The EU AI Act for small teams: what actually applies to you

The EU AI Act entered into force in August 2024 and is phasing in. Banned practices, and a duty to take steps so your staff understand the AI tools they use, have applied since February 2025. Rules for general-purpose AI models followed in August 2025, and the transparency rules — like telling people they're talking to AI — in August 2026. The high-risk rules were due in August 2026 too, but the EU's Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) pushed them back: to 2 December 2027 for uses like hiring and credit, and to 2 August 2028 for AI built into regulated products. If you run a small business in the EU and use AI anywhere, the Act applies to you in some form. The good news: for most small-team use cases, that form is light.

Sources: Regulation (EU) 2024/1689 — full text on EUR-Lex · European Commission — AI Act overview and timeline · Regulation (EU) 2026/1744 (Digital Omnibus on AI) — EUR-Lex · European Commission — AI Act overview and timeline

The one idea that explains the whole law

The Act sorts AI uses by risk, not by technology. The same model can be unregulated in one use and heavily regulated in another. Four buckets: prohibited (social scoring, manipulative systems — things you weren't doing anyway), high-risk (AI making consequential decisions about people: hiring, credit, essential services), limited-risk (AI that interacts with people — needs transparency), and minimal-risk (everything else — most business automation lives here).

What a typical small-team automation actually is

Invoice OCR that extracts fields into your accounting software. A workflow that moves order data between systems. A knowledge assistant answering questions from your own documents. None of these make consequential decisions about people — they're minimal-risk, and the Act imposes essentially no new obligations on using them.

Where a small business can genuinely cross the line

The high-risk bucket is closer than it sounds in one specific place: people decisions. Use AI to screen job applications, evaluate employees, or decide who gets credit or an essential service, and you're in regulated territory with real obligations — documentation, human oversight, risk management. The practical rule for a small team: automate the paperwork around people decisions freely, but keep the decision itself with a human. Those obligations now start on 2 December 2027 — later than first planned, but not cancelled.

Don't forget the older law that already applied

GDPR didn't go anywhere, and for most small-business automation it's still the law that bites first. Personal data in your invoices, emails and CRM flows through any automation you build — which is why where the AI runs matters. EU-region hosting and self-hostable tools keep the data-protection story simple. That's our default for exactly this reason.

What to actually do, this quarter

• List where AI already touches your business — including tools your team adopted without asking.
• Label your chatbots and voice agents as AI, if you have them. Ten-minute fix.
• Make sure whoever uses AI tools at work knows the basics — what they're good at and where they go wrong. The Act already asks you to take steps on this.
• Check where each AI tool processes data, and prefer EU-region options for anything sensitive.
• Keep humans making the people decisions — hiring, firing, credit.
• If you think a use might be high-risk, ask a lawyer. This article isn't one.

Compliance is a lot cheaper designed in than bolted on — it's why every build we do starts from EU data rules rather than retrofitting them after an audit. But whoever builds your automation, make them answer one question in writing: where does the data go?