Does the AI Act apply to my small business? What to do, and from when

Yes, almost certainly. If anyone in your business uses artificial intelligence tools for work, under the AI Act you are a “deployer”, meaning a professional user. Since 2 February 2025 you have had to train the people who use AI and you may not use it in prohibited ways; since 2 August 2026 anyone who talks to a chatbot or sees realistic AI-generated content must be able to know it. The heaviest obligations, those for “high-risk” systems such as recruitment tools, have been postponed to 2 December 2027 by Regulation (EU) 2026/1744, in force since 27 July 2026.

Who the AI Act applies to, and which role you have

The AI Act, Regulation (EU) 2024/1689, sets out two main roles. The provider develops an AI system, or has one developed, and puts it into service under its own name or trademark. The deployer uses it in the course of its professional activity.

A 12-person business that sells spare parts and uses AI to write emails, transcribe meetings and create images for social media is a deployer. It can become a provider if it has a system built and puts it into service under its own brand, for example an assistant on its website that answers customers in the company’s name.

The obligations grow with the risk: some uses are prohibited, others are high-risk, and chatbots and generated content carry transparency obligations. For most uses in a small or medium-sized business (SME), what is left is mainly training.

The dates: what already applies and what is coming

The timetable is in Article 113 of the AI Act, amended in 2026 by Regulation (EU) 2026/1744.

What the “Digital Omnibus” changed, and what it did not

On 19 November 2025 the European Commission proposed a simplification package called the “Digital Omnibus”, in two parts. The AI part became Regulation (EU) 2026/1744: approved by the European Parliament on 16 June 2026 and by the Council on 29 June, published in the Official Journal of the European Union on 24 July, and in force since 27 July 2026. For an SME, this is what changes:

• High-risk postponed: to 2 December 2027 for Annex III uses, and to 2 August 2028 for Annex I products.
• Training rewritten, not removed: the new Article 4 still asks providers and deployers to take measures to develop their staff’s AI literacy, but without having to guarantee a specific level. The Commission and the Member States must help SMEs in particular, including with practical examples.
• New prohibitions from 2 December 2026 for systems that generate intimate images of identifiable people without their consent, or child sexual abuse material.

The transparency date, 2 August 2026, does not change, and neither do the prohibitions already in force. On penalties, for SMEs the maximum is the lower of the fixed amount and the percentage of turnover (Art. 99). The second part of the package, which would also affect the GDPR, is still a proposal: for personal data, the current rules apply.

The Italian rules: Law 132/2025 and the decrees

Law no. 132 of 23 September 2025, in force since 10 October 2025, adds national rules alongside the AI Act. For a business, three points matter.

• Employment (Art. 11): employers must inform workers about the use of AI, in the cases and in the ways set out for automated systems by Article 1-bis of Legislative Decree 152/1997.
• Intellectual professions (Art. 13): accountants, lawyers, engineers and consultants may use AI only for instrumental and support activities, with their own intellectual work prevailing, and must tell the client which systems they use, in clear, simple and comprehensive language.
• Deepfakes (Art. 26): spreading images, videos or voices falsified with AI without consent, where this causes unjust harm, is a criminal offence.

The national AI authorities are AgID (the Agency for Digital Italy) and the National Cybersecurity Agency (ACN).

Legislative Decree no. 160 of 9 September 2026 is in force from 30 September 2026. Among other things, it helps people claiming compensation for harm caused by AI: the court can order logs and documentation to be disclosed, and if the harm results from a breach of an AI Act obligation, the causal link is presumed. Keeping track of how you use AI also helps you defend yourself.

A second decree, on authorities, penalties, training and employment, was given final approval by the Council of Ministers on 4 August 2026, but as of 24 September 2026 it had not yet been published in the Official Gazette (Gazzetta Ufficiale), so it was not in force: check its current status before you decide. The Government’s press release announces that hiring, changes to the employment relationship, disciplinary measures and dismissals may not be decided solely through automated processing.

What to do if you use AI: map, training, rules, transparency

For an SME that uses AI, there are four things to do.

1. Map how AI is used. Which AI tools, who uses them, for what, and with which data. Include the AI already built into your business software, CRM, phone system and payroll software.

2. Train your people (Art. 4). You do not need a certificate: the European Commission has made this clear. You need training suited to each role: someone who writes texts with AI must know it can invent facts; someone who uses it with customer data must know what not to put in. Keep an internal record of who did which training, and when.

3. Write internal rules of use. One or two pages are enough: approved tools, data that must not be entered (for example health data or clients' confidential documents), and a check by a person before anything is sent outside the business. A usage policy and training are also part of our AI and automation service.

4. Be transparent with customers (Art. 50, from 2 August 2026). Anyone writing to the chatbot on your website must know they are talking to an AI, unless it is obvious. Images, audio and video generated or altered with AI that look real, the “deep fakes”, must be disclosed: this can include the photo of a flat furnished with AI. The same applies to texts published to inform the public on matters of public interest, unless a person has reviewed them and takes responsibility for them.

High-risk: take care with recruitment

For an SME, the most likely high-risk case concerns staff. Annex III lists systems used to place targeted job adverts, filter applications and evaluate candidates, as well as those that decide on promotions, terminations or task allocation, or that assess performance. The same list includes assessing the creditworthiness of individuals.

From 2 December 2027, anyone using these systems will have to follow the provider’s instructions, assign oversight to people who are trained and have the authority to step in, keep the logs for at least six months, inform workers and their representatives before putting them into use, and tell people when a decision about them goes through the system (Art. 26).

Some rules already apply: using AI to infer people’s emotions at work is prohibited, except for medical or safety reasons, and Law 132/2025 requires you to inform workers. If you are looking at software that “reads” CVs, ask the questions now, not in 2027.

Personal data and suppliers: what to check

The AI Act leaves the GDPR untouched: if you put names, email addresses, health data or payslips into a prompt, meaning your request to the AI, you are processing personal data and all the privacy rules apply. Update your privacy notices for customers and employees if AI enters the processes that concern them, and consider a DPIA, the data protection impact assessment. According to the Italian Data Protection Authority (Garante privacy), you need one when you use innovative technologies, AI included, together with at least one other risk criterion: evaluating or scoring people, systematic monitoring, or data about employees or vulnerable people. Filtering CVs with AI, for example, is a case that calls for a DPIA.

You can meet many of these obligations only if the supplier gives you the right information. Before adopting a tool, or when you renew, ask in writing:

• where the data is processed and stored, and whether it stays in the European Union;
• whether your data is used to train the models, and how to opt out;
• for the data processing agreement and the list of sub-processors;
• whether the system, as you will use it, is high-risk, and how it will comply by 2 December 2027;
• how the chatbot discloses that it is an AI, and how generated content is marked;
• which activity logs you can consult, and who to call if something goes wrong.

For help choosing who to work with, there is a checklist in the guide on how to choose a digital partner.

What to do this month

1. Draw up the map: AI tools in use, people, purposes, data.
2. Check that none of your uses is among the prohibited ones.
3. Organise short training for each role and note who attended.
4. Write your internal rules of use and share them.
5. Check the chatbots, images and videos you publish: where needed, state that they were made with AI.
6. If you use tools to select or assess staff, treat them as potentially high-risk and consider a DPIA.
7. Inform workers about the AI tools that affect them.
8. If you are a professional, prepare the sentence you will use to inform your clients.
9. Send your suppliers the questions above.

This guide explains the general rules and is not a substitute for advice on your case: your role, tools and data change the answer, so check your situation with an adviser. If you want to start with the map, that is exactly what we do in the initial assessment. And if you are thinking about systems that act on their own inside your software, read what AI agents really do.