1. The one-sentence summary
The AI Act is mandatory, but for most self-employed professionals and small businesses it is not about buying an expensive tool or setting up an ISO: it is about using AI with control, transparency, data protection and minimum evidence.
If you use ChatGPT, Copilot, Gemini, Claude, a web chatbot, a CRM with smart features, an image generator or invoicing software with AI, you are already using AI in your professional activity. You will normally be a professional user of AI, what the Regulation calls a deployer.
The practical idea: know which AI you use, what you use it for, what data you enter, who reviews the results, when you must inform the client and which uses must not happen.
2. Key dates every small business must know
You do not need to memorise the whole Regulation, but you do need these dates. They mark when each major block becomes enforceable.
Legislative status: the Digital Omnibus has been adopted and signed, but the official procedure file still shows it as awaiting publication in the Official Journal. These are the dates in the final act and they will take legal effect on the third day after publication.
3. Risk traffic light: green, yellow or red
For a small business, the useful question is not “do I use AI?”, but what role that AI plays. Helping you draft a text is not the same as deciding about a person.
Normal use
Drafting emails, quotes, posts, summaries or translations, provided a person reviews the result and no personal or confidential data is entered without control.
Transparency and GDPR
Chatbots, automated customer service, invoice reading, marketing with AI-generated images or texts. Here you must give notice when required, review providers and take care of the data.
Specific analysis
Screening candidates, evaluating workers, scoring creditworthiness, deciding on credit, insurance, biometrics, facial recognition, emotions or significant decisions about people.
4. The delicate point is usually the GDPR
In many cases the problem will not be the “pure” AI Act, but entering data about clients, workers or suppliers into an AI tool without reviewing what the provider does with that information.
Do not enter into an AI any information you would not comfortably send to an external provider without a contract, without guarantees and without knowing where it is processed.
Before using AI with personal data, review at least: what data you enter, whether it is necessary, whether you can anonymise it, whether the provider keeps or uses data for training, where it is processed, what security applies, whether there is a data processing agreement and whether you can delete the information.
5. The minimum package: 7 steps to start well
For normal uses, a small business can start with something proportionate and documented. This does not replace a specific analysis, but it leaves the house in much better order.
List which AI tools the business uses and what for.
Flag which ones process personal, confidential or sensitive data.
Define what can be done, what cannot and who reviews.
Explain to the team errors, limits, GDPR and prohibited uses.
Do not send contracts, invoices or important replies without reading them.
Give notice if the client is talking to a chatbot or sees synthetic content that could be misleading.
Keep the inventory, policy, training, providers, notice texts and annual review.
6. Quick checklist before you keep using AI
| Question | Yes/No |
|---|---|
| Do I know exactly which AI tools my business uses? | |
| Do I know what data is entered into each one? | |
| Have I given minimum training to the people who use them? | |
| Do we review the results before using them with clients? | |
| Do we give notice when a client is talking to a chatbot? | |
| Have I ruled out prohibited or high-risk uses without analysis? | |
| Do I keep evidence of the inventory, policy and review? |
If several answers are “no”, the priority is not to stop using AI: it is to put its use in order before a claim, an audit, a big client or an incident arrives.
Frequently asked questions
Is the AI Act already mandatory for SMEs and the self-employed?
Yes. The European AI Regulation is in force and obligations such as AI literacy and prohibited practices have applied since 2 February 2025. Article 50 transparency obligations apply from 2 August 2026. The final Digital Omnibus act, adopted and signed but awaiting publication in the Official Journal, sets 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Annex I high-risk systems embedded in regulated products.
Does using ChatGPT or Copilot require a large implementation?
Normally not. For uses such as drafting emails, quotes, documents or posts, the reasonable approach is to have a tool inventory, an internal policy, control over personal data, basic training, human review and evidence.
What is the most common risk for small businesses?
The most delicate point is usually the GDPR: entering data about clients, workers or suppliers into AI tools without reviewing the provider, retention, security, transfers or the data processing agreement where applicable.
When should I stop and analyse before using AI?
When AI takes part in decisions about people: recruitment, worker evaluation, creditworthiness, credit, life or health insurance, biometrics, facial recognition, emotions or similar significant decisions.
Official sources reviewed
- Council of the EU: final Digital Omnibus on AI act (PE-CONS 30/26)
- European Parliament: procedure 2025/0359(COD) and publication status
- Council of the EU: final adoption and application dates
- European Commission: Article 50 transparency guidelines (20 July 2026)
- AI Act Service Desk: Timeline for the Implementation of the EU AI Act
- AI Act Service Desk: Article 3, Definitions
- AI Act Service Desk: Article 4, AI literacy
- AI Act Service Desk: Article 5, Prohibited AI practices
- AI Act Service Desk: Annex III, High-risk AI systems
- AI Act Service Desk: Article 50, Transparency obligations
- AEPD: Seguridad de los tratamientos
The AI Act can be organised without oversizing the project.
If your business already uses AI and you want to know what to review first, I can help turn it into a simple system: inventory, data, risks, providers, training and evidence.
