The EU AI Act: What It Means for Your Business

The AI Act distinguishes several roles, and this is the key to understanding your obligations. The provider develops and places an AI system on the market: that is Microsoft, OpenAI, Google. The deployer uses an AI system in the course of its professional activity: that is you, as soon as your teams use Copilot, a chatbot or a business AI tool. The vast majority of SMBs are deployers, not providers, and a deployer's obligations are significantly lighter. Be careful though: if you heavily customize an AI system, market it under your own brand or change its intended purpose, you can shift into the provider role, with the heavy obligations that come with it.

The regulation classifies AI systems into four risk levels. Unacceptable risk practices are outright banned (social scoring, subliminal manipulation, certain forms of emotion recognition at work). High-risk systems, listed in the annexes, carry heavy obligations: this is where many SMBs get caught out, because it covers AI used for recruitment, candidate screening, employee evaluation or promotion, as well as access to credit. Limited-risk systems (chatbots, content generation) are subject to transparency obligations. Finally, minimal risk, which covers the overwhelming majority of office use cases, carries no specific obligation. In plain terms: using Copilot to summarize meetings or draft emails is minimal risk. Using AI to screen CVs moves you into high risk.

Application is progressive. Since 2 February 2025, prohibited practices are banned and an AI literacy obligation applies to all organizations: you must ensure that staff using AI have a sufficient understanding of its capabilities, limits and risks. This is the most concrete and universal obligation, and many SMBs are still unaware of it. Since 2 August 2025, rules on general-purpose AI models and governance have applied. 2 August 2026 marks the general application of the regulation, notably for high-risk systems listed in Annex III. A final deadline in 2027 targets AI embedded in already-regulated products. Penalties are dissuasive (up to tens of millions of euros or a percentage of worldwide turnover depending on the breach), with caps adapted for SMBs.

Four tasks, in this order. First, the inventory: list the AI tools actually used across the business, including those your teams adopted without telling you. That is often the biggest surprise. Then qualification: for each use case, determine the risk level, paying particular attention to HR and recruitment. Then literacy: train your users and keep a record of that training, it is an obligation that already applies. Finally governance: control the data the AI can reach (badly configured SharePoint permissions are a risk at least as real as the regulation itself) and align everything with GDPR, which continues to apply fully in parallel. This article provides a general framework and is not legal advice: for a high-risk use case, have your analysis validated by a specialist lawyer.