Does the EU AI Act Apply to Small Businesses?

The Act uses a risk-based approach. Minimal-risk systems have few specific duties. Systems that interact with people may have transparency duties. High-risk systems used in areas such as employment, education, credit, or essential services have extensive controls. The same framework can apply to an SME and a large company, although penalties and enforcement must take proportionality into account.

• Record the AI tools used by staff and what each tool does.
• Give staff appropriate AI-literacy guidance under Article 4.
• For direct AI interaction, verify that the provider's Article 50 notice is implemented clearly in your customer journey.
• Keep a human involved where AI output affects an important decision.
• Check contracts and instructions supplied by each AI provider.

A small business can still deploy a high-risk AI system. An automated CV-screening tool, credit decision system, or certain healthcare tools require closer assessment regardless of the organisation's headcount.

Start with a risk classification. Do not assume a familiar product is low risk: classification depends mainly on its purpose and context.

Build a simple AI System Register, identify customer-facing uses, and document staff training. Escalate only the systems that affect important decisions or create uncertainty.