU AI Act questions do small businesses ask?

Small businesses need to distinguish current duties from the later high-risk phases. The Commission’s guidance checked in 2026 identifies 2 August 2026 for certain transparency duties [2], while other requirements follow separate timelines. These answers explain the starting points; they do not replace a system-specific assessment or the current official guidance.

Are small businesses exempt from the EU AI Act?

Do not assume a blanket exemption based on business size. The Commission’s overview checked in 2026 identifies four broad risk levels and different duties by actor and use [1]. Assess the system, intended use and your role, then check which small-business support or simplifications apply to that situation.

When do AI transparency requirements apply?

The relevant transparency obligations apply from 2 August 2026, according to the Commission’s guidelines [2]. Duties differ for providers and deployers, including specified interactions and types of generated content. Review the particular activity and the stated exceptions rather than assuming every AI-assisted document needs the same label.

What is the current high-risk AI Act timeline?

The Commission’s overview checked in 2026 lists 2 December 2027 for Annex III high-risk use cases [1]. It separately identifies a later product-embedded phase, so confirm which category your application falls into. Keep the current official timeline alongside your system assessment and review it when the use changes.

Does using AI remove GDPR obligations?

No: the AI Act assessment and personal-data assessment address different requirements. The EDPB’s guidance checked in 2026 describes six core data-protection principles alongside accountability [6]. Map personal data, purpose and access for the workflow, and investigate security, supplier and transfer obligations rather than relying on the AI tool’s label.

Which sources support this EU AI Act explainer?

The legal overview relies on official European Commission guidance, including the 2 August 2026 transparency application date [2]. OECD and ECB research provide business context, rather than legal exemptions or compliance findings. The references were checked in 2026, and the author disclosure supports the published workflow experience described in the action plan.

1. European Commission: AI Act — Current risk framework and application timeline. Tier 1.
2. Commission: AI transparency guidelines — Specified provider and deployer duties. Tier 1.
3. Commission: AI literacy — Current literacy requirement and support. Tier 1.
4. OECD: Empowering SMEs in the age of AI — Non-representative 2026 survey context. Tier 1.
5. Commission: AI Act Service Desk — Official role and scope tools. Tier 1.
6. EDPB: Data protection basics — Separate personal-data obligations. Tier 1.
7. ECB: SAFE Q2 2026 — Euro-area financing context; not AI legislation. Tier 1.
8. Satya Prakash Rai: Professional profile — Self-reported AI workflow experience. Author disclosure.

Source values were checked on 12 October 2026. Confirm your specific role, application and national requirements before making compliance decisions. Explore related European market research.