Hardly any software offering today gets by without the two letters: AI. A chatbot on the website, an assistant for product descriptions, an image generator for the next social media post. With the EU’s AI regulation – known internationally as the EU AI Act – there are now clear rules for the first time. Many owners ask themselves: does this apply to me too, even though I only use AI and don’t build it myself?
The short answer: for most small businesses the effort is manageable. There are a few points you should know, though.
As of October 2026. This article is guidance only and not legal advice. The rules around AI keep changing – for any specific plans, check the current position.
What is the EU AI Act?
The EU AI Act is the first comprehensive set of rules for artificial intelligence. It applies directly in every EU country. The basic idea is simple: the higher the risk an AI application poses to people and their rights, the stricter the rules. Harmless applications stay free, dangerous ones are banned. Large, general-purpose models – such as the language models behind many chat assistants – get their own requirements, but these mainly concern the providers of those models.
Important for you: the regulation distinguishes between “providers” (those who develop an AI or offer it under their own name) and “deployers” (those who use an AI in a business context). As a business using a ready-made AI tool, you are usually a deployer – with far fewer obligations than the provider.
When does what apply?
The AI Act came into force on 1 August 2024, but its obligations take effect in stages. The key dates:
- 2 February 2025: The banned AI practices apply. Businesses are also expected to ensure their staff have sufficient “AI literacy”.
- 2 August 2025: Rules for large, general-purpose AI models, along with the supervision and penalty provisions.
- 2 August 2026: The transparency duties take effect – the decisive point for most businesses.
- End of 2027: The obligations for high-risk AI. This date was recently pushed back politically.
Because the timetable was adjusted recently, for any specific plans it’s worth checking the European Commission’s current position.
The four risk classes
The AI Act sorts AI into four levels.
Banned (unacceptable risk). Some applications are not permitted – for example scoring people by their social behaviour (“social scoring”) or detecting emotions in the workplace. This level barely matters for ordinary businesses.
High-risk. AI in sensitive areas: medical technology, critical infrastructure, staffing decisions. If you use AI to pre-sort job applications automatically, you may fall into this category. Such systems need documentation and checks.
Limited risk: transparency. The level that concerns almost every website operator. If you use AI that talks to people or creates content, you have to disclose it.
Minimal risk. Everything else – spam filters, product recommendations, many everyday tools. Here the AI Act sets no special requirements.
Does this affect me if I use AI on my website?
For the vast majority of businesses the answer is: you land in the “limited risk” level and mainly have transparency duties.
Chatbots must identify themselves. If you have an AI chatbot on your website, visitors must be able to tell that they are writing to an AI and not to a person. In practice a clear note on the chat window is often enough.
AI images, videos and text. The duty to mark AI content in a machine-readable way falls mainly on the providers of the AI tools, not on the small business that uses them. An additional disclosure duty applies to “deepfakes” – convincingly real images, audio or video of real people or events. An obviously illustrative AI graphic on your homepage is usually not a deepfake. When in doubt: better to label it.
AI literacy in the team. Businesses are expected to make sure the people using AI understand what they are doing – in proportion to how it is used. For a small team a short briefing and clear agreements about who does what with which tool are often enough.
What happens if you breach the rules
The fines are tiered: up to €35 million or 7% of worldwide annual turnover for banned practices, up to €15 million or 3% for breaches of most other obligations (these include the transparency rules). Small and medium-sized enterprises get a concession: the lower of the two amounts applies in each case. The figures mainly show the direction of travel – for a small business that uses AI cleanly and transparently, the risk is low.
What you can do now
A calm three-step approach is enough to start with:
- List everywhere AI is in use – chatbot, booking assistant, text, images.
- Check whether visitors can tell when they are talking to an AI.
- Decide for which automatically generated content a note makes sense.
Much of this can simply be handled during your next website update.
Transparency is a trust signal
A chatbot that honestly says it is an AI comes across as more trustworthy than one that pretends otherwise. We build websites that account for such notices from the start – unobtrusive in the design, clear for visitors. If you are thinking about using AI on your website, or you are unsure whether your current site fits, we will look at it together. A glance at our packages shows what is included.
Sounds good? Then let’s talk – in a free initial consultation.