Fines up to €35 million or 7% of global annual turnover. Most SMBs are "deployers" with lighter obligations than developers — but lighter isn't zero. You have 10 weeks to get ready.
12 questions · 5 minutes · Instant compliance score
The EU AI Act uses a tiered risk system. 85% of AI falls into "minimal risk" — but if your systems touch hiring, credit, or healthcare, you're in high-risk territory with full compliance obligations.
These systems were banned February 2, 2025. If you're using them, stop immediately — enforcement is already active.
Systems that make or influence decisions in sensitive domains. Full documentation, risk assessment, conformity assessment, and EU database registration required.
Systems that interact with users or generate content. You must clearly disclose that users are talking to AI or that content is AI-generated.
The vast majority of AI tools fall here. No specific AI Act obligations beyond documenting that your staff understands how AI works and its limitations.
Work through these questions for each AI system you use. The first "yes" determines your compliance obligation — stop there.
Does it perform real-time biometric ID in public spaces, social scoring, subliminal manipulation of vulnerable people, or emotion recognition in a workplace context?
Yes → Stop using it. Prohibited since Feb 2, 2025.Does the system touch hiring, credit, education, healthcare, housing, law enforcement, insurance, or access to essential services?
Yes → High-risk. Full compliance required by Aug 2, 2026.Does the system interact with users as if it were human, or produce AI-generated images, text, audio, or video for public consumption?
Yes → Limited-risk. Transparency disclosure required.Sales tools, spam filters, recommendation engines, internal productivity AI, scheduling tools — anything that doesn't touch a sensitive domain or interact with users as AI.
Minimal-risk. AI literacy training for staff — that's it.A quick-reference table for the most common AI tools SMBs use and their EU AI Act classification. Don't over-classify — that wastes months on documentation you don't need.
| AI System | Classification | What You Need |
|---|---|---|
| Hiring/recruitment AI (CV screening, candidate ranking) | High-Risk | Full compliance: risk assessment, documentation, human oversight, conformity assessment, EU database registration |
| Employee performance monitoring / scheduling AI | High-Risk | Full compliance required — affects employment decisions |
| Credit / lending decision AI | High-Risk | Full compliance required |
| Customer service chatbot | Limited-Risk | Disclose that users are talking to AI at the start of the conversation |
| AI-generated marketing content | Limited-Risk | Label as "AI-generated" (machine-readable format required by Dec 2026) |
| Sales pipeline AI (lead scoring, opportunity ranking) | Minimal-Risk | AI literacy training for staff using the tool |
| Email spam filter | Minimal-Risk | AI literacy training only |
| Recommendation engine (products, content) | Minimal-Risk | AI literacy training only |
| Internal document summarization / AI copilot | Minimal-Risk | AI literacy training only |
| Pricing AI (dynamic pricing, cost calculation) | Minimal-Risk | AI literacy training; non-discrimination monitoring advised as best practice |
The AI Act has a phased rollout. Here's what matters for a typical SMB using (not building) AI systems.
Social scoring, real-time biometric surveillance, and subliminal manipulation systems were banned. Enforcement is active.
List every AI tool in use, classify each by risk tier. Most SMBs discover 10+ tools including embedded AI in existing software. Don't over-classify.
Article 4 requires documented proof that all staff using AI understand how it works, its limitations, and accountability. FUNDAE or EU Digital Academy certification counts — self-study does not.
Full compliance required for high-risk systems: documented risk management policy, technical documentation, human oversight mechanisms, conformity assessment complete, and EU database registration.
Machine-readable labels required on AI-generated images, audio, and video. Marketing and content teams need a labeling workflow in place.
If your AI tools are minimal-risk (most are), your compliance footprint is small. Here's what each tier actually requires from an SMB deployer.
The free 5-minute assessment identifies which of your AI systems are high-risk, what compliance gaps you have, and exactly what to fix before August 2.
Free assessment · Compliance Action Plan $299 · No subscription