The EU AI Act for small businesses: what applies now and what to do this week

The Act sorts everyone into roles, and your duties depend on the role. Two of them matter here.

A provider develops an AI system, or has one developed, and puts it on the EU market or into service under its own name or trademark. OpenAI is the provider of ChatGPT. Your chatbot vendor is the provider of the chatbot.

A deployer uses an AI system under its own authority for something other than personal, non-professional activity. That's you. The Commission's FAQ adds a helpful detail: your employees aren't separate deployers. The company is, even when a freelancer runs the tool on its behalf.

One caution. If you had a chatbot custom-built and you run it under your own company name, you may count as its provider, because the definition includes having a system developed and putting it into service under your own name. I can't settle that for you from here. If it describes your setup, it's the one question in this post I'd take to a lawyer.

Article 50 has four working paragraphs. Two are addressed to providers and two to deployers. This is the split as the Commission's FAQ and the Article text give it.

Notice what that means for the website chatbot. The duty to tell visitors they're talking to an AI sits with the provider, as a design duty. The FAQ says people must be told from the start of the first interaction, in a clear and distinguishable way. The exception for "obvious" cases is meant to be read narrowly.

And notice what it means for images. The provider marks the file in a way machines can read. If what you publish is a deepfake, you still have to label it so that people can see or hear the label. The FAQ is explicit that a deployer can't rely on the provider's embedded mark for that.

On fines, the FAQ says they can reach up to 15 million euros or 3 percent of total worldwide turnover for the preceding financial year, and that proportionality can be taken into account for small and medium-sized companies. National market surveillance authorities do most of the enforcing. There's also a voluntary Code of Practice on marking and labelling that providers and deployers can sign.

• 50(1), provider. AI systems that interact directly with people must be designed so that people are informed they are interacting with an AI, unless that is obvious to a reasonably well-informed, observant person.
• 50(2), provider. Providers of systems that generate synthetic audio, image, video or text must make sure the output is marked in a machine-readable format and detectable as AI-generated. It doesn't apply where the system only assists with standard editing. The Commission's guidelines also place some outputs out of scope, such as source code and purely machine-to-machine output, and they foresee a narrow exemption for business-to-business and industrial contexts.
• 50(3), deployer. If you use an emotion recognition or biometric categorisation system, you must inform the people exposed to it. Most small businesses don't use either.
• 50(4), deployer, deepfakes. If you use AI to generate or manipulate image, audio or video that amounts to a deepfake, you must disclose that it is artificial. For evidently artistic, creative, satirical or fictional work, the disclosure can be made in a way that doesn't spoil the work.
• 50(4), deployer, text. If you publish AI-generated or manipulated text to inform the public on matters of public interest, you must disclose that. The duty falls away where the text has gone through human review or editorial control and a person or company holds editorial responsibility for publishing it.

These dates come from the timeline on the Commission's AI Act Service Desk, which already includes the changes made by the Digital Omnibus on AI.

For a small deployer, three of those dates matter. AI literacy has applied since 2 February 2025. Article 50 has applied since 2 August 2026, chatbot disclosure included. And 2 December 2026 is when providers whose generative systems were already on the market before 2 August 2026 must comply with the 50(2) marking duty. That grace period covers the marking only. It doesn't postpone anything else in Article 50.

Old content is left alone. The FAQ says content generated before 2 August 2026 does not need to be labelled retroactively, although the Commission encourages deployers to do it where they can.

One more date, in case it's yours: if you use AI to filter job applications or evaluate candidates, that is on the Annex III high-risk list, and those rules apply from 2 December 2027. That's a bigger subject than this post.

• 1 August 2024: the Act enters into force.
• 2 February 2025: general provisions, including definitions and AI literacy, and the prohibitions apply.
• 2 August 2025: rules for general-purpose AI models apply.
• 2 August 2026: most of the Act applies, including the Article 50 transparency rules, and enforcement starts for the rules that apply.
• 2 December 2026: new prohibitions apply for AI systems that generate non-consensual sexual deepfakes and child sexual abuse material. Transitional deadline for the Article 50(2) marking duty.
• 2 August 2027: each member state should have at least one AI regulatory sandbox running.
• 2 December 2027: rules for high-risk AI systems listed in Annex III apply.
• 2 August 2028: rules for high-risk AI embedded in regulated products under Annex I apply.

ChatGPT for drafts. Using it internally triggers nothing in Article 50 by itself. Two things can. One is publishing AI-written text that informs the public on a matter of public interest. The FAQ's list of such matters is broad: politics, public services, public health, consumer safety, and economic, financial, scientific or cultural developments that may be the subject of public debate. A post about your opening hours isn't on it. A post that explains a health topic or a safety issue might be. I can't tell you exactly where the line runs.

What I can tell you is what the exemption needs. Human review, in the FAQ's words, is a deliberate examination of the substance by someone with relevant knowledge. Spell-checking and grammar fixes don't count. And somebody has to hold editorial responsibility for publishing. So: a named person who knows the subject reads every public text and can change or reject it. That's good practice with or without a law.

The website chatbot. The legal duty to build in the "you're talking to an AI" notice is your vendor's. Your visitors don't know or care whose duty it is. Open your own site, start the chat and look. If the first thing a visitor sees doesn't make clear that it's an AI, ask the vendor to fix it, and until they do, write the notice into the welcome message yourself.

AI images and video. Ask whether what you made is a deepfake in the Act's sense. The FAQ gives three criteria that all have to be met: it closely resembles its subject, the subject is a person, object, place or event that exists or plausibly could, and the result would falsely appear authentic. A made-up example: an AI "photo" of a customer workshop that never took place probably ticks all three. A flat cartoon illustration for a blog header doesn't appear authentic to anyone. For the first kind, put a visible label where people first see it.

About watermarks: I found nothing in Article 50 that tells a deployer to preserve the provider's machine-readable marks. I'd keep them anyway, and I'd tell the team not to crop or strip them. Removing a mark doesn't remove your own duty to label a deepfake, and it throws away the one signal that lets others check where an image came from.

The team. Article 4 says providers and deployers shall take measures to support the AI literacy of their staff, taking into account their knowledge and the context the systems are used in. The current text adds that this doesn't oblige you to guarantee any particular level for any individual. The Act doesn't prescribe a format. A one-page guide that people have read is my suggestion for a ten-person team, and I don't claim the law names that as the minimum.

Six steps. None of them is a big job, and you can spread them over a week. Keep a dated note of what you did for each, with a screenshot where there's something to see.

If you only do one of these today, do step two. It's the change a visitor sees.

• Write a one-page internal AI guide. Which tools are allowed, by name. What must never be pasted into them. Who reviews anything that gets published. Where to ask when unsure. Put it where the team will find it. The prompt at the end drafts it for you.
• Check the chatbot notice. Open your site in a private window and start the chat. If it isn't clear from the first message that this is an AI, add a line such as "You are chatting with an AI assistant" to the welcome message and raise it with the vendor.
• Keep the provider's marks. Look at how your team exports and edits AI images and video. Don't crop out visible marks, and tell people not to run files through tools whose purpose is to strip them.
• Label deepfakes. If an image, voice or video shows something realistic that didn't happen, label it as AI-generated in the caption or on the image, where people see it first.
• Name a reviewer for public text. Decide who reads blog posts, announcements and anything else that informs the public before it goes out. That person checks the substance, not the commas, and their name goes on the decision to publish.
• Ask your chatbot vendor about 2 December 2026. Was the system on the market before 2 August 2026? Is the vendor using the transition period for the 50(2) marking duty? What marking will the output carry, and from when? File the answer.

These lines are my suggestions. None of them is official wording, and the Act doesn't prescribe any. It asks for the information to be clear and distinguishable, and given at the latest at the first interaction or exposure. Short and visible does that better than a paragraph in the footer.

Replace the brackets before you publish, and only promise what's true. If nobody follows up on chatbot requests, don't say that somebody does.

• Chatbot, first message: "You are chatting with an AI assistant from [Company]."
• Chatbot, second line if you want one: "I can get things wrong. For a binding offer, write to [email]."
• Realistic AI image: "AI-generated image. This scene did not take place."
• AI illustration, where you choose to label it: "Illustration created with AI."
• Video with a synthetic voice: "Voice and visuals generated with AI."
• Satire or art: "Satire. Visuals created with AI."
• Public text you publish without real review: "This text was generated with AI."
• Public text that was reviewed, as an optional courtesy: "Drafted with AI and reviewed by [Name]."

You can't hand your own duties to a vendor. You can ask the vendor to show that they've done theirs. Send these to your chatbot vendor and, with the second and third, to your image or video tool. Keep the answers in one folder with the date.

Be a little suspicious of two answers. "Our terms of service mention AI, so no notice is needed" doesn't match what the FAQ says about informing people from the start of the first interaction. And "you can switch the marking off" is a setting I'd leave alone.

• Do you consider yourself the provider of this system under the AI Act, and what did you change for Article 50?
• How does the product tell users they are interacting with an AI, and can I see or edit that notice?
• What machine-readable marking do you apply to generated output under Article 50(2), and does it survive download and editing?
• Was the system on the EU market before 2 August 2026, and are you relying on the transition to 2 December 2026?
• Have you signed the Code of Practice on transparency of AI-generated content?

This works in any AI assistant. Fill in the brackets first. Then read the result as you would read a draft from a new colleague: correct the tool names, delete anything that isn't true for your company, and put a date on it.

The prompt tells the assistant not to give legal advice and to use only the three dates from this post, so that it doesn't make up others. If you'd like help putting guardrails around AI in your own product, that's what cost and safety rails is about, or just write to me.

Goal: Draft a one-page internal AI guide for my small business, as a first step on AI literacy and on the transparency rules in Article 50 of the EU AI Act.

Inputs: Business name: [fill in]. Team size: [fill in]. AI tools we use: [for example ChatGPT, our website chatbot and its vendor, our image tool]. What must never be pasted into an AI tool: [for example customer personal data, passwords, contracts]. Person who reviews text before it is published: [name]. Chatbot welcome line: [You are chatting with an AI assistant from X]. Rule for images: [keep the provider's marks; label realistic AI images as AI-generated].

Constraints: Plain words and short sentences, written for people who are not engineers. Do not give legal advice. Include one line that says legal questions go to a lawyer and that the official pages are the reference. Do not invent tool features, fines or dates. If a date is needed, use only these: 2 February 2025 (AI literacy applies), 2 August 2026 (Article 50 applies), 2 December 2026 (transition deadline for providers' machine-readable marking).

Definition of done: One page with these headings: allowed tools, what never goes into them, the chatbot notice, images and deepfake labels, review before publishing, questions we have asked our vendors, who to ask when unsure, and the date of the next review.