The EU AI Act
for small businesses.

The AI Act sets different duties for different roles. Two matter for small businesses. The definitions are in Article 3, which we read on 4 November 2026.

• Deployer: a business that uses an AI system for its work. A shop using an AI writing assistant to draft emails is a deployer.
• Provider: a business that builds an AI system, or has one built, and puts it into use under its own name.

A business that only uses ready-made AI tools is a deployer. But there is a catch. If you pay someone to build a chatbot and run it under your brand, you can count as the provider. That brings extra duties, so ask your supplier how they handle them.

1. Build AI literacy. AI literacy means knowing what AI can and cannot do. Article 4, as changed by the Omnibus, says providers and deployers shall “take measures to support the development of AI literacy” of their staff. It sets no exam and no set level. A short briefing and a written AI policy are a sensible start.

2. Avoid the banned uses. Article 5 bans a short list of practices. Examples are AI that manipulates people, social scoring and emotion recognition at work. Few small businesses come close, but check before you try something new.

3. Be open about AI. Article 50 applies from 2 August 2026. People must be told when they talk to an AI system, unless it is obvious. That duty sits with the provider. Deployers must label deepfakes, which are AI images, audio or video that look real. AI text that informs the public on matters of public interest must be labelled too, unless a person reviews it and takes responsibility.

4. Keep following GDPR. GDPR is the EU law on personal data. The AI Act does not replace it. If your AI handles customer data, the usual rules still apply. In Malta, the regulator is the IDPC.

Want an AI assistant that says it is AI and hands over to a person? Apply now for AI automation ↗

High-risk AI has the strictest rules. For a small business, it usually means AI that helps make decisions about people. Examples are sorting job applications, managing or rating staff, credit scoring and deciding who gets essential services.

The Omnibus moved these rules to 2 December 2027. That gives you time, but not forever. If you plan AI for hiring or staff, choose a supplier that already explains how it will meet the rules. Using AI to draft a job advert is not the same as using AI to rank applicants.

A short list of where you use AI is the easiest first step. It helps you train staff, answer customers and talk to the regulator if asked. Copy these columns into a spreadsheet:

1. Tool: for example, an AI writing assistant, a booking-tool AI feature or a website chatbot.
2. Who uses it: a team or a role.
3. What for: one line, such as “first drafts of customer replies”.
4. Your role: deployer or provider.
5. Personal data? Yes or no, and what kind.
6. Who checks the output: the person who reviews it before it goes out.
7. Do people know it is AI? Where you tell them.
8. Last reviewed: a date. Check again every six months.

Then write a one-page AI policy. Say which tools staff may use, what data must never go in and who checks AI output. Brief new staff on it.

Our WhatsApp chatbot page has a scripted demo for a made-up restaurant called Demo Kitchen. Its first message reads: “Hi! I’m the automated assistant for Demo Kitchen, a made-up restaurant. I’m AI, and a person can take over at any time.”

That one line does two jobs. It tells people they are talking to AI. It also tells them how to reach a person. Every option menu in the demo includes “Talk to a person”.

It is a demo, not a client result. It runs in your browser, is not connected to WhatsApp and books nothing.

See it for yourself. Try the scripted demo ↗