If you run a business in the EU and your team uses ChatGPT, Claude or Gemini for work, the EU AI Act already applies to you. That sounds heavier than it is. For most small businesses the part that applies is small, and you can work out exactly which part in about ten minutes.
This is that ten-minute check: four questions in plain English, and what each answer means for you. Outside the EU? Keep reading, because it can still reach you.
The short version
- The AI Act cares about what you do with AI, not how big you are. Using ChatGPT at work brings you in. Building or commissioning an AI tool brings you in further.
- Almost every business using AI already has one duty: help the people who use it understand it.
- Labelling duties only apply if you publish certain kinds of AI-made content.
- The heavy "high-risk" rules don't start until December 2027, and only for specific uses like hiring.
- Being outside the EU doesn't take you out of it if what your AI produces is used in the EU.
Are you using AI, or putting it out there?
The AI Act sorts everyone into roles, and your role decides your duties. Two matter for small businesses.
A deployer is anyone using an AI system "under its authority". If your team writes emails in ChatGPT, drafts proposals in Claude or researches in Gemini, your business is a deployer. Using AI in your personal, non-work life doesn't count.
A provider develops an AI system, or has one developed and puts it into service "under its own name or trademark". That's OpenAI, Anthropic and Google for their own tools. It can also be you. If you paid a developer to build a chatbot for your website and it runs under your brand, you may be the provider, with the provider's duties.
Most small businesses are deployers. Some are both without realising it.
The four-question check
1. Does anyone in your business use AI for work?
If yes, you have a duty under Article 4: take measures to support the AI literacy of the people using it, matched to what they already know and what they use it for. It has applied since 2 February 2025, and it was rewritten in July to ask less. There's no set level anyone has to reach, and the European Commission's own Q&A says "There is no need for a certificate."
In practice, that's three things: know who uses which tool and for what, tell them where it goes wrong (like AI making things up and sounding sure of itself), and keep a note that you did it.
2. Do you publish AI-made images, video or audio that look real?
The Act calls realistic AI-made or AI-altered content a deep fake. If you publish one, you must disclose that it's been artificially generated or manipulated. That has applied since 2 August 2026. For clearly artistic, satirical or fictional work the duty is lighter: you only have to disclose that the AI content is there, in a way that doesn't spoil the work.
A cartoon robot on your Instagram isn't pretending to be real. A realistic photo of your shop full of customers who never existed is a different matter.
The same part of the Act covers text. AI-written text published to inform the public on matters of public interest has to be disclosed too, unless a person has reviewed or edited it and someone holds editorial responsibility for publishing it. I walked through who has to label what, and who doesn't, in Who Has to Label AI-Generated Content Under the EU AI Act?
3. Did you build, or pay someone to build, an AI tool people talk to under your name?
Think of a website chatbot, a booking assistant, or an AI that answers customer emails under your brand. The provider of a system that talks directly to people has to design it so they're told they're dealing with an AI, unless that's obvious to a reasonably well-informed person.
The question to settle is whether that provider is you or your developer. Don't assume it's "whoever built it". The test turns on who had it developed and puts it into service under their own name. Settle it with your developer in writing, before launch rather than after.
4. Do you use AI to make decisions about people in hiring, credit or education?
These are among the areas the Act lists as high-risk, including AI used "for the recruitment or selection of natural persons", to "evaluate the creditworthiness of natural persons", or to "evaluate learning outcomes". High-risk systems carry the heaviest duties in the whole Act.
After this summer's changes, those rules apply from 2 December 2027, and from 2 August 2028 for AI built into products that already have EU safety rules. If you're using AI to screen CVs or score customers, that's your runway, not a reason to ignore it.
If question 1 was your only yes, the Act asks one thing of you today, and you've just read it.
What if my business isn't in the EU?
The Act can still reach you. It covers providers and deployers based outside the EU "where the output produced by the AI system is used in the Union", and providers putting AI systems on the EU market wherever they're based.
The same logic works the other way round. Your AI supplier being American doesn't take your business out of the Act. If you're in the EU and using the tool for work, the deployer duties are yours wherever the tool comes from.
If you're thinking about where your AI tools keep what they learn about you, that's a separate question, and I covered it in Everyone's Getting an AI Agent. Who Owns What It Learns?
What did the "delay" change?
You probably saw headlines this year saying the AI Act had been delayed. Half of that was true.
The changes came in Regulation (EU) 2026/1744, in force since 27 July 2026. It pushed the high-risk rules back to 2027 and 2028, and it rewrote the AI literacy duty. It didn't move the transparency rules in question 2, which have applied since 2 August 2026.
One date to know: providers of AI tools that generate images, audio, video or text and were already on the market before August have until 2 December 2026 to mark that content in a machine-readable way. That's a provider deadline, so it sits with the companies behind tools like ChatGPT and Gemini, not with you, unless you're a provider yourself.
Common questions
Does the EU AI Act apply if I only use ChatGPT?
Yes, in a small way. Using ChatGPT, Claude or Gemini for work makes your business a deployer, which brings the AI literacy duty. The labelling duties only come in if you publish deep fakes, or AI-written public-interest text that nobody reviewed.
Do I need to tell customers I used AI to write an email?
Not under the AI Act. Its labelling duty for text covers material published to inform the public on matters of public interest, not everyday business emails. Your own standards may go further than the law, and that's your call.
When do the high-risk rules start?
2 December 2027 for the areas listed in the Act's Annex III, such as hiring and credit scoring. 2 August 2028 for AI built into products already covered by EU safety rules.
Where this leaves you
Go through the four questions with your team this week and write the answers down. It takes ten minutes, and that note is the start of the record the Commission suggests you keep.
