AI
The EU AI Act: a practical checklist for SMEs
The EU AI Act for an SME that uses or builds AI: risk categories, roles, transparency duties, AI inventory and governance. A concrete, step-by-step checklist.
- Published
- Updated
- Reading time
- 7 min read
The EU AI Act does not ask an SME to become a law firm. It asks it to know which AI it uses, for what, and at what level of risk. Most companies will find their uses lightly regulated: a writing assistant, search over internal documents, meeting summaries. A few uses, however, fall into the "high-risk" category without anyone noticing, often in HR. This checklist helps you sort them, in order, without spending months on it.
This article offers practical guidance and is not legal advice: for a specific case, consult a specialised lawyer.
The AI Act in a few lines
The EU regulation on artificial intelligence entered into force in 2024. It applies directly in every member state, with no national transposition. Its obligations apply in stages: since 2025, the prohibited practices and the AI literacy obligation apply, as do the rules for providers of general-purpose AI models. Further obligations follow, notably for high-risk systems, and their timetable is the subject of adjustment discussions at EU level. Check where the calendar stands when you read this.
The logic is risk-based: the more a use can harm people, the stronger the requirements.
The four risk levels
- Unacceptable risk: prohibited. Social scoring, manipulative techniques that exploit vulnerabilities, emotion recognition in the workplace or in schools (except for medical or safety reasons), building facial recognition databases by scraping images, biometric categorisation that infers sensitive data.
- High risk: allowed, but tightly regulated. Hiring and managing employees, education and grading, access to credit and certain insurance, critical infrastructure, biometrics, and safety components of products that are already regulated.
- Limited risk: transparency duties. Chatbots, AI-generated or AI-altered content, deepfakes.
- Minimal risk: no specific obligation. Spam filters, recommendations, internal writing assistants, the vast majority of everyday uses.
Your role: deployer or provider
The regulation mainly distinguishes two roles, and obligations follow from them.
- Deployer: you use an AI system in your business. An SME using Claude, an OpenAI model or Mistral, or business software with built-in AI, is a deployer.
- Provider: you develop an AI system and place it on the market under your name, including built into your own product. A software company adding an AI agent to its SaaS becomes the provider of that system.
Watch for role changes: putting your brand on a system, substantially modifying it or using it for a high-risk purpose it was not intended for can make you a provider. Providers of general-purpose models (Anthropic, OpenAI, Mistral) have their own obligations; using them through an API does not transfer those to you.
The checklist
| Step | Question to ask | What you produce |
|---|---|---|
| 1. Inventory | Which AI tools and features do we use, including those built into our software? | A register: tool, use, team, data processed |
| 2. Classification | Is each use prohibited, high-risk, subject to transparency, or minimal? | A justified risk level for each register entry |
| 3. Role | Are we deployer or provider for each use? | The role recorded in the register |
| 4. Prohibited practices | Does any use touch the list of prohibitions? | Immediate stop of that use |
| 5. Transparency | Do customers know they are dealing with AI? Is generated content labelled? | Notices in interfaces, publishing rules |
| 6. AI literacy | Do our teams know how to use these tools and their limits? | Role-based training, records of what was done |
| 7. High risk | For each high-risk use, do we have human oversight, logs and information for affected people? | One file per system, a named owner |
| 8. Vendors | Do our AI vendors give us the documentation and guarantees we need? | Contract clauses, archived documentation |
| 9. Review | Who updates the register when a new tool arrives? | An owner and a periodic review |
The points that deserve attention
The AI literacy obligation
It is the broadest obligation, and it already applies. Providers and deployers must take measures so that the people using AI on their behalf have a sufficient level of AI literacy, suited to their role and context. In practice: knowing what the tool does well, where it gets things wrong (hallucinations, bias), which data should never be pasted into it, and when to have output reviewed. Hands-on, documented training meets this requirement far better than a policy nobody reads.
Transparency towards your customers
If a customer interacts with a chatbot or an agent, they must be told, unless it is obvious. AI-generated content must be identifiable as such, and deepfakes disclosed. For a website or an app, that means a clear notice in the interface, not a line buried in the terms and conditions.
Human resources
This is where SMEs most often slip into high risk without realising it: a tool that screens CVs, ranks candidates, evaluates performance or monitors employee activity. As the deployer of such a system, you must notably use it according to its instructions, assign oversight to competent people, monitor how it works, keep its logs, and inform employees and their representatives before putting it into service.
If you build AI
A software company that adds an agent or a copilot to its product must first classify that use. For a limited-risk use, the core of the work is transparency. For a high-risk use, the requirements are those of a regulated product: risk management, data quality, technical documentation, logging, human oversight, robustness and cybersecurity, conformity assessment. Better to know that before writing the first line of code.
Governance, at SME scale
You do not need a committee. You need a living register, a named owner, a simple rule for new tools (register and classify before use), and a regular review. Security good practice applies too: the OWASP Top 10 for LLM applications lists risks such as prompt injection and data leakage, and GDPR still applies to every processing of personal data.
The regulation also provides support measures for SMEs, including regulatory sandboxes and simplified documentation. They lighten the load; they do not waive the obligations.
In short
Take inventory, classify each use, identify your role. Stop any prohibited use, make customer-facing AI visible and train your teams. Save the heavy effort for the few high-risk uses, especially in HR. A well-organised SME covers the essentials in a few weeks, and comes out with a clear view of how it uses AI, which is worth a lot beyond compliance.
Frequently asked questions
Does the AI Act apply to an SME that only uses ChatGPT, Claude or Mistral?
Yes, but lightly in most cases. You are a deployer: the AI literacy obligation for your staff already applies, and transparency duties apply if you expose AI to your customers or publish generated content. The heavy obligations only target high-risk uses.
Which business uses of AI count as high-risk?
The most common ones in SMEs concern employment (CV screening, evaluating or monitoring employees) and access to essential services (creditworthiness assessment, pricing of certain insurance). The list sits in Annex III of the regulation, alongside safety components of regulated products such as medical devices.
Is GDPR compliance enough for the AI Act?
No. The two texts apply side by side. GDPR governs the processing of personal data; the AI Act governs AI systems according to their risk level. The same project often has to meet both, and a GDPR impact assessment can feed the AI Act work.
An AI use case in mind? A product to launch?
Describe the situation in a few lines. Within two business days you get a straight answer: what we would do, in which order, and whether we are the right team for it.