Does the EU AI Act Apply to Your Business? Obligations Explained in Plain Terms

Most guides to the EU AI Act are written for companies that build AI. This one is for everyone else too: the online shop with a chatbot, the agency drafting copy with ChatGPT, the software company adding an AI feature, the non-EU business selling to European customers. The regulation’s main application date has now passed and, with a late amendment, the picture has settled. Here is what the Artificial Intelligence Act actually requires of an ordinary business.

What the Artificial Intelligence Act Is and Why It Matters

The AI Act, formally Regulation (EU) 2024/1689, is the world’s first comprehensive AI law (the current consolidated text is on EUR-Lex). As an EU regulation it applies directly in every member state, without national transposition. The AI regulation is built on a risk-based logic: the greater the potential impact of an AI system on people’s safety or fundamental rights, the stricter the obligations on those who develop and use it.

The Digital Omnibus on AI (Regulation (EU) 2026/1744) amended the Act shortly before its main application date. It postponed the high-risk deadlines, added two new prohibited practices, narrowed part of the high-risk definition and cut paperwork for smaller companies. The architecture, four risk levels and role-based duties, is unchanged.

Who Does the EU AI Act Apply To? A Four-Question Check

1. Is the tool an “AI system”? A rule-based algorithm with fixed, human-defined steps is not. The defining feature is inference: the system produces predictions, recommendations, decisions or content from data in ways not explicitly programmed. Chatbots, generative tools, scoring and recommendation engines qualify; a spreadsheet formula does not.

2. Is it used professionally? Private, non-professional use is out of scope. The moment an employee uses a tool on behalf of a company, the company is in scope.

3. Does it touch the EU? The Act applies if the AI system is placed on the EU market, used in the EU, or its outputs are used in the EU. A company outside the Union that serves EU customers is covered. There is no exemption for small businesses or start-ups; AI Act obligations scale with risk, not headcount.

4. Did you build it, or do you use it? This decides your role, and your role decides your duties.

Most businesses are deployers under the AI Act. Using ChatGPT, Copilot or a vendor chatbot does not make you a provider, but it does make you a deployer, with the obligations described below. You can become a provider without intending to: if you substantially modify a system, integrate it into your own product or market it under your own brand.

One further rule for companies outside the EU: a non-EU provider must appoint an authorised representative established in the Union before making a high-risk AI system or a general-purpose AI model available there (open-source models without systemic risk are exempt).

AI Act Risk Categories: The Four Levels

The European Commission estimated when drafting the law that roughly 85% of AI systems fall into the minimal-risk category. For most service, software and e-commerce companies, only the first and third rows matter in practice.

EU AI Act Timeline: What Applies Now and What Was Postponed

EU AI Act Requirements Most Businesses Face Today

1. Do not use prohibited AI practices

Check that no tool in your business falls into a banned category. The most realistic trap for an ordinary company is emotion recognition of employees or customers, or biometric categorisation that infers sensitive traits such as ethnicity or political views. The Commission has published guidelines on prohibited practices for borderline cases.

2. Support AI literacy, and yes, write an AI policy

Providers and deployers must take measures that support AI literacy among the people who operate or use AI on their behalf. The Omnibus softened the wording: you no longer have to guarantee a particular level of competence for each person, but you must still act. The Act does not literally say “adopt an AI policy”, yet a short internal AI-use policy, documented training and a record of who completed it are the simplest way to evidence compliance. Since the duty applies to internal use too, this is the one obligation that reaches even companies whose AI never touches a customer.

3. Chatbot disclosure: tell people when they are talking to a machine

Under the transparency obligations, an AI system that interacts directly with people, such as a chatbot or voice assistant, must make clear that the user is dealing with AI, unless this is obvious from context. The duty sits with the provider who built the system. If you use a vendor chatbot on your website, the vendor must build the disclosure in, but you are the one facing your customers: confirm the notice is visible before or at the first interaction. A line such as “You are chatting with our AI assistant” is enough.

Do You Have to Label AI-Generated Content?

This is the AI content disclosure question businesses ask most, and the one most frequently answered wrongly. The rules distinguish between an invisible, machine-readable marking that the provider of a generative tool must embed, and a visible disclosure that the deployer, the business publishing the content, must add in specific cases only.

Two points to remember. First, intention does not matter: a realistic image must be labelled even if nobody meant to deceive. Second, the upstream watermark embedded by the AI tool does not discharge your own labelling duty; the disclosure must be perceivable by a person without any technical tool.

AI Act Compliance in Practice: Five Common Scenarios

High-Risk AI Systems: Postponed, Not Cancelled

If your company provides or deploys AI in one of the Annex III areas, a much heavier set of high-risk AI requirements applies from the postponed dates. Providers must run a risk-management system, keep technical documentation and logs, design for human oversight and pass a conformity assessment before the system goes on the market. Deployers must use the system as instructed, assign trained people to oversee it and retain logs.

Smaller companies get real relief: simplified technical documentation for SMEs, start-ups and the new “small mid-cap” category; simplified quality management for all SMEs; and fine caps at the lower of the fixed amount or the turnover percentage. There is also an exclusion: a system in an Annex III area is not high-risk if it only performs a narrow procedural or preparatory task and does not materially influence decisions. Two caveats apply. Any system that profiles natural persons is always high-risk, and a provider relying on the exclusion must document its assessment and still register the system in the EU database.

Penalties, Enforcement and the GDPR Overlap

Enforcement is shared. The European AI Office supervises providers of general-purpose AI models; each member state designates a market surveillance authority for AI systems; data-protection authorities continue to supervise personal data used by AI. The Commission’s AI Act Service Desk answers questions from businesses in English.

Penalties for non-compliance are tiered: up to €35 million or 7% of worldwide annual turnover for prohibited practices; up to €15 million or 3% for most other duties, including transparency; and up to €7.5 million or 1% for supplying incorrect information to authorities. For large companies the higher of the two figures is the ceiling; for SMEs and start-ups, the lower.

The AI Act sits alongside the GDPR, not instead of it. The AI Act regulates the system and its use; the GDPR regulates the personal data flowing through it. A tool can be fully compliant with one and still breach the other. Where the AI Act requires a fundamental-rights impact assessment, it may draw on an existing data-protection impact assessment rather than duplicating it.

A Practical AI Compliance Checklist for Businesses

Good AI governance does not require a legal department. For most companies, these nine steps cover the current AI Act requirements and prepare the ground for the high-risk rules later:

• Inventory: list every AI tool in use, including features embedded in SaaS products and general-purpose models used by staff.
• Role: decide for each tool whether you are a provider, a deployer or both.
• Classification: check each tool against the prohibited list and the Annex III areas; write down the result.
• Chatbots: confirm every customer-facing AI assistant identifies itself.
• Content: apply the labelling table above to what you publish.
• Literacy: adopt an AI-use policy and keep training records.
• Data protection: align AI use with your existing GDPR documentation.
• EU presence: if you are outside the EU and provide a high-risk system or a general-purpose model, appoint an authorised representative.
• Roadmap: if anything is high-risk, plan for the postponed dates rather than wait for them.

AI Act Compliance and EU Company Set-Up with Eesti Firma

The Artificial Intelligence Act rewards businesses that build compliance in from the start, and for companies outside the Union it makes an EU presence a practical necessity. Eesti Firma supports AI-driven businesses at both ends: establishing an EU entity through fully digital company formation in Estonia, including formation through e-Residency for founders who never need to visit Estonia, and helping the company meet its obligations once it operates in the EU market.

Our lawyers prepare legal opinions on whether a specific AI system falls within scope and which role and risk level it triggers, and our legal services team drafts the AI-use policies and disclosures a company needs to evidence AI literacy, transparency and data-protection compliance.

Get a legal opinion on your AI system

Frequently Asked Questions