EU AI Act for small businesses: what to do now

What is the EU AI Act?

The AI Act governs how AI systems are placed on the market and used in the European Union. The aim is for AI to be safe and to respect people's rights. The law looks mainly at the risk of an application. A tool that writes copy is very different from a system that decides who gets a loan.

The law distinguishes between roles. A provider develops an AI system and places it on the market. A deployer uses an AI system in their own work. As a small business you're usually the second: you use ChatGPT, a chatbot or a tool that reads documents. If you have something built and bring it to market under your own name, you can also become a provider.

The four risk categories of the AI Act

• Unacceptable risk: banned. Think of systems that give people a social score or manipulate them in harmful ways.
• High risk: allowed under strict requirements. For example AI that selects job applicants, assesses creditworthiness or operates in critical infrastructure.
• Limited risk: mainly transparency. Chatbots must make clear you're talking to AI, and AI-generated images or deepfake videos must be recognisable.
• Minimal risk: no extra requirements. Think of spam filters, spell checkers or AI that optimises your scheduling.

Most AI use in small businesses falls under limited or minimal risk. A chatbot on your website, a tool that sorts emails or an assistant that writes reports usually falls into those categories.

Two examples make the difference clear. A beauty salon with a chatbot that answers questions about prices and opening hours falls under limited risk. The salon mainly needs to show visitors they're talking to a bot. A business that has AI rank and reject job applicants quickly ends up in the high-risk category. Much stricter requirements then apply, such as human oversight, proper documentation and monitoring how the system performs. If you want to use AI for decisions like these, get proper advice first.

What already applies to businesses?

Since February 2025, two parts have applied that also matter for small businesses:

• The ban on AI applications with unacceptable risk.
• The AI literacy obligation: anyone using AI must make sure the staff who work with it have enough knowledge of how it works and what the risks are.

The other rules follow in steps, such as rules for large AI models, transparency obligations and the requirements for high-risk systems. The exact timeline may still shift due to new European decisions. So check the current status before making important choices.

AI literacy: what does it mean in practice?

AI literacy sounds like a big deal, but for a small business it can be simple. The point is that everyone who works with AI understands what it can do, where it goes wrong and what the agreed rules are. You could, for example:

• Give a short explanation of how tools like ChatGPT work and why they sometimes make things up.
• Agree which data must never go into an AI tool.
• Record that a person checks the output before it goes to a customer.
• Keep track of who has had which explanation, so you can show it.

Tips for good ground rules are in our article on using ChatGPT for business.

Step-by-step: preparing your business for the AI Act

• Make a list of all the AI tools your business uses, including tools staff have picked themselves.
• For each tool, write down what you use it for and which data goes into it.
• Determine the risk of each application: is it a writing aid, or does it make decisions about people?
• Be transparent: let visitors know when they're talking to a chatbot, and be open about AI-generated images.
• Sort out AI literacy with a short explanation and a few fixed agreements.
• Not sure whether something is high risk, such as AI in recruitment or credit assessment? Get legal advice before you start.

The AI Act and the GDPR: two laws side by side

The AI Act doesn't replace the GDPR (AVG in Dutch). If you use AI with personal data, both laws apply. The GDPR is about privacy and how you handle people's data. The AI Act is about the risks of the AI system itself. You can read how to handle the privacy side in our article on AI and the GDPR. For questions about your own situation, ask a lawyer or the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

How Violexa takes this into account

At Violexa we build AI solutions that suit a small or growing business: chatbots, automatic processing of emails and documents, and integrations between systems. We keep the risk low by having AI mainly do the preparation and a person make the decision. A chatbot clearly shows that it's a bot. And we explain how the solution works, so your team knows what it does. We don't give legal advice, but we make it easy for you to have your setup reviewed. Take a look at AI & automation or first read our overview of AI for small businesses. A custom solution starts from €1,799 excl. VAT (€2,177 incl. VAT), one-off.

Want to know how to use AI sensibly without hassle over the rules? Book a free quickscan. In 30 minutes, online or on site, we look at your plans. Afterwards you get short written advice with a price estimate, with no obligation.

Frequently asked questions