What does the EU AI Act require from small businesses?

The EU AI Act uses a risk-tiered approach, and its requirements depend more on the *type of AI system* deployed than on company size.

General obligations for small businesses:

• If you deploy or develop high-risk AI (e.g., in hiring, credit scoring, biometric identification, or critical infrastructure), you face the same core obligations as large companies: conformity assessments, technical documentation, human oversight mechanisms, and registration in the EU database.
• Prohibited AI practices (e.g., social scoring, real-time remote biometric surveillance in public spaces) apply universally—no size exemptions.
• For limited-risk AI (chatbots, deepfakes), transparency obligations apply—users must know they're interacting with AI.

Where SMEs get some relief:

• Reduced regulatory sandbox access is specifically encouraged for SMEs and startups to test systems under lighter supervision.
• Fee structures and administrative burdens may be proportionately reduced for small businesses in some member state implementations.
• General-purpose AI obligations primarily target providers of large foundation models, not typical SME users.

Practical takeaway: If your business only uses low-risk AI tools (recommendations, spam filters), obligations are minimal. The real compliance burden hits businesses that develop or deploy AI in high-risk categories, regardless of size.

Small businesses are not exempt from the EU AI Act, but their obligations are scaled to the risk level of the AI system they provide or use. The Act focuses on high-risk AI (e.g., in hiring, credit scoring, safety components), and any business developing such systems must meet core requirements—such as risk management, high-quality datasets, transparency, and human oversight—just like larger firms.

However, the Act explicitly acknowledges the burden on smaller players and includes several relief measures:

• Simplified technical documentation: SMEs can use a lighter template to demonstrate compliance.
• Priority access to AI regulatory sandboxes and testing facilities, giving them a practical environment to validate systems.
• Reduced conformity assessment fees: Notified bodies must consider SME needs when setting costs.
• Tailored guidance and awareness-raising from national authorities.

For limited-risk AI (like chatbots or emotion-detection systems), transparency duties apply regardless of size—for example, informing users they are interacting with an AI. Small businesses using such systems off-the-shelf mainly need to ensure correct deployment and clear labeling. Minimal-risk AI (spam filters, AI-enabled video games) is largely unregulated.

The main trade-off is that while these supports lower barriers, they do not offer a complete safe harbor. Small businesses still bear full responsibility for harm caused by their high-risk AI and must invest in compliance. Early risk classification and engagement with national support schemes are therefore crucial to avoid costly retrofits.

The EU AI Act applies to all organisations, including small businesses, that develop, deploy, or use AI systems within the EU. The key requirement is risk-based compliance: you must classify your AI system as prohibited, high-risk, limited-risk, or minimal-risk.

For most small businesses, the practical obligations are:

• Prohibited AI (e.g., social scoring, real-time biometric surveillance) is outright banned, regardless of size.
• High-risk AI systems (e.g., those used in employment, credit scoring, or critical infrastructure) face the heaviest requirements: risk management, data governance, technical documentation, transparency, human oversight, and conformity assessment. Small businesses are not exempt, but the Act includes proportionality measures – SMEs can benefit from regulatory sandboxes, reduced fees, simplified documentation templates, and priority access to guidance.
• Limited-risk systems (e.g., chatbots) require transparency – users must be informed they are interacting with AI.
• Minimal-risk (most common) has no additional obligations, though voluntary codes of conduct are encouraged.

My view: The Act correctly balances safety with SME realities by offering lighter-touch provisions, but the main trade-off is that high-risk classification can still be burdensome for small firms with limited legal and technical resources. To comply, small businesses should proactively assess their AI’s risk level, document its purpose and data use, and engage with national supervisory authorities early.

The EU AI Act primarily targets providers and deployers of high-risk AI systems, not small businesses generally. However, small businesses are not entirely exempt and need to assess their involvement with AI.

Key considerations for small businesses:

• Risk Classification: If a small business develops or uses an AI system classified as "high-risk" (e.g., in critical infrastructure, medical devices, or employment), they must comply with stringent requirements. These include risk management systems, data governance, technical documentation, human oversight, and cybersecurity.
• Transparency and Information: Even for lower-risk AI, businesses must ensure transparency. For instance, users interacting with AI systems (like chatbots) should be informed that they are communicating with an AI.
• Prohibited AI Practices: Small businesses cannot develop or deploy AI systems that engage in practices deemed unacceptable, such as widespread social scoring or certain manipulative techniques.
• Supply Chain Impact: If a small business uses AI components or services from larger providers, they may need to demonstrate compliance through contractual agreements. They may also be considered deployers and share some responsibilities.

In essence, the impact on a small business hinges on the nature and risk level of the AI systems they utilize or develop. A proactive assessment is crucial to ensure compliance and avoid potential penalties.

The EU AI Act adopts a risk-based approach, so obligations for small businesses depend primarily on whether they develop, import, or deploy AI systems classified as high-risk. Most SMEs will face minimal or no specific duties if their tools fall into limited-risk or minimal-risk categories.

Key practical requirements include:

• Transparency measures for chatbots, deepfakes, or emotion-recognition systems: users must be informed they are interacting with AI.
• Documentation and oversight if a system is deemed high-risk (for example, in recruitment or credit scoring): maintain risk-management processes, ensure data quality, enable human supervision, and keep technical records for audits.
• Conformity assessment before market placement, often self-assessment for SMEs, followed by CE marking where required.

To ease compliance, the Act provides regulatory sandboxes, priority access to guidance, and reduced fees for small enterprises. Non-compliance can trigger fines scaled to company size, starting at lower thresholds than for large firms.

In practice, small businesses should map their AI uses against the Act’s annexes early, update vendor contracts for transparency clauses, and allocate modest resources to staff training. The main trade-off is upfront compliance cost versus improved market trust and legal certainty across the EU.

The EU AI Act applies a risk-based approach, meaning a small business’s obligations depend primarily on how it develops or uses AI, rather than its size. However, the legislation includes targeted provisions to prevent disproportionate burdens on SMEs.

If a small business merely deploys low-risk AI (like standard marketing tools), requirements are minimal. If it provides or deploys high-risk AI (e.g., automated HR screening), it must comply with strict data governance, transparency, and human oversight rules.

To support smaller players, the Act offers:

• Simplified documentation: SMEs can use streamlined technical files for high-risk AI conformity assessments.
• Regulatory sandboxes: Priority access to controlled testing environments with dedicated regulatory guidance.
• Micro-enterprise exemptions: Certain General Purpose AI (GPAI) obligations do not apply to micro-enterprises unless the model poses systemic risks.

Regardless of size, all SMEs must avoid prohibited AI practices (like manipulative biometric categorization) and meet basic transparency obligations (e.g., labeling deepfakes).

While the Act intentionally reduces friction for SMEs, the main trade-off is that baseline compliance costs for high-risk AI remain steep. Small businesses must still carefully map their AI use cases, as the administrative overhead of proving compliance can easily outweigh the intended regulatory relief.