The EU AI Act for SMEs: What to Know Before Adding AI to Your Product

Adding AI to a product is easier than ever. A chatbot, a smart search box or an AI writing assistant can often be built on top of an existing model in weeks. But if your customers or users are in the European Union, there is now a law that governs how AI systems are built and used: the EU AI Act.

The good news for most small and medium-sized businesses is that the EU AI Act is risk-based. A customer service chatbot or a product recommendation feature is treated very differently from AI that screens job applicants or assesses creditworthiness. This guide explains how the EU AI Act affects SMEs, which obligations apply to common AI features, the key dates, and the practical steps to take before you launch.

This article is general information, not legal advice.

What is the EU AI Act?

The EU AI Act is Regulation (EU) 2024/1689, published in the Official Journal and available on EUR-Lex. It entered into force on 1 August 2024, with obligations phasing in over several years.

Like GDPR, it reaches beyond Europe. A company in Dubai, Beirut or New York that places an AI system on the EU market, or whose AI system's output is used in the EU, can fall within its scope.

Are you a provider or a deployer?

Most obligations fall on providers: organizations that develop an AI system, or have one developed, and place it on the market or put it into service under their own name. Deployers are organizations that use an AI system under their own authority in a professional context.

• If you use an off-the-shelf AI tool, such as an AI writing assistant or a chatbot platform, you are usually a deployer.
• If you build an AI feature into a product you offer under your brand, you may be the provider of that AI system, even if it runs on someone else's model.
• If you substantially modify a high-risk system or put your name on it, you can take on provider obligations.

When you work with a development partner, agree in writing who handles documentation, transparency labels, logging and incidents.

The four risk levels in plain English

The EU AI Act sorts AI uses into broad categories. Where your feature lands determines what you must do.

1. Prohibited practices. A short list of uses is banned outright, such as social scoring, manipulative techniques that cause significant harm, exploiting people's vulnerabilities, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces and schools (with narrow exceptions).
2. High-risk systems. AI used in sensitive areas listed in the Act, such as hiring and managing workers, education and exam scoring, access to essential services like credit and certain insurance, critical infrastructure, and some biometric uses, as well as AI that is a safety component of regulated products. These carry the heaviest obligations.
3. Transparency obligations. Systems that interact with people or generate content, such as chatbots and generative AI, must meet specific disclosure duties.
4. Minimal risk. Most other AI, like spam filters, recommendation engines and internal productivity tools, has no specific new obligations under the Act, although other laws such as GDPR still apply.

There are also separate rules for providers of general-purpose AI models, the large foundation models that many products are built on. If you use such a model through an API rather than training your own, those model-level obligations mostly sit with the model provider, not with you.

Key dates for the EU AI Act

The timeline has already changed once, so it is worth being precise:

• 2 February 2025: prohibited practices became banned, and the AI literacy provisions started to apply.
• 2 August 2025: obligations for providers of general-purpose AI models started to apply, along with governance and penalty provisions.
• 2 August 2026: most remaining provisions, including the Article 50 transparency obligations for chatbots and AI-generated content, started to apply.

In 2026, the EU adopted the "Digital Omnibus on AI", Regulation (EU) 2026/1744, which is available on EUR-Lex. It entered into force on 27 July 2026 and pushed back the high-risk deadlines:

• 2 December 2027: obligations for stand-alone high-risk systems listed in Annex III (such as employment, education and creditworthiness).
• 2 August 2028: obligations for high-risk AI embedded in products covered by EU product safety legislation (Annex I).

The Omnibus also gave providers of generative AI systems already on the market before 2 August 2026 until 2 December 2026 to comply with the machine-readable marking duty in Article 50(2). Rules can change again, so check the current status before relying on any date.

What this means for common SME AI features

Customer service chatbots

If you deploy a chatbot that talks to customers, people must be informed that they are interacting with an AI system, unless that is obvious from the context. In practice, a clear label in the chat window ("You are chatting with an AI assistant") and an easy route to a human are good practice. A chatbot that answers product questions or books appointments is usually not high-risk.

AI-generated text, images and audio

Providers of systems that generate synthetic content must mark outputs in a machine-readable way so they can be detected as AI-generated. Deployers who publish deepfakes must disclose that the content is artificially generated or manipulated, and there are disclosure rules for AI-generated text published to inform the public on matters of public interest, unless it has been human-reviewed and someone holds editorial responsibility.

Recommendations, smart search and internal tools

AI that recommends products, improves site search, summarizes documents or drafts emails for your team is generally minimal risk. You still need to respect GDPR when personal data is involved, and you should be transparent with users about how features work.

Hiring, credit and education

If your product screens CVs, ranks candidates, evaluates students or scores creditworthiness, it may be high-risk. That brings requirements such as risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, plus conformity assessment and registration. Even with the later deadlines, these take time to prepare, so start early and get specialist advice.

SME-friendly provisions and AI literacy

The Act recognizes that smaller companies have fewer resources. Measures include priority access to regulatory sandboxes and, for high-risk systems, simplified technical documentation for SMEs. Fines for SMEs and start-ups are capped at the lower of the percentage or the fixed amount set for each type of infringement.

The AI literacy duty in Article 4 was reworded by the Omnibus so that providers and deployers take measures to support AI literacy among staff who operate AI systems, without requiring a specific level for each person. Simple internal guidance and short training on the tools you use is a sensible way to meet the spirit of it.

A pre-launch checklist for AI features

1. Describe the feature in one sentence and identify which risk level it most likely falls into.
2. Confirm it does not involve any prohibited practice.
3. Decide whether you are the provider, the deployer, or both.
4. Add clear AI disclosure in chat interfaces and label AI-generated media where required.
5. Review personal data use under GDPR: lawful basis, privacy notice, vendor agreements and data transfers. Our GDPR website checklist is a good starting point.
6. Keep human oversight for decisions that significantly affect people.
7. Document your model provider, prompts, data sources, testing and known limitations.
8. Give staff basic training on how the tool works and where it can fail.
9. If the feature might be high-risk, get specialist legal advice before launch.

How HEXACODES can help

HEXACODES builds, enhances and integrates AI, from chatbots and smart search to workflow automation, and we design features with transparency and data protection in mind from the start. Learn more about our AI services, or read how we approach Arabic AI chatbots for customer service.

If you are planning an AI feature for EU users, contact us to discuss the technical design. For legal classification of higher-risk uses, we recommend working alongside a qualified lawyer.

Frequently asked questions

Does the EU AI Act apply to my small business?

It can, if you build or use AI systems and your users or customers are in the EU. There is no blanket exemption for SMEs, but most typical SME uses, such as chatbots, recommendations and internal productivity tools, carry light obligations or none beyond transparency. The heavier requirements apply to high-risk and prohibited uses.

Do I have to tell customers they are talking to an AI chatbot?

Yes, in most cases. The Article 50 transparency obligations require that people are informed when they interact with an AI system, unless it is obvious from the context. A clear label in the chat window is a simple way to do this.

When do the high-risk rules of the EU AI Act apply?

Following the Digital Omnibus on AI, obligations for stand-alone high-risk systems in Annex III apply from 2 December 2027, and those for AI in regulated products under Annex I from 2 August 2028. Dates have already changed once, so check the current status before planning around them.