The EU AI Act: What It Means for Your AI Projects

In short: The EU AI Act is Europe's AI regulation, and it governs AI systems according to their risk. For most SME use cases such as chatbots, writing assistants or document processing, the main obligations are transparency and making sure staff are trained to use AI. Strict requirements apply to high-risk systems, for example in recruitment, credit scoring or critical infrastructure. What matters is that you list your AI applications, assign each to a risk category and know whether you act as provider or deployer.

What the EU AI Act covers

Regulation (EU) 2024/1689 entered into force in August 2024 and applies directly in all member states without a national law having to transpose it. It covers anyone who develops, offers or uses AI systems in the EU, including companies outside the EU whose systems are used here.

The approach is risk-based. The greater the potential impact on health, safety or fundamental rights, the stricter the rules. A spam filter is treated differently from a system that pre-screens job applications.

The four risk categories

Prohibited practices

Certain uses have been banned since February 2025. They include social scoring, manipulative techniques that exploit people's vulnerabilities, emotion recognition in workplaces and schools, and untargeted scraping of facial images to build databases. These rarely touch ordinary business software, but a quick check still belongs in your review.

High-risk systems

This covers AI in sensitive areas: recruitment and performance evaluation, access to education, creditworthiness checks, critical infrastructure, and AI used as a safety component in regulated products like machinery or medical devices. Providers of such systems need risk management, technical documentation, high data quality, logging, human oversight and a conformity assessment. These obligations phase in over time, and the EU has proposed pushing back some deadlines, so check the current status before starting a high-risk project.

Limited risk with transparency duties

Many typical SME applications land here. People talking to a chatbot must be able to tell that they are dealing with an AI. AI-generated or manipulated images, video and audio (deepfakes) must be disclosed as such, and synthetic content must be marked in a machine-readable way.

Minimal risk

Spam filters, shop recommendations, internal text summaries and translation aids carry no specific obligations under the regulation. GDPR and other laws still apply, of course.

Provider or deployer: which role do you have?

The AI Act distinguishes providers, who develop an AI system and place it on the market under their own name, from deployers, who use a system under their own authority. Most obligations sit with the provider. If you use an off-the-shelf tool, you are usually a deployer. If you commission your own AI application and offer it to customers, you become a provider yourself.

Since August 2025, the makers of general-purpose AI models such as large language models have their own obligations, for example on documentation and copyright. If you integrate such a model through an API, that helps you, because the model provider has to supply information downstream. Our post on LLM integration for enterprise shows what a clean integration looks like.

What SMEs should do now

Start with an inventory. Which AI systems are in use, from the website chatbot to the applicant tracking tool? Assign each to a risk category and record your role.

Since February 2025 there has also been an AI literacy obligation. Companies must ensure that staff working with AI systems have sufficient knowledge of them. A documented training session on how your tools work, where they fail and what the risks are is a good start.

For new projects, build transparency and traceability into the design. A production AI chatbot should identify itself as AI, log its answers and be able to hand over to a human. Many of these measures overlap with what GDPR already requires, as our guide to GDPR-compliant software development explains.

Frequently asked questions (FAQ)

Does the EU AI Act apply to small businesses?

Yes, it applies regardless of company size. It does include relief for SMEs and startups, such as simplified documentation and priority access to regulatory sandboxes. In practice, most SMEs are mainly affected by the transparency duties and the training obligation.

Can we still use ChatGPT at work under the AI Act?

Yes. Using a language model for writing, research or summaries usually falls under minimal or limited risk. What matters is trained staff, clear rules on confidential data and transparency when customers interact with an AI directly.

Who enforces the AI Act in Germany?

Each member state designates national supervisory authorities. Germany plans to make the Federal Network Agency (Bundesnetzagentur) the central authority, with sector regulators keeping responsibility in some areas. Violations can lead to substantial fines.

Do I need to change existing AI applications?

That depends on the risk category. Chatbots need a clear notice that an AI is answering, and generated media needs labelling. If an existing system falls into the high-risk category, a thorough review with legal advice makes sense.

Conclusion

For most mid-sized companies the EU AI Act is manageable: keep an inventory, train your staff, build in transparency. It only gets demanding in high-risk areas, and there it pays to plan documentation and human oversight from day one instead of retrofitting them. This article is not legal advice.

If you are planning an AI application that should be compliant by design, talk to us about AI & automation.