The EU AI Act: what a smaller business actually needs to do

The Act classifies by risk, not by company size. The large majority of what a small or medium business deploys — drafting assistants, service triage, catalogue generation — falls into the limited-risk band, where the obligations centre on transparency: people should know when they are interacting with a machine, and synthetic content should be identifiable.

That is not an excuse to skip the paperwork. Maintain an inventory of where AI is in use, what data it touches, which vendor processes it and where. Record the human review step for anything that affects a customer or an employee.

Higher-risk categories — recruitment screening, credit decisions, aspects of healthcare — carry substantially heavier duties. If a proposed use-case touches those areas, the governance work belongs before the procurement, not after.

In practice a proportionate register, a short internal policy and a named owner satisfy most of what an SME will be asked to demonstrate.