The EU AI Act for small businesses: what you need to do
LAST UPDATED ·
A June 2025 study by the Dutch Chamber of Commerce found that half of business owners did not know the AI Act existed. Only 7% knew it well. This article is for the other 93%.
The AI Act in three sentences
The AI Act is EU Regulation 2024/1689. It sets rules for developing and using AI systems and was published in the Official Journal of the European Union. The greater an application’s risk to people, the stricter its rules. The regulation applies directly in the Netherlands without a separate Dutch law.
Four risk levels, and where most small-business uses fall
The AI Act classifies applications by risk. This is the table you need:
| Risk level | Example | What it means for you |
|---|---|---|
| Prohibited | Social scoring, manipulating vulnerable groups, and emotion recognition at work | Do not use it. This rule has applied since February 2, 2025. |
| High risk | AI that selects applicants, assesses creditworthiness, or evaluates employees | Strict requirements cover risk management, documentation, human oversight, and registration. Most apply to the supplier, but users have duties too. |
| Limited risk | Chatbots and AI-generated text or images shown to the public | Be transparent. Say that people are interacting with AI or seeing AI-generated content. |
| Minimal risk | Reading orders from PDFs, drafting emails, summarizing documents, and supporting planning | No specific requirements beyond the general AI literacy duty. |
Almost all process automation in a small business falls in the last row. An AI step that extracts order lines from a PDF does not decide anything about a person. Pay attention as soon as AI touches applicants, performance reviews, or credit decisions: that moves you into high risk.
What has applied since February 2, 2025
Two parts already apply:
- Prohibited practices (Article 5). These are not relevant to most businesses. They become relevant if you plan to measure employee emotions or score people by behavior. Do not do that.
- AI literacy (Article 4). Everyone using AI for your business needs enough knowledge to use it responsibly. That includes Copilot and ChatGPT. Our article on AI literacy under Article 4 explains what to do.
What applies from August 2026 and who enforces it
Most of the regulation applies from August 2, 2026. This includes rules for high-risk systems and transparency duties. In the Netherlands, the Dutch Data Protection Authority and the RDI are preparing joint oversight. The implementing act will define their responsibilities. Check autoriteitpersoonsgegevens.nl for the current position.
Do not expect an inspector at your door in the first month. Do expect a client, accountant, or insurer to ask which AI you use and how you manage it. You want a clear answer to that question.
Five things to do now
This is the order we use with clients. For a company with 30 employees, the work takes two to four half-days in total.
- Create an AI register. One list: which tools and automations do we use, for what, which data goes in, which risk level, and who is responsible. A SharePoint table is enough.
- Build AI literacy. Give everyone who uses AI short, role-specific training. Record attendance and course content.
- Ask suppliers the right questions. Ask where the model runs, whether your data trains it, whether a data processing agreement is available, and how the supplier classifies the product.
- Keep a human in the loop. Add an approval step to every automation that acts toward a client or employee. The law does not require it for minimal risk. It is still the best protection there is, and it looks good in your register.
- Put it on one page. An AI policy: what is allowed, what is not, who approves tools, and where people report an error.
What you do not need
- No conformity assessment or CE marking, unless you develop or sell a high-risk system yourself.
- No EU database registration for ordinary applications.
- No separate AI officer. One management team member can be responsible.
- No ban on ChatGPT. Set rules for permitted data and accounts instead.
- No AI literacy certificate. The law requires knowledge, not a diploma.
What this looks like in a process
Picture an automation as four blocks: Order by email → AI reads lines → Review screen → Order in ERP. The second block is a minimal-risk AI system. The third block, the review screen, is your human oversight. Your register describes all four blocks. The key: a person sits between the AI and the system that takes action.
Checklist
| Item | Done? |
|---|---|
| AI register with tools, purpose, data, risk level, and owner | [ ] |
| AI literacy training delivered and recorded | [ ] |
| Supplier answers about region, training, and a data processing agreement | [ ] |
| Approval step in every automation involving a client or employee | [ ] |
| One-page AI policy shared with the company | [ ] |
| Check: do we use AI in hiring, performance reviews, or credit decisions? If so, that is high risk and you need extra advice. | [ ] |
FAQ
FAQ
Does the AI Act apply if a business only uses ChatGPT or Copilot?
Yes. Anyone using AI systems must meet the AI literacy requirement in Article 4. This includes businesses that only use a chat tool. The stricter obligations only apply to high-risk uses.
Does a small business need to maintain an AI register?
The law does not require a register for ordinary uses. It is still the easiest way to show which AI you use, why you use it, and who is responsible.
Who enforces the AI Act in the Netherlands?
The Dutch Data Protection Authority (AP) and the Dutch Authority for Digital Infrastructure (RDI) are preparing joint oversight. Check autoriteitpersoonsgegevens.nl for the current position.
