AI Act for small businesses: less than you think, but this applies

The EU AI Regulation (AI Act) is the world’s first major AI law. But it is risk-based, and most small businesses fall into the lowest risk level, where requirements are small.

Risk classes, briefly

• Prohibited: e.g. social scoring. Does not concern you.
• High-risk: AI in e.g. recruitment, credit assessment, medical devices. Strict requirements, but most small businesses do not build such systems.
• Limited risk: chatbots and AI-generated content. The requirement is essentially transparency.
• Minimal risk: most other uses. No special requirements.

Do you use ChatGPT to write emails or Mistral for research? Then you are a user of minimal- or limited-risk AI. The requirements on you are light.

What you actually need to do

1. AI competence: since February 2025, employees who use AI must have a basic understanding of the tools. For a small business, it is largely enough to discuss how you use AI and what you should not feed in.
2. Be transparent: do you use an AI chat with customers or publish AI-generated content? Tell them.

That is basically it for most.

Timeline

Basic parts already apply. The heavy high-risk requirements are postponed to 2027–2028 following the EU Digital Omnibus 2026. In Sweden, PTS is the coordinating authority, together with IMY and the Swedish Financial Supervisory Authority.

When you should read up more

Are you building AI into recruitment, credit decisions, or something that affects people’s rights? Then you may end up in high-risk, and legal help is worth it. Otherwise: breathe out.

More in our overview of data protection and EU regulations. Ahead of 2 August, there is also the checklist with a free AI policy template.