Compliance
AI compliance without a compliance department
Search “AI compliance” and you will find governance platforms, control frameworks, audit-readiness dashboards, and a lot of guidance written by large companies for other large companies. All of it assumes something you probably do not have: somebody whose job this is.
This is the version for a firm of five. Or eleven. Or one.
This article is general information, not legal advice. We make small AI tools; we are not a law firm, and we cannot tell you what your obligations are. For your specific situation, take advice from a qualified advisor.
Official sources are linked at the end.
What “AI compliance” actually means when you are small
For most small businesses using AI for everyday work, this is not a certification exercise and there is nothing to buy. It comes down to four plain questions:
- Do the people using AI here understand what it is and is not good at?
- Do the people on the other end know when they are dealing with AI?
- Are we doing anything the law flatly prohibits?
- Are we using AI to make decisions about people?
Question four is the one that changes everything, and we will come back to it. The first three are cheap to get right.
The AI literacy duty is the one nobody knows about
Since 2 February 2025, the EU AI Act has carried an AI literacy duty (Article 4). If your business uses AI, you are expected to make sure the people operating it have a working understanding of what it does and where it fails.
There is no certificate involved and no course you have to buy. What it looks like in a small firm is a page, genuinely, one page, that says:
- which AI tools the business uses, and for what;
- what staff must never rely on them for without checking;
- who to ask when something looks wrong;
- that AI output gets reviewed before it goes to a client.
Write it once. Revisit it when your tools change. That is most of the duty discharged, and it doubles as an induction note for the next person you hire.
Tell people when they are talking to AI
Since 2 August 2026, the Act’s transparency obligations (Article 50) have applied to AI systems in use, and national authorities hold penalty powers. The duty binds systems intended to interact directly with people, and does not bite where it is already obvious to a reasonable person that they are dealing with AI.
If you run a support chatbot, deploy a voice assistant, or publish AI-generated content, this is live now and it applies to you as the deployer, not just to whoever built the tool. In practice it means saying so: a line on the chat widget, a note where AI drafts customer replies, appropriate marking on AI-generated content you publish.
This is not an onerous obligation. It is mostly a copywriting task, and doing it well reads as confidence rather than as a disclaimer.
The prohibited list is short, and mostly not about you
Some practices were banned outright from February 2025, social scoring, manipulative techniques that exploit vulnerability, untargeted scraping of facial images, and inferring emotions in the workplace or in education.
Most of these are far from ordinary SME work. The one worth a second look is emotion inference in a workplace context, which sits closer to the mainstream than people expect. Some sales-coaching and call-analysis tools have drifted into it.
The question that changes the answer
Does the AI influence decisions about people?
Hiring, credit, insurance, access to essential services, education. Annex III of the Act lists these as high-risk, and the regime is a different order of magnitude: conformity assessment, technical documentation, registration, ongoing monitoring.
The reason this catches small firms out is that the tools look completely ordinary. “Score these CVs against the role spec and give me a shortlist” is a sentence anyone might say to a recruiter, and it describes a high-risk system.
If this is you, stop and take proper advice before building or buying anything. This is the one area where getting it wrong is expensive, and where a supplier who tells you it will be fine is a supplier to be suspicious of.
What you can probably leave alone for now
If you are a deployer, meaning you use AI tools rather than putting AI systems on the market, then the heavyweight provider obligations, the general-purpose model duties, and the conformity assessment machinery are aimed at somebody else. They land on OpenAI, Anthropic, Google and the firms building systems for market, not on the accountancy practice using a drafting assistant.
One exception, and it is a real one: if a tool goes to market under your own name or brand, the Act generally treats you as its provider, even if somebody else built it. That is the white-label trap, and it should be settled in the contract before anyone writes code.
Transparency notices, human review points and documentation belong in the work rather than bolted on afterwards. What we cannot do is tell you what your obligations are, or certify anyone as compliant. Nobody selling you AI should be claiming otherwise.
The honest summary
For most small businesses, AI compliance in 2026 is: write the one-page policy, say clearly when customers are talking to AI, stay well away from the prohibited list, and think hard before letting AI shape decisions about people. That is a morning’s work, not a project.
Official sources
- EU AI Act Service Desk: the European Commission’s own help desk and compliance checker.
- artificialintelligenceact.eu: the full text, article by article.
- Department of Enterprise, Tourism and Employment: Ireland’s national implementation and guidance.
Read next: The EU AI Act, for people who run small businesses, our full guide, including a five-question check on whether it applies to you.