If you’ve seen the headlines about the EU AI Act, you’re probably somewhere between mildly panicked and completely confused.
“Europe’s sweeping AI regulation” this. “Massive fines for non-compliance” that. If you run a 50-person company that uses ChatGPT for drafting emails and an AI tool for customer support, you might be wondering whether you need a compliance team and a lawyer on retainer.
You probably don’t. But you do need to understand what this law actually says, because some of it matters and some of it has nothing to do with you.
The one distinction that changes everything
The EU AI Act draws a line between two very different things: companies that develop AI systems and companies that deploy AI tools.
If you’re building AI models from scratch, training your own systems, or selling AI products to other businesses, you’re a developer (the Act calls you a “provider”). The rules for you are extensive.
If you’re a business that uses off-the-shelf AI tools like ChatGPT, Claude, or Copilot, you’re a deployer. The rules for you are much lighter.
Most SMBs are deployers, not providers. This is the most important thing to understand, and it’s the thing most headlines leave out.
The risk categories, without the jargon
The Act sorts AI applications into four risk buckets. Higher risk means more rules.
Unacceptable risk (banned)
AI uses the EU has decided are too dangerous to allow. Social scoring systems that rate citizens by behavior. AI that manipulates people through subliminal techniques. Real-time biometric surveillance in public spaces (with narrow law enforcement exceptions).
If you’re running a small or mid-sized business, you’re almost certainly not doing any of this. Move on.
High risk
This is where the regulation gets dense, and where it becomes relevant for some businesses. AI used in hiring, credit scoring, insurance pricing, educational assessment, and critical infrastructure falls into this category.
The practical question: is your AI making or heavily influencing decisions that significantly affect people’s lives? If the AI’s output directly determines whether someone gets a job, a loan, or insurance coverage, pay attention. If the AI drafts a first version and a human makes the actual call, your obligations are lighter.
The rules here require documented risk assessments, human oversight, transparency about how decisions get made, and data quality standards.
Limited risk
Covers AI that interacts with people directly. Chatbots, mainly. The requirement is straightforward: tell people when they’re talking to an AI. If your website has an AI chatbot, label it. If you’re generating AI content for customers, be upfront.
Most SMBs using AI for customer-facing applications land here. The burden is low. Tell people it’s AI. Don’t pretend it’s a person.
Minimal risk
Everything else. Drafting internal emails, summarizing documents, generating marketing copy, analyzing data, automating reports. This is where the vast majority of business AI use sits, and the regulatory burden is essentially zero.
The EU’s position: these uses don’t pose meaningful risks to people’s rights, so they don’t need specific rules.
What you actually need to do
If you run a business with 10 to 200 employees and use AI tools, here’s what compliance actually looks like.
First, figure out which category you’re in. Go through your AI tools and ask: does this tool make or directly influence decisions about people’s employment, credit, insurance, or legal rights? If yes, you have high-risk obligations. Customer-facing AI? Transparency obligations. Internal productivity tools? You’re mostly fine.
Hiring is the high-risk area most likely to affect SMBs. If you’re using AI to screen resumes, rank candidates, or score assessments, you need documentation of how the system works, human oversight on final decisions, and the ability to explain how the AI reached its conclusions. The good news: most AI hiring tools worth using are building compliance features into their platforms right now. Ask your vendor where they are on EU AI Act compliance.
Label your chatbots. If you have an AI chatbot or use AI to generate content customers interact with, say so. A “This conversation is powered by AI” notice is enough. Don’t overthink it.
Keep a simple record of what AI tools you use and what they do. Not a formal AI register (that’s an enterprise thing), but a spreadsheet listing your tools, what data they process, what decisions they touch. When a regulator or client asks “what AI do you use?”, you want an answer that doesn’t start with “uh.”
And talk to your AI vendors about compliance. The providers bear most of the regulatory burden. They’re required to make sure their systems meet the Act’s requirements before you ever see them. Your job is to use them responsibly and within their intended purpose.
What you can safely ignore
This is the part the headlines skip, because “most businesses don’t need to do much” doesn’t get clicks.
You don’t need to hire a compliance officer for AI. Unless AI-driven decisions are core to your business model, like if you run a hiring platform, your existing compliance processes can absorb this.
You don’t need to stop using AI tools. The Act isn’t trying to prevent businesses from adopting AI. It’s making sure AI that affects people’s rights gets used responsibly. Your team using Claude to draft proposals is not what this law is about.
The fines sound terrifying (up to 35 million euros or 7% of global revenue), but those numbers are aimed at companies deploying banned systems or willfully ignoring high-risk requirements. A small business making a good-faith effort at compliance is not going to get a nine-figure penalty.
And you don’t need to do everything now. The Act is phased in. Bans on unacceptable-risk AI took effect in February 2025. Most high-risk obligations phase in through 2026 and 2027. The regulatory guidance is still being refined. You have time.
The catch (because there’s always a catch)
The regulation applies to any company that serves EU customers, regardless of where that company is based. US company with European clients? This applies to you.
The other catch: the Act is complex, and the guidance is still evolving. We’re reading new interpretive documents from the European Commission every few months. Some boundaries between risk categories are blurry. “Human oversight” isn’t precisely defined for every scenario. This will get clearer, but right now there’s genuine ambiguity.
Our honest advice: don’t try to become an expert in the full text. Do the basics. If you discover you’re in high-risk territory, talk to a lawyer who specializes in EU tech regulation. For everyone else, this is a “stay informed and be sensible” situation, not a “restructure your business” one.
The bigger picture
I think the EU AI Act is, on balance, a reasonable piece of regulation. Not perfect. Some categories are awkward. Some timelines are aggressive. But the core idea, that AI systems making important decisions about people should be transparent, documented, and subject to human review, is hard to argue with.
If you’re already using AI responsibly (telling people when they’re interacting with AI, keeping humans in the loop for important decisions, knowing what tools you use and what data they touch), you’re most of the way to compliance already.
The businesses that should worry are the ones that were cutting corners before the regulation existed. If your AI hiring tool has been auto-rejecting candidates with zero human review and no documentation, the EU AI Act isn’t creating a new problem for you. It’s just making the old one harder to ignore.