EU AI Act for small businesses

For a small business that only uses everyday AI tools, like ChatGPT, Claude or a customer chatbot, the European AI law asks little, but not nothing: don't use it for prohibited purposes, take steps so your people know how to use it with judgement, and be transparent when someone is talking to an AI or receiving content generated by one. The heavy obligations are for those who develop AI systems or use them in high-risk areas.

The law, known as the AI Act, is Regulation (EU) 2024/1689 and applies in phases. In 2026 a reform, the so-called Digital Omnibus, pushed back the high-risk rules, which include uses such as recruiting staff, until December 2027, and softened the obligation to train staff: it now talks about supporting that training, not guaranteeing a level (checked in September 2026). What usually confuses people is thinking you have to register or ask for permission to use ChatGPT: for normal use, you don't. The tricky part begins when AI makes decisions about people.

What I've understood of the law as it applies to what I do I explain in "Is what I'm doing with artificial intelligence legal?", in practical terms and without legalese. I'm not a lawyer and this law keeps changing, so for your specific case consult a professional or the information from your national AI supervisory authority (in Spain, AESIA, the Spanish Agency for the Supervision of Artificial Intelligence).