Regulation
AI Act for small businesses: less than you think, but this applies
The AI Regulation sounds intimidating, but the high-risk requirements are postponed and most small businesses are barely affected. What remains is two light points, and quite a lot you can ignore.
The EU AI Regulation (AI Act) is the world’s first major AI law. But it is risk-based, and most small businesses fall into the lowest risk level, where requirements are small.
Risk classes, briefly
- Prohibited: e.g. social scoring. Does not concern you.
- High-risk: AI in e.g. recruitment, credit assessment, medical devices. Strict requirements, but most small businesses do not build such systems.
- Limited risk: chatbots and AI-generated content. The requirement is essentially transparency.
- Minimal risk: most other uses. No special requirements.
Do you use ChatGPT to write emails or Mistral for research? Then you are a user of minimal- or limited-risk AI. The requirements on you are light.
What you actually need to do
- AI competence: since February 2025, employees who use AI must have a basic understanding of the tools. In a small business, it can be enough to simply talk through how you use AI and what you should not feed in.
- Be transparent: do you use an AI chat with customers or publish AI-generated content? Tell them.
That is basically it for most.
Timeline
Basic parts already apply. The heavy high-risk requirements are postponed to 2027–2028 following the EU Digital Omnibus 2026. In Sweden, PTS is the coordinating authority, together with IMY and the Swedish Financial Supervisory Authority.
When you should read up on it
Are you building AI into recruitment, credit decisions, or something that affects people’s rights? Then you may end up in high-risk, and legal help is worth it. Otherwise you can relax.
More in our overview of data protection and EU regulations. Ahead of 2 August, there is also the checklist with a free AI policy template.
Sources
Tools mentioned
ChatGPT
OpenAI
Writes quotes, emails and customer replies in seconds. The free version covers most everyday needs; the downside is that data is stored in the USA unless you have an Enterprise or Edu plan with EU data residency.
- The free version is enough for most small businesses
- Best in Swedish among the major AI tools
- Data is stored in the USA on Free, Plus and Business plans; EU data storage is only available for Enterprise and Edu
Best for: Everyday tasks like email, text, ideas and research.
Mistral (Le Chat)
Mistral AI
France's answer to ChatGPT: the AI chat Le Chat from Mistral AI in Paris, one of the few European models in the top class. Data is stored within the EU, with a GDPR data processing addendum and certifications for SOC 2 Type II as well as ISO 27001 and 27701. A free tier is available to start with.
- European model in the top class, developed by Mistral AI in Paris.
- Data storage within the EU, with a GDPR processing addendum and certifications for SOC 2 Type II as well as ISO 27001/27701.
- Does not quite reach the level of the largest American models.
Best for: A Swedish consultant or agency that wants a powerful AI chat for quotes and emails without handing data to an American provider.
Related articles
This is general information, not legal advice. See How we review.