The AI Act for small and medium-sized businesses – what do you actually need to do?
Short answer
A small business that uses AI needs to do five things: write down how it uses AI, give staff AI literacy, avoid prohibited AI, tell people when a chatbot is AI, and – if AI is used for things like recruitment – make sure a human decides and that this is documented. GDPR applies alongside. SMEs get lower fine caps and support from the authorities, but no exemption.
What to do now
Most small businesses use AI for writing, summaries, translation and customer service. That is minimal or limited risk, and the requirements are manageable: AI literacy, no prohibited uses and a notice on your chatbot.
What can wait – but not for long
If you use AI to sort job applicants or for HR decisions, the high-risk requirements apply from 2 December 2027. GDPR's requirement for a human decision already applies.
What is easier for SMEs
- Lower fine caps: the lower of the fixed amount and the percentage.
- Simpler technical documentation for SMEs that develop high-risk AI themselves.
- Priority access to regulatory sandboxes.
- The Commission and the Member States must support SMEs with guidance on AI literacy.
What it looks like day to day
With GoalCube, low-risk uses are approved automatically under fixed rules. Anything that needs a human lands on a single list – typically around 5 minutes a week.
What to do
- Create an AI register.Which tools, for what, which data and what risk.
- Adopt an AI policy.What is allowed, what isn't, and who to ask.
- Give everyone a short course.And keep a record of who has completed it.
- Protect personal data.A business subscription, a data processing agreement and no names in the AI when you can avoid it.
- Let people decide matters about people.And document it.
What the law says
- Articles 4 and 5 AI Act
- AI literacy and the bans apply to everyone, whatever their size.
- Article 99(6) AI Act – SMEs and fines
- For SMEs, the lower of the fixed amount and the percentage applies.
- Commission Recommendation 2003/361/EC – the SME definition
- Fewer than 250 employees and turnover of up to €50 million or a balance sheet total of up to €43 million.
Questions and answers
How long does it take?
For a business with simple AI use: a few hours for the register, policy and course. GoalCube AI Map is built for exactly that, and it is free.
Do we need an AI officer?
The law doesn't require one, but someone has to be responsible. Put it in your policy.
What if we don't use AI?
Ask your staff. Many people use AI without management knowing – this is called shadow AI.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.