The EU AI Act for Small Businesses: What Actually Applies in 2026

Quick answer: Yes — the EU AI Act applies to small businesses, but its heaviest machinery does not target you. Since 2 February 2025 you must not use banned AI practices and must take measures that support your team's AI literacy. Since 2 August 2026 you must tell customers when they are dealing with a chatbot or voice agent, and label realistic AI-generated content such as deepfakes. The strict high-risk obligations — including AI used in hiring and credit scoring — were postponed to 2 December 2027 (2 August 2028 for AI embedded in regulated products) by the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026. Fines for banned practices run up to €35 million or 7% of global turnover, with lower caps for SMEs and start-ups under Article 99(6). Whether the Act covers you depends on your role and where your AI is used — see Article 2 below; serving EU customers alone is not the test.

---

What is the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI law; the European Commission keeps a plain-language overview of the framework. It entered into force on 1 August 2024 and sorts AI systems into four risk tiers, each with different obligations:

Most of what a small business does with AI falls into the transparency and minimal-risk tiers, so the Act is more manageable than the headlines suggest — but manageable is not ignorable. This article is general information, not legal advice.

What does the Act require from a small business right now?

Four buckets matter, and their timing differs:

The AI literacy duty was softened by the Digital Omnibus: employers now take measures that support literacy, without guaranteeing any particular level of staff knowledge. A short training programme and a written AI usage policy are a common starting point — whether that is enough depends on your organisation and the AI you use. Our Prompt Engineering for Teams workshop covers the practical side.

What changed on 2 August 2026?

Two things changed on and around that date:

1. Article 50 transparency obligations. The duties differ by role. Providers of AI systems that interact directly with people — chatbots, voice assistants, AI agents — must design them so that users are told they are dealing with AI, unless it is already obvious from the circumstances. Providers of generative systems must mark synthetic audio, image, video and text in a machine-readable way. Deployers who publish deepfakes — realistic synthetic content — must disclose that it is artificially generated; what adequate disclosure looks like depends on the format and context, not one identical treatment for every image. Content published before 2 August 2026 needs no retroactive labels, and generative systems already on the market have until 2 December 2026 for machine-readable marking. The Commission's Article 50 guidance explains the details.
2. Enforcement and penalties. Application is phased under Article 113: obligations switch on progressively between February 2025 and 2028, and which authority enforces what depends on the tier — national market-surveillance authorities handle most systems placed on their market, while the Commission's enforcement role centres on general-purpose AI models. The Commission's transparency guidelines followed on 20 July 2026, so official guidance now exists on what compliance looks like.

The practical reading is short: your chatbot should say it is a bot, realistic AI-generated images should be identifiable as AI, and any AI voice agent should introduce itself honestly.

Were the high-risk rules delayed? The Digital Omnibus explained

Yes — and this is the part many business owners missed. The Commission's Digital Omnibus package eased several AI Act timelines. The resulting regulation (Regulation (EU) 2026/1744, in force since 27 July 2026) moved the deadlines:

• Annex III high-risk systems — AI used in recruitment, credit scoring, education and exams, biometrics — must comply by 2 December 2027, not August 2026.
• Annex I systems — AI embedded in regulated products such as machinery and medical devices — move to 2 August 2028.
• A new prohibition on AI systems that generate non-consensual intimate images applies from 2 December 2026.

If you use an AI CV-screening tool, its obligations — and yours as its deployer — arrive in December 2027. Use the headroom to document how humans stay in the loop in hiring decisions.

Does the EU AI Act apply to UK businesses?

It depends on your role and where your AI is used, not simply on where your customers sit. Under Article 2, the Act covers providers that place AI systems on the EU market or put them into service in the EU — wherever the provider is established — and deployers that have their place of business or are located in the EU. It also reaches providers and deployers in third countries where the output of their system is used in the Union. So a UK agency whose AI-generated deliverables are used by EU clients, or a UK shop running a chatbot whose output is used in the EU, can be in scope; a UK business with no EU footprint in those terms generally is not. If you are unsure, work through the Article 2 criteria or take legal advice.

The UK itself has no standalone AI Act; it relies on regulators and ICO guidance instead.

The data-protection side of the 2026 rule changes — the UK Data (Use and Access) Act 2025 and GDPR duties around AI tools — is covered in our AI data security guide; the AI Act is a separate law with separate duties.

Which banned AI practices should small businesses know about?

Since 2 February 2025, these uses are prohibited outright across the EU:

• Social scoring: rating people's trustworthiness based on social behaviour.
• Emotion recognition in the workplace and education institutions — with narrow medical or safety exceptions. An AI tool that reads employees' or students' emotions is off-limits.
• Exploiting vulnerabilities: AI that manipulates people through age, disability or economic situation to cause harm.
• Subliminal manipulation: techniques that distort behaviour in ways that cause significant harm.
• Biometric categorisation inferring sensitive attributes such as race, religion or sexual orientation.
• Untargeted scraping of facial images for recognition databases.

Most small businesses will never come close to these. The two worth a second look are emotion recognition — some "productivity monitoring" and video-interview tools flirt with it — and manipulation-adjacent marketing automation. If a feature sounds like it reads moods or pressures behaviour, ask questions before buying.

How should a small business prepare? A 12-month checklist

Work through these in order; each takes a few hours except the last, which is a habit:

1. Inventory where AI touches your operations. Website chatbot? Voice agent? CV screening? Content drafting? You cannot manage duties you have not mapped. Our Business Process & AI Diagnostic reviews up to three agreed processes in your operations and returns written findings with a prioritised list of improvements.
2. Check your chatbot and voice agent disclose they are AI. Article 50 has applied since August 2026, and the fix is usually a one-line change. Building a new assistant? The Workflow Automation Pilot builds AI disclosure in from the design stage.
3. Label realistic synthetic content. AI-generated images or video that look real should be marked as AI-generated; text drafts polished by AI generally do not need a label.
4. Train the team. The Article 4 duty is effort-based, and trained staff are the cheapest quality control you will ever buy. The AI Kickstart workshop is a 90-minute group session that gets a team started with practical AI — it is currently being prepared. Prompt Engineering for Teams helps keep AI output on-brand and reviewed.
5. Note December 2027 if you use AI in hiring. Document the human oversight around any CV-screening tool now, and check your vendor's roadmap for the new deadline.
6. Write a one-page AI usage policy. Which tools are approved, which data may never be pasted into them, who to ask. It is a practical step for the literacy duty and for good data hygiene.

How CortexLeap helps: we turn where AI touches your operations into a plain-language picture. The Business Process & AI Diagnostic reviews up to three agreed processes and returns written findings and a prioritised list of improvements — an operational starting point, not a legal compliance assessment.

Frequently asked questions

Does the EU AI Act apply to small businesses?

Yes. The Act is risk-based, not size-based. Most small businesses face only the transparency duties (disclose chatbots, label realistic synthetic content), the AI literacy duty and the banned-practices list. The strict high-risk regime applies only to uses such as hiring and credit scoring — now from December 2027.

What happened on 2 August 2026?

Article 50 transparency obligations became applicable, with Commission guidance adopted on 20 July 2026. Chatbots must now identify themselves and realistic AI-generated content must be handled under the transparency rules. Enforcement and the rest of the penalty regime follow the phased application schedule in Article 113.

Were the AI Act's high-risk rules delayed?

Yes. Regulation (EU) 2026/1744, in force since 27 July 2026, moved high-risk obligations to 2 December 2027 (stand-alone systems such as recruitment and credit-scoring tools) and 2 August 2028 (AI in regulated products). Transparency, literacy and prohibition rules were not delayed.

Does the EU AI Act apply to UK businesses?

It depends on your role and where your AI is used. Under Article 2, providers placing systems on the EU market and deployers established or located in the EU are covered — and so are providers and deployers outside the EU where the output of the system is used in the Union. The UK has no equivalent standalone AI law; it relies on regulators and ICO guidance.

What are the fines under the EU AI Act?

Up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% for most other violations, including transparency breaches. Article 99(6) sets lower caps for SMEs and start-ups; which authority can impose which fine, and for what, follows the phased application of the Act (Article 99, Article 113).

What is the AI literacy obligation?

Article 4, applicable since 2 February 2025: providers and deployers must take measures to support staff AI literacy — softened by the Digital Omnibus to an effort-based duty. A short workshop plus a written usage policy is a proportionate response for many small organisations; what is enough depends on your context and the AI you use.

Map your AI Act to-do list

August 2026 was a checkpoint, not a cliff edge — and December 2027 is already visible on the road. The businesses that map their AI touchpoints now will treat the transparency duties as a checklist; the ones that wait will scramble.

Start with the Business Process & AI Diagnostic — up to three agreed processes reviewed, written findings, and a prioritised list of improvements.

Train your team with AI Kickstart — a 90-minute group session, currently being prepared.

Prefer to talk it through first? Book a free 30-minute call and we will point you in the right direction.

Last updated: 19 October 2026