Which AI Duties Actually Apply to a Small Organisation

When your business is small, compliance can feel impossible. You do not have a dedicated legal or compliance team, and the idea of navigating AI regulation may seem like something only large enterprises need to worry about. The reality is different. The EU AI Act, which came into force on 2 February 2025, applies to all organisations that use AI systems, regardless of size. Article 5 of the regulation prohibits certain AI practices entirely, and these prohibitions apply to your small business just as they do to a multinational corporation. Understanding which duties actually fall on your shoulders is the first step to staying safe.

Small organisations are exempt from nothing under the EU AI Act. The regulation does not have a company-size threshold. If you operate in the European Union or serve EU customers, the rules apply to you. Penalties for violations can reach up to 35 million euros or 7 percent of global turnover. For a small business, even a lower penalty tier would be significant. The key to managing this is not panic but clarity: know which specific duties apply to what you actually do.

Your duties depend on how you use AI. If you are a user of AI systems, you have different obligations than if you are a developer or deployer of high-risk systems. Most small businesses fall into the user category. This means you must ensure that the AI systems you choose do not use prohibited practices such as social scoring or real-time biometric identification in public places. You must also ensure that the data you feed into AI systems, including language models, does not breach confidentiality or data protection rules.

Article 4 of the EU AI Act creates a national AI literacy duty that came into force on 2 February 2025. Enforcement by member states begins from 2 August 2026. This duty requires that anyone handling AI systems understands what they are doing and knows the basic risks. For a small business, this typically means your staff who use AI tools have some training. Your accountant who uses AI for bookkeeping, your receptionist who manages the chatbot, your social media manager who uses AI for content creation all need to know the basics. This is not a doctoral programme. It is straightforward awareness.

GPAI systems, which are general-purpose large language models like ChatGPT, are subject to special rules. These rules have been in effect since August 2025, with Commission enforcement beginning on 2 August 2026. The main requirement for you as a user is transparency. You need to know when you are using a GPAI system and understand what it can and cannot do safely. Article 50 transparency obligations came into force on 2 August 2026. If you are using a generative AI system to create content, you have a duty to mark that content, and you must do so in a machine-readable way by 2 December 2026.

Your duties as a small business are manageable but non-negotiable. Start by listing every AI tool your organisation uses. Identify which person uses each tool and what they use it for. Then, map those uses against the prohibited practices list and the transparency requirements. You will find that most of your uses are permissible, but you need to know which ones are not. The duties are not designed to drive small businesses offline. They are designed to prevent the worst harms. Meeting them is within your reach if you know what they are.

Frequently asked questions

Does the EU AI Act apply to small businesses?

Yes. The EU AI Act applies to all organisations that develop, deploy, or use AI systems, regardless of company size. There are no exemptions based on the number of employees or annual revenue. If your small business uses AI tools, Article 4 AI literacy requirements apply to your staff, and Article 50 transparency requirements apply to AI-generated content you create.

Is a free chatbot tier safe for business data?

No, not in most cases. Free tiers of language models typically allow the vendor to use your input data for training the model. If you paste customer information, supplier data, or business secrets into a free tool, you are sharing that information with the vendor and potentially with everyone whose data is used for future training. For sensitive data, use a paid tier that promises no training on user data, or use an on-premises tool that does not send data to external servers.

Do small companies need an AI policy?

Yes. An AI policy for a small company does not need to be long or complex. A two-page policy covering authorised tools, data restrictions, output review processes, and an escalation contact is sufficient. The policy prevents staff from adopting unauthorised tools, sets clear expectations about data confidentiality, and provides evidence that you thought through AI governance. The policy also fulfils part of the Article 4 AI literacy requirement.

Do you have to tell customers you use AI?

Yes, in most cases. Article 50 of the EU AI Act requires clear disclosure when content or interaction is generated by an AI system. This disclosure must be in a machine-readable way by 2 December 2026. Until machine-readable standards are standardised, human-readable disclosure near the AI-generated content is acceptable. If you use a customer service bot, you must tell customers they are talking to an automated system. If you generate marketing content with AI, you must disclose this.

Can a small business be fined for misusing AI?

Yes. Penalties for breaching the EU AI Act can reach up to 35 million euros or 7 percent of global turnover. These penalties apply regardless of company size. A small business is not exempt. However, breaches serious enough to incur penalties typically involve the most serious harms: prohibited practices such as social scoring or systematic deception. If a small business follows the basic governance approaches in this course, the risk of such serious breaches is low.

What AI risks matter most for a small company?

The risks that matter most are those that cause direct business harm or legal liability. These include: data confidentiality breaches from using public tools with sensitive data, accuracy failures in financial or customer-facing AI output, discrimination in recruitment or lending decisions, failure to disclose AI use to customers, and cyber risks from weak account security. Focus on these first. Start with data confidentiality and output accuracy.

Is AI generated marketing copy legally risky?

Yes, if it is not checked for accuracy. Advertising standards in your jurisdiction still apply to AI-generated claims. You are liable for the truthfulness of claims, not the AI. Verify factual claims against your records. Check that the AI did not invent statistics, citations, or product features. Fact-check and fact-check again. Also, disclose that the content is AI-generated as required by Article 50. This transparency protects you.

How do you stop staff pasting client data into AI tools?

Create a clear policy that prohibits pasting client or customer data into public AI tools. Use plain language: “Customer contact information, payment details, and personal data must never be pasted into any free tool or any tool that trains on user data.” For staff who need to use AI for sensitive data, provide access to paid tools with confidentiality commitments. Make it easy to do the right thing. Train your team. Answer questions. Treat violations as teachable moments, not crimes.

What should a small business ask an AI supplier?

Ask these key questions: What happens to data I put into your tool? Is it used for training your model? Is it shared with third parties? How long do you retain it? Can I delete it? What is your security and encryption policy? What happens if your company is acquired? Can you provide references from similar businesses? Do you have third-party security audits or certifications? Are there limitations on what data types your tool is safe for? A good vendor will have clear answers.