Small software and AI automation. Built in Dublin.

Menu

EU AI Act

The EU AI Act, for people who run small businesses

The EU AI Act applies to businesses that use AI, not only to those that build it. For most small firms the obligations are narrow and manageable, but "most" is not "all", and the exceptions do not look like exceptions. This page is the practical version: what already applies, what you actually have to do, and where the traps are.

This is general information, not legal advice. We are an Irish company that makes small AI tools, not a law firm. We cannot tell you what your obligations are, and we do not certify anyone as compliant. For your specific situation, take advice from a qualified advisor.

Researched and drafted with AI assistance, and published under Tarnua’s editorial responsibility. The official sources are linked at the bottom: check them before relying on anything here.

Start here

Does it apply to you?

Five questions. If you answer yes to the first one, some part of the Act already applies to you.

  1. Do you use AI anywhere in the business, including a general assistant for drafting?

    Then you are almost certainly a deployer, and the Article 4 AI literacy duty already applies. This is the obligation most small firms do not know they have. It is also the cheapest to meet: write down which tools you use, what they are used for, and what staff should never rely on them for.

  2. Do customers or the public interact with an AI system you have deployed?

    A support chatbot, a voice assistant, an AI that drafts replies sent under your name. Then Article 50 transparency applies, and has since 2 August 2026. In practice: tell people they are dealing with AI rather than a person, and mark AI-generated content appropriately when you publish it.

  3. Does AI influence decisions about people?

    Recruitment and worker management, creditworthiness assessment, risk assessment and pricing in life and health insurance, access to essential public services, and evaluating learning outcomes. This is the one that catches people out. Annex III of the Act lists these as high-risk, and the regime is far heavier: conformity assessment, documentation, registration. Note the definitions are narrower than the everyday words: general insurance pricing is not the same as life and health insurance, and fraud detection is treated differently from credit scoring. Some of these tools look completely ordinary. If this is you, take proper advice before building anything. We cannot classify your system for you.

  4. Will an AI system go to market under your own name or brand?

    Then you are likely the provider rather than just the deployer, and provider obligations are substantially heavier. This matters enormously for white-label work: if a supplier builds a tool that you sell under your brand, the Act generally treats you as the provider. Settle who carries what in writing before the build, not after.

  5. Could anything you do fall under the prohibited practices?

    Social scoring, manipulative techniques that exploit vulnerability, untargeted scraping of facial images, and emotion inference in the workplace or in education are among the practices banned outright since February 2025. These are unusual in ordinary SME work, but emotion inference in a workplace context is closer to the mainstream than people expect.

Timeline

What is already in force

The Act phases in. Everything below has already happened: there is no waiting period left for the duties that affect most SMEs.

  1. 2 February 2025

    In force

    Prohibited practices and the AI literacy duty

    The ban on prohibited AI practices applies, and so does the Article 4 AI literacy duty: if your business uses AI, the people operating it are expected to understand what it can and cannot do. A short written policy and a training note go a long way.

  2. 2 August 2025

    In force

    General-purpose AI model obligations

    Obligations attach to providers of general-purpose AI models, along with the governance and enforcement structures. These land on model providers such as OpenAI, Anthropic and Google, rather than on the SME using their tools.

  3. 2 August 2026

    In force: this is the one for most SMEs

    Article 50 transparency, and penalty powers

    The transparency obligations apply to AI systems in use, and national authorities hold penalty powers. Article 50 binds systems intended to interact directly with people, and does not bite where it is already obvious to a reasonable person that they are dealing with AI. If you run a chatbot, a voice assistant, or publish AI-generated content, assume it applies to you as the deployer.

Obligations for high-risk systems phase in later, and that timetable has been subject to change at EU level. We deliberately do not quote a date for it here. Check the official sources below if high-risk applies to you.

The part people miss

Ordinary-looking tools that are not ordinary

The Act sorts systems by risk, and most everyday SME uses, such as a support chatbot, a document drafter or an internal knowledge assistant, sit in the limited-risk band where the headline duty is transparency.

The trap is that some high-risk uses look exactly like normal business software. The clearest one for SMEs is recruitment: AI that screens, scores or ranks job candidates is high-risk under Annex III. So is AI used to assess creditworthiness, to price life and health insurance risk, to decide access to essential public services, or to evaluate learning outcomes. The definitions are narrower than the everyday words: general insurance pricing is not life and health, and fraud detection is treated differently from credit scoring. So if a tool shapes decisions about people's access to work or services, get it classified properly rather than guessing.

There is a second trap in white-label work. If a system goes to market under your name, the Act generally treats you as its provider, and provider duties are much heavier than deployer duties. That allocation should be settled in the contract before anyone writes code.

Where we draw our own line

This is not hypothetical for us. On an industrial site we work on the records side only: inspection registers, maintenance and repair records, spare parts, reports, scheduling and paperwork. We do not build AI that monitors, scores or ranks the people who do the work, and we do not touch machine control or safety functions. We would rather turn that work down than hand a small business a set of obligations it cannot carry.

In practice

What to ask for, on every AI project

Whoever builds an AI system for you, these belong in the work rather than bolted on afterwards. None of them is a compliance guarantee.

  • Transparency notices: people are told when they are dealing with an AI system, by default rather than on request.
  • Human review points: consequential steps stop for a person.
  • Documentation: what the system does, what it was given, and where its limits are, written down so you can show your working.
  • A clear role split: who is provider and who is deployer, agreed in writing, with the duties that remain yours set out plainly.
  • Data protection alongside: the AI Act sits next to GDPR, it does not replace it.

Read next

Go deeper

Official sources