AI Rules Small Businesses Should Know: EU AI Act and More
You do not have to build AI to be affected by AI rules. If you use a chatbot on your website, screen job applicants with software or publish AI-generated content, some regulations may already apply to you. Here is a plain-English map of the main rules and the practical steps that make sense for a small business today.
Key takeaways
- Most everyday AI uses, such as drafting emails or summarizing documents, face few specific AI rules, but general laws on privacy, consumer protection and discrimination still apply.
- The EU AI Act sorts AI by risk. A few practices are banned, high-risk uses such as hiring carry heavy duties, and many chatbots face transparency rules.
- In the US there is no single federal AI law. Existing laws, regulators and a changing mix of state and city rules apply.
- Dates and details keep shifting. Treat this as general information, not legal advice, and check current rules with an advisor.
A few years ago, "AI regulation" sounded like a problem for big technology companies. That has changed. Lawmakers have focused on how AI is used, not only on who builds it, so businesses that deploy AI tools can have obligations too. At the same time, rules differ widely between countries and are being revised as they take effect.
The good news for small businesses is that most rules target specific, higher-risk situations: decisions about people's jobs, credit, education or access to services, and content that could mislead. If your AI use is limited to internal writing and admin, your main duties come from laws you already know. This explainer covers the main frameworks, what they mean in practice and how to stay on the right side of them. For setting internal rules, see our separate article on writing an AI use policy.
The European Union: the AI Act
The EU Artificial Intelligence Act was adopted in 2024 and entered into force on 1 August 2024. It is the most comprehensive AI law so far, and it applies to businesses outside the EU when their AI systems or outputs are used in the EU. Its obligations phase in over several years rather than all at once.
The risk tiers
| Risk tier | Examples | What it means |
|---|---|---|
| Unacceptable risk | Social scoring, manipulative techniques that cause harm, some emotion recognition at work and in schools | Banned |
| High risk | AI in recruitment and employment decisions, credit scoring, education, essential services, some safety components | Strict duties on providers and deployers, such as risk management, human oversight, logging and transparency |
| Limited or transparency risk | Chatbots, AI-generated or manipulated content such as deepfakes | Tell people they are dealing with AI and label certain synthetic content |
| Minimal risk | Spam filters, writing helpers, most internal productivity uses | No specific new duties, though voluntary codes are encouraged |
The Act also has separate rules for providers of general-purpose AI models, the large models behind popular chat assistants. Those obligations fall mainly on the model developers, not on small businesses using their products.
The timeline, and why you should check it
Under the original schedule, the bans on prohibited practices and a duty to promote AI literacy among staff applied from February 2025, and rules for general-purpose AI models from August 2025. Most remaining obligations were due from August 2026. In 2026, EU lawmakers agreed a package of changes, often called the Digital Omnibus on AI, which according to law firm summaries pushes many high-risk obligations back to December 2027, and to August 2028 for AI built into regulated products. Because dates have already moved once, check the current official timeline before planning any compliance work.
What it means for a typical small business
Most small businesses are "deployers," meaning they use AI systems built by others. Practical duties for deployers can include making sure staff using AI have a sufficient level of AI literacy, telling people when they are talking to a chatbot rather than a human, labeling certain AI-generated content, and, if you use a high-risk system such as an AI hiring tool, following the provider's instructions, keeping human oversight and informing affected people.
Common mistake
Assuming the EU AI Act does not apply because your business is outside Europe. If you sell to EU customers, recruit EU-based staff or offer AI-powered services used in the EU, parts of the Act may apply to you. Check where your AI outputs are used, not only where you are based.
GDPR and automated decisions
Long before the AI Act, the EU's General Data Protection Regulation already covered many AI uses because AI tools often process personal data. Key points for small businesses:
- Article 22 gives people the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, such as automatic rejection of a job or credit application, with limited exceptions and safeguards.
- Transparency: you must tell people how their data is used, including meaningful information about automated decision-making where it applies.
- Data protection impact assessments may be required for high-risk processing, which can include some AI uses.
- Vendor terms: when you paste personal data into an AI tool, the provider may be processing it on your behalf, which requires appropriate agreements and safeguards.
The UK has its own version of the GDPR and has so far favored a principles-based approach to AI, relying on existing regulators rather than a single AI law. Check the latest guidance from the UK Information Commissioner's Office if you operate there.
The United States: existing laws plus a patchwork
The US does not have a single comprehensive federal AI law. Instead, small businesses face a mix of existing federal laws, regulator enforcement and state and local rules, and the policy direction has shifted with changes in administration.
Federal agencies and existing laws
The Federal Trade Commission has repeatedly stated that existing consumer protection law applies to AI, and in 2024 it announced enforcement actions against companies it said made deceptive AI claims. In practice, that means you should not exaggerate what your AI-powered product does, should not use AI to create fake reviews and should be truthful about how customer data is used. In employment, federal anti-discrimination laws apply to hiring decisions whether or not software is involved, even though the Equal Employment Opportunity Commission removed its earlier AI guidance documents in early 2025.
State and city rules
States and cities have moved faster. New York City's Local Law 144 requires bias audits and candidate notices for certain automated hiring tools. Illinois regulates AI analysis of video interviews. Colorado passed a broad AI law in 2024 and, according to law firm reports, replaced it in 2026 with a narrower law on automated decisions expected to apply from 2027. California and other states have adopted or proposed rules on automated decisions, AI transparency and deepfakes. Meanwhile, a December 2025 presidential executive order directed federal agencies to challenge state AI laws seen as burdensome, adding uncertainty. Our article on AI in hiring covers employment rules in more depth.
Other regions to watch
Many other countries are developing AI rules. China has issued rules on generative AI services and on labeling AI-generated content. Canada's proposed federal AI law did not pass before Parliament was dissolved in 2025, so existing privacy and consumer laws remain the main framework there. Countries including Brazil, South Korea and Japan have adopted or debated AI frameworks. If you sell into a specific market, a short check with a local advisor is worthwhile.
Practical steps for small businesses now
- Map your AI use. List every AI tool and feature you use, including those built into existing software, and what each is used for.
- Flag high-risk uses. Mark anything that makes or influences decisions about people's jobs, credit, housing, education, health or access to services.
- Be transparent. Tell customers when they are chatting with AI, label realistic synthetic images or video, and explain automated decisions where required.
- Protect personal data. Check tool settings and terms, avoid pasting sensitive data into unapproved tools and update your privacy notice.
- Keep humans in charge. Make sure a person reviews significant decisions about individuals.
- Train your team. Basic AI literacy, covering what tools can and cannot do and your internal rules, is both good practice and, in the EU, a legal expectation.
- Review twice a year. Rules and dates are changing quickly. Schedule a check with an advisor, especially before adopting a high-risk tool.
Pro tip
Ask every AI vendor which regulations their product is designed to support and what documentation they provide. Providers of high-risk systems in the EU have their own obligations, and good vendors will give you instructions, audit summaries and data terms that make your own compliance much easier.
Hypothetical example
Imagine an online furniture retailer based in Canada that sells across Europe and the US. It maps its AI use and finds three items: a website chatbot, AI-written product copy and a resume screening feature in its applicant tracking system. It adds a clear "You are chatting with an AI assistant" message and a way to reach a person, sets up human review of all product copy, and switches off automatic rejection in the hiring tool so a manager reviews every application. It then books an annual review with a privacy advisor. None of these steps is expensive, and together they address the main risks.
Usually lower regulatory risk
- Drafting emails, posts and documents with human review
- Summarizing internal notes and meetings
- Brainstorming, research and planning
- Spam filtering and basic productivity features
Usually higher regulatory risk
- Screening, ranking or rejecting job applicants
- Credit, pricing or eligibility decisions about individuals
- Customer-facing chatbots without disclosure
- Realistic synthetic images, voices or video of people
Your AI compliance starter list
- Create an inventory of AI tools, uses and data involved
- Identify which markets your customers, staff and applicants are in
- Flag any use that affects decisions about individuals
- Add AI disclosures to chatbots and synthetic content
- Review data settings and vendor terms for each tool
- Give staff a short AI literacy briefing and written rules
- Book a regular check of current rules with a qualified advisor
Frequently asked questions
Does the EU AI Act apply to me if I just use a chat assistant at work?
For ordinary uses like drafting and summarizing, the Act imposes few specific duties beyond AI literacy for staff. General laws such as the GDPR still apply if you process personal data. Duties increase sharply if you use AI for high-risk purposes such as hiring.
Do I need to label AI-generated content?
It depends on the content and the market. The EU AI Act requires disclosure for certain synthetic content, such as deepfakes, and some platforms have their own labeling rules. Even where not required, being open about realistic AI images or voices protects trust.
Are small businesses exempt from AI rules?
Generally not, although some laws reduce burdens or penalties for smaller companies. Many duties depend on what you use AI for, not on how big you are.
Where can I find the current rules?
Official sources include the European Commission's AI Act pages, national data protection authorities, the FTC and state attorney general websites. Because the rules change often, confirm details with a qualified advisor before making significant decisions.
Related reading
The bottom line
AI rules are multiplying, but they follow a clear logic: the higher the risk to people, the stricter the duties. Most small businesses can stay safe by knowing where they use AI, being transparent with customers, protecting personal data, keeping humans in charge of decisions about individuals and checking the latest rules regularly. This article is general information, not legal advice, so involve an advisor before adopting any high-risk AI use.
