On this page
In short, the EU AI Act asks three things today of a small business that uses AI: support the AI literacy of your people (since 2 February 2025), make a chatbot say it is AI (since 2 August 2026), and if you let AI help decide about people, as in hiring, strict rules apply from 2 December 2027. It also covers companies outside the EU when their AI or its output is used in the EU. The GDPR keeps applying alongside. The practical answer is a short AI policy of one or two pages: which AI tools your team may use and with which account, which data never goes in, who approves a new tool and how people learn to use it. It need not be legal work; above all it has to be read.
If you then want AI to really work inside your processes, that starts with AI for business. To see quickly where you stand, use our EU AI Act checker.
Why an AI policy pays off now
In most small businesses someone already uses ChatGPT, Copilot or another assistant. Often with a free account, on a personal phone, without the owner knowing. An accounting firm where an employee pastes a payslip into a chat window to have an email written. A builder where a customer's quote with name and address ends up in a translation tool. Nobody means harm, but the data has left your business.
A policy does not solve that with a ban. People use AI because it saves time, and a ban only pushes it out of sight. A good policy says which tool is allowed, with which account and for which kind of work; the AI policy template has two filled-in examples. Then your team knows where the line is, and you know which data is where. Whether such a policy is required: do I need an AI policy.
Who the EU AI Act covers
The AI Act splits duties between whoever makes an AI system (the provider) and whoever uses it (the deployer). The heavy duties sit with the makers. A business that uses ChatGPT, Copilot or an AI feature in its accounting package is a deployer. If you build a chatbot yourself, or have one built under your own name, you can also be a provider.
It is not only for EU companies. The Act applies to providers placing AI on the EU market wherever they are based, to deployers in the EU, and to providers and deployers outside the EU when the output of their AI is used in the EU. A UK or US company with a chatbot on a site aimed at EU customers is therefore in scope for that chatbot.
| Kind of use | Example in a small business | What the AI Act asks | Since |
|---|---|---|---|
| Prohibited | Recognising staff emotions in the workplace | Do not do it | 2 February 2025 |
| High risk | AI that selects applicants or assesses creditworthiness | Strict requirements: risk management, human oversight, logging | 2 December 2027 |
| Transparency | A chatbot on your site, AI images, a deepfake | Disclose that it is AI; mark images machine-readably | 2 August 2026 |
| Ordinary use | Emails, texts, summaries, translations | Support your people's AI literacy | 2 February 2025 |
Most small businesses sit in the bottom row, perhaps with a chatbot in the third. The timeline below sets out all the dates, with what each moment means for you.
2 February 2025
Prohibited practices and AI literacySome uses are banned, such as emotion recognition in the workplace. Whoever uses AI supports the AI literacy of their people.
What you doWrite down which tools your team uses and teach them to work with them.
2 August 2025
Rules for general-purpose AI modelsObligations for the makers of the large language models behind the well-known chat assistants.
What you doLittle: that duty lies with the maker. Do choose a provider with clear terms.
2 August 2026
TransparencyWhoever talks to an AI system must know it, unless that is already clear.
What you doA chatbot on your site says at the first question that it is AI.
2 December 2026
Marking generated contentSystems already on the market before August 2026 mark generated images, audio and text.
What you doYour image tool handles the marking. Do know which images in your marketing were made with AI.
2 December 20272 August 2026Postponed by the omnibus of July 2026
High riskStrict requirements for AI that helps decide about people, such as selecting applicants or assessing creditworthiness.
What you doIf you use AI in hiring or assessment, have a lawyer look at it before you start.
2 August 2028
AI in productsAI in products with their own safety rules, such as machines or medical devices.
What you doOnly relevant if you make or sell such products.
Dates still under negotiation may shift.
What goes into your AI policy
- Which AI tools your team may use, and with which account: the business one, not a personal free account.
- Which data never goes in: national ID numbers, salaries, medical data, passwords and confidential client files.
- Which data may go in, and in what form: without names, or only in a tool where you know where the data is stored.
- Who approves a new AI tool before anyone uses it.
- That a person reads every AI result before it goes to a customer.
- How people learn to work with AI, and when they get a refresher.
- When you tell customers they are dealing with AI, such as a chatbot on your site.
- Whom to contact about a mistake or a leak, and what that person then does.
- When you reread the policy: every six months, or whenever you introduce a new tool.
AI literacy without a diploma
Since 2 February 2025 the AI Act has required businesses that use AI to support the AI literacy of their staff. The omnibus of July 2026, Regulation (EU) 2026/1744, simplified that article: you take measures to support that knowledge. It sets no fixed level everyone must reach. For a small business that is good news: it is about reasonable steps, not certificates.
What those steps are depends on how you use AI. For a team that mainly drafts emails and texts, a short session is often enough: what a language model does well, where it makes things up, why you check figures and names, and which data must not go in. Someone working with AI that answers customer questions or processes documents needs deeper training. Write down what you did and when. That is your evidence if anyone asks. The full picture of the AI literacy requirements after the omnibus, with what enforcers can ask from August 2026, is in AI literacy requirements.
Worked example: what an AI policy costs in year one
A business with twelve staff, five of whom work with AI every day. We count 40 euros of wage cost per hour and ChatGPT Business at 21 euros per user per month, billed yearly. The hours are an example; put in your own hourly cost and both the cost and the time saved scale with it.
| Item | Calculation | Cost |
|---|---|---|
| Write the policy and have it checked | 6 hours x 40 euros | 240 euros |
| Training for everyone | 12 people x 2 hours x 40 euros | 960 euros |
| Business licences for daily AI users | 5 x 21 euros x 12 months | 1,260 euros |
| Refresher after six months | 12 people x 1 hour x 40 euros | 480 euros |
| Total year one | 2,940 euros | |
| For comparison: time saved by those five | 5 x 2 hours a week x 46 weeks x 40 euros | 18,400 euros |
The policy itself costs little; licences and training are the biggest items. They pay for themselves if your team really saves the time. Which assistant to choose and what it costs: ChatGPT or Copilot and AI tools for business.
The GDPR still applies
The AI Act comes on top of the GDPR, not instead of it. If you paste personal data into an AI tool, you are processing personal data, with everything that entails: a legal basis, a data processing agreement with the provider and knowing where the data ends up.
| Question for every tool | Why | Where to find it |
|---|---|---|
| Does the provider train on what you enter? | Many free versions may; business plans usually switch it off | The terms or privacy policy of the business plan |
| Where is the data stored? | Inside the EU is simpler than outside | The provider's data location page |
| Is there a data processing agreement? | Required when the provider processes personal data for you | Usually in the business terms |
| Who in your business has access? | A shared account is no control | Your own account management |
What each assistant does with your data is set side by side in ChatGPT or Copilot. If you use AI on your website, such as a chatbot, it belongs in your privacy policy too.
What if you do not comply?
The AI Act sets fines of up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices, and up to 15 million or 3 percent for most other obligations. For small and medium-sized businesses the lower of the two amounts applies. Enforcement sits with national market surveillance authorities, which member states designate one by one; by October 2026 not every country had one in place. That is no reason to wait: the obligations already apply, and the GDPR has its own regulators in every member state.
What is still coming
On 2 December 2026 generative systems already on the market before August 2026 must mark their images, audio and text machine-readably; see AI-generated content labelling from December 2026. The same day a new ban applies on AI that creates non-consensual sexual images. The high-risk rules moved to 2 December 2027 and 2 August 2028; what that delay means: EU AI Act high-risk delay. For a chatbot on your site the disclosure duty already applies; see EU AI Act transparency obligations.
A policy people actually read
Keep it short. Two pages with examples from your own work do more than twenty pages of legal text. Write "never paste a payslip into a chat window" instead of "do not process special categories of personal data". Have it read by the people who work with it every day, and update it when you introduce a new tool.
Start small. A policy for the tools you use now beats a perfect policy for tools you might buy one day. If you want to roll out AI more widely, first read AI implementation in your business: it explains how to start with one task and measure what it returns.
Questions about AI policy and the EU AI Act
Does my business need an AI policy?
Yes, as soon as anyone in your business uses AI for work. A short policy says which tools are allowed, which data never goes in and who decides. The AI Act also requires you to support your people's AI literacy.
What is the EU AI Act?
The AI Act is the European law on artificial intelligence, Regulation (EU) 2024/1689. It applies in stages since February 2025 and puts the heaviest duties on those who make AI systems. For a business using AI, AI literacy, transparency and the high-risk rules matter most.
Does the EU AI Act apply to companies outside the EU?
Yes, when their AI system is placed on the EU market or its output is used in the EU. A chatbot on a site aimed at EU customers falls under the transparency duty, wherever the company is based.
Can I put customer data into ChatGPT?
Only if the GDPR allows it and you know what the provider does with it. Use a business account, check whether the provider trains on your input and never put sensitive data such as national ID numbers or salaries into a free tool.
When do I have to comply with the AI Act?
Part already applies: prohibited practices and AI literacy since 2 February 2025, transparency since 2 August 2026. Marking for existing systems follows on 2 December 2026, the high-risk rules on 2 December 2027, AI in products on 2 August 2028.
Must I disclose that my chatbot is AI?
Yes. Since 2 August 2026 anyone talking to an AI system must know it, at the latest at first interaction, unless it is already clear. The duty lies with the provider of the system, so ask your builder how it is handled.