AI Act for Small Businesses: 5 Rules That Apply to You
The EU AI Act comes into force August 2, 2026. Here are the five obligations that actually affect small businesses and creators using ChatGPT, Gemini or Claude.
👁 120 reads
The EU AI Act, regulation 2024/1689 on artificial intelligence, comes into force for most provisions on August 2, 2026, and for the first time affects ordinary businesses and creators, not just labs building models. This is not a legal commentary on 113 articles; it’s a list of five things that actually apply to small businesses, agencies, shops and content creators using ChatGPT, Gemini or Claude, in order of frequency. We describe the timeline and what has been postponed separately on the page AI Act: what applies from August 2, 2026. This is an overview, not legal advice: in specific cases, the text of the regulation and national law decides.
First: who you are under the AI Act
The regulation distinguishes between provider (who builds a system or model and brings it to market) and deployer (who uses it in their operations). A company that writes proposals in ChatGPT, runs a chatbot on its website or generates graphics is a deployer. This matters because most heavy obligations (technical documentation, conformity assessment, registration) fall on providers. You become a provider when you sell your own AI system under your brand or substantially modify someone else’s, for example by fine-tuning a model and offering it to clients.
1. Labeling AI content (art. 50): applies to every creator
From August 2, 2026, three transparency obligations apply. A chatbot on your site must make it clear that a machine is talking, unless it’s obvious. Deepfakes, meaning generated or manipulated images, audio or video showing real people, places or events as genuine, must be labeled as artificially generated, except for obvious satire and artistic work, where labeling that doesn’t disrupt reception is sufficient. Text generated by AI and published to inform the public about matters of public interest must be labeled, unless it has been edited by a human who takes responsibility for it. In practice for blogs and social media: label AI illustrations, mark video with synthetic voice, and don’t publish chat texts without your own editing. How watermarks work and how to recognize AI content is described in our texts on deepfakes and on SynthID and C2PA.
2. AI literacy (art. 4): from February 2025
Every company using AI systems must ensure its employees have a “sufficient level of AI literacy” appropriate to their role. The provision applies from February 2, 2025 and has no separate penalty, but supervisory authorities take it into account when assessing other violations. Documented training is sufficient: what the model can do, where it hallucinates, what data must not be pasted. Material for such training is in our texts on hallucinations and on what ChatGPT sees.
3. Prohibited practices (art. 5): from February 2025, highest penalties
Absolutely prohibited are subliminal manipulation causing harm, exploiting vulnerabilities of groups (age, disability, economic situation), social scoring, emotion recognition at work and school (except medicine and security), and mass scraping of faces from the internet for biometric databases. For small businesses, one thing has practical significance: no “candidate emotion analysis” tools in recruitment and no scraping photos of people for your own models. Penalties: up to 35 million euros or 7% of global turnover.
4. High-risk systems (Annex III): recruitment, credit, education
If AI at your company decides or significantly influences decisions about employment, promotion, dismissal, creditworthiness assessment, access to education or public services, it’s a high-risk system. As a deployer you must use it according to the provider’s instructions, ensure human oversight, maintain logs and inform employees. After Digital Omnibus, obligations for high-risk systems from Annex III (recruitment, credit, education, biometrics) apply from December 2, 2027, and for AI built into regulated products from Annex I (machinery, medical devices) from August 2, 2028. Details in the text AI Act: deadlines after Omnibus. An AI-based CV filter is the most common case in businesses that owners don’t know is subject to these provisions.
5. Who enforces in the EU and what penalties
EU member states are establishing national market surveillance authorities; we wrote about the first penalties and guidelines in the text AI Act: first fines. Penalty ranges from the regulation: up to 35 million euros or 7% of turnover for prohibited practices, up to 15 million or 3% for most other violations, up to 7.5 million or 1% for providing false information to authorities; for small and medium enterprises the lower of the two amounts applies. For comparison, GDPR penalties are up to 20 million euros or 4%.
One-page checklist
List what AI tools the company uses and for what. Label AI content published under your brand (images, video, voice, unedited texts). Add information about AI to the chatbot on your site. Train your team and keep confirmation. Check whether any tool influences decisions about people (recruitment, credit, grades); if so, ask the provider for compliance documentation. Don’t paste customer personal data into chats without a data processing agreement. This is my list from practice, not an official template; the full text of the regulation is in EUR-Lex under number 2024/1689.
Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →Frequently asked questions
Does the AI Act apply to a sole proprietor using ChatGPT?
Yes, in terms of transparency (labeling content, chatbot) and literacy. It doesn’t impose registration or documentation obligations if you’re not building your own system or using AI for decisions about people.
Do I have to label every text written with AI help?
No. The obligation applies to texts published to inform about matters of public interest, and disappears when the text has been edited by a human responsible for publication. You always label images and video realistically showing people and events.
When do penalties start?
For prohibited practices from August 2, 2025, for other violations from August 2, 2026, though national authorities are still developing enforcement practices. Timeline details on the page AI Act: what applies from August 2, 2026.
Sources checked September 18, 2026: regulation (EU) 2024/1689 (EUR-Lex), art. 4, 5, 50, 99 and Annex III; European Commission communications on AI Act application from August 2; our earlier texts on national implementation and first penalties.
More on this from QUANTSLANT
magazine·Andrej Karpathy: OpenAI Co-Founder & Vibe Coding CreatorThe AI researcher who coined 'vibe coding', led Tesla's Autopilot Vision, co-founded OpenAI, and now works at Anthropic on model pretraining.