Updated on 4 October 2026. With the Digital Omnibus on AI, the high-risk rules were postponed in July 2026 and the AI literacy obligation was relaxed. This article has been updated accordingly and now also covers what belongs in an AI policy.
What the EU AI Act is
The EU AI Act is the first comprehensive legislation in the world to regulate the use of artificial intelligence. The law was adopted in 2024 and comes into force in stages. The prohibited practices and the AI literacy obligation have applied since February 2025, and most other rules, including the transparency obligations, since 2 August 2026. The rules for high-risk AI systems were postponed by the Digital Omnibus on AI: to 2 December 2027 for applications such as recruitment and credit assessment, and to 2 August 2028 for AI built into products.
For large tech companies that develop AI models, the impact is enormous. For SMBs that use AI as a tool in their operations, the picture is more nuanced.
What is relevant for you as an SMB owner
The AI Act works with a risk classification. AI systems are sorted into four categories: unacceptable risk (banned), high risk (strict requirements), limited risk (transparency obligations) and minimal risk (no extra requirements).
Most AI applications that SMBs use fall into the minimal or limited risk category. Think of AI for email processing, content generation, data analysis, customer-service support and process orchestration. No heavy compliance requirements apply to these.
Transparency obligation: Since 2 August 2026, people must know they are communicating with an AI system, unless that is obvious. Formally the obligation lies with the provider of the system, but if you have a chatbot built under your own name, that is often you. In practice this means: if you have an AI chatbot on your website, state that it is an AI. And if you publish realistic images, video or audio that were created or edited with AI and look real, disclose that too.
High risk applies specifically to: AI in recruitment and selection, credit assessment, access to essential services and certain government processes. If you use AI to screen applicants or make creditworthiness decisions, stricter rules apply to you from 2 December 2027. Most SMBs do not do this.
What you can ignore
The vast majority of the AI Act is written for developers of AI models and for organisations that deploy AI for high-risk applications. If you use AI as an entrepreneur to improve your business processes, you do not need to worry about training foundation models, conformity assessments for AI systems, or extensive technical documentation.
That does not mean you should be careless. But the obligations that apply directly to you are manageable and often already covered by common sense and existing GDPR compliance.
What you do need to do
Four concrete actions that are relevant for every SMB. First: know which AI tools you use and for what. Make a simple overview. This takes an hour and gives you a grip. Second: make sure your people know how to work with those tools sensibly. That is the AI literacy obligation under Article 4, lighter since July 2026 but still in force. Third: make sure customers know when they are communicating with AI. Transparency is mandatory and also increases trust. Fourth: check with your AI suppliers whether they are GDPR compliant, where your data is processed and whether it is used for model training. That is a GDPR obligation you already have anyway.
What does an AI policy consist of?
A good AI policy for an SMB fits on two pages and answers seven questions. It is not a legal document, but a working agreement your employees actually read.
- Purpose and scope: what you use AI for, and who the policy applies to (including freelancers and interns).
- Approved tools: which AI tools may be used, with a business account instead of a personal one.
- Data: which data must never go into an AI tool, such as citizen service numbers, medical data and confidential client files, and when only anonymised data is allowed.
- Human oversight: which output is always checked by a person before it reaches a client.
- Transparency: when you tell clients they are dealing with AI, for example with a chatbot or AI-generated images.
- AI literacy: what explanation or training each role gets, and where you record it (Article 4 of the AI Act).
- Ownership and review: who keeps the register of AI tools, who answers questions and how often you review the policy.
Start with the tools already in use and the data that flows through them. A policy that fits how your team works today gets followed; a policy that bans everything gets bypassed. In an AI audit we deliver the register and the basis for this policy.
What Innoworks pays attention to
In everything we build, we make sure it complies with both the GDPR and the AI Act. Data is processed in Dutch data centres, we work model-agnostic so there is no vendor lock-in, and we always build with a human in the loop: AI advises, the human decides.
That is not a compliance checkbox. That is how we think AI should work: transparent, reliable and under the control of the entrepreneur.
