EU AI Act - What Every Small Business Owner Must Know

The EU AI Act (Regulation (EU) 2024/1689) applies to every business whose employees use ChatGPT, Gemini, Copilot or other AI tools - regardless of company size. Since February 2, 2025, Article 4 has required you to help people who use AI understand how the tool works, its limitations and its risks. Most of the regulation has applied since August 2, 2026. Breaches of operator obligations carry fines up to EUR 15 million or 3% of turnover, while the top tier (EUR 35 million or 7%) applies only to prohibited practices, not to ordinary business use of AI. Three things to put in place in a small business: 1) training or other measures that help people understand their AI tools, ideally written down, 2) a register of AI tools in use (Shadow AI counts too), 3) GDPR compliance when entering client data - ChatGPT on a personal account (Free, Plus, Pro) may train on your conversations by default until you switch this off in settings; business accounts (Business, Enterprise) do not by default. How long it takes depends on how many tools and people you have; the workshop itself fits in one day.

If your employees use ChatGPT to write emails, Gemini for data analysis, or Copilot in Excel, you have been subject to the AI Act since February 2025. It does not matter whether you have 3 people in your company or 300.

Most of the rules have applied since August 2, 2026. This article explains what you need to do and how to prepare - without legal jargon.

Updated: October 23, 2026. We added when AI-generated content needs a label, whether AI training is mandatory and who now chairs KRiBSI. The AI Act dates are now in one table, each checked against the legal text.

What is the AI Act and who does it apply to?

The AI Act (Regulation (EU) 2024/1689 of the European Parliament and of the Council, OJ L, 2024/1689, 12.7.2024, ELI: data.europa.eu/eli/reg/2024/1689/oj) is the world's first comprehensive law regulating artificial intelligence. The European Parliament and the Council adopted it jointly - the act was signed on June 13, 2024, and published on July 12, 2024. It applies across all EU member states.

The regulation does not only concern companies that build AI systems. It applies to any entity that uses AI. If your employee uses an AI tool at work - even the free version of ChatGPT - your company is a "deployer" under the AI Act.

That comes with specific obligations. The most important one for small businesses is Art. 4 - the duty to support the development of AI literacy among people who use these tools.

Art. 4 - the AI Literacy obligation

Article 4 of the AI Act is clear: providers and deployers of AI systems must take measures to "support the development of AI literacy" among people who operate or use those systems (wording amended by the Digital Omnibus, Regulation (EU) 2026/1744).

In practice, this means:

• You need to know which AI tools are used in your business - including those employees installed on their own (Shadow AI).
• Everyone using AI should understand how these tools work, their limitations, and potential risks.
• It pays to write it down. Art. 4 does not require any documentation. Still, a record of training and materials is the simplest way to show what you did if a regulator or a client asks.

Art. 4 does not require trainer accreditation or a certificate. Since the July 2026 amendment, it also says plainly that you do not have to ensure each person reaches a set level of AI literacy (Art. 4(1), second sentence). What counts is whether your measures fit who uses AI and for what.

Is AI training mandatory?

What is mandatory is taking measures that help your people understand the AI tools they use. Art. 4 does not say those measures must be a training course, how long it should last or who should run it. It asks you to match them to people's knowledge and experience, to what they use AI for, and to who is affected.

In practice, training is the simplest option because it covers the whole team in a few hours. A one-page guide, a short briefing when a new tool arrives or a review of common mistakes count too. A salesperson drafting emails with ChatGPT needs different preparation from someone in HR pasting staff documents into an AI tool.

Sample AI training register (good practice)

A register is not required by Art. 4. It is a single table that shows what you did and reminds you when to revisit it. A spreadsheet with these columns is enough:

Keep the training materials and attendance lists with the register. If you ever breach another provision, the authority weighs mitigating circumstances (Art. 99(7)). A folder like this shows them right away.

What you specifically need to do

Preparing for Art. 4 of the AI Act comes down to three steps.

Step 1: Audit of AI tools in your business

Create a list of every AI tool your business uses. Not just the official ones - check what employees have installed on their own too. Common places where AI "hides":

• ChatGPT, Claude, Gemini - for writing emails, proposals, content
• Microsoft Copilot - built into Office 365
• Canva AI, Adobe Firefly - for graphics
• Grammarly, DeepL - for translations and proofreading
• CRM tools with AI features (e.g., HubSpot, Salesforce Einstein)
• Browser extensions with AI

For each tool, record who uses it, what for and what data it processes. This will be the basis for scoping your training. The tool audit is also a good moment to plan AI process automation - which of these tools can hand work to one another.

Step 2: Employee training

Training should cover:

• How AI works - what a language model is, why it "hallucinates", what a prompt is
• Tool limitations - when AI gets things wrong, what data can be entered and what cannot
• Data security - what happens to data entered into ChatGPT, the difference between the free and paid versions
• Practical use - how to prompt effectively, how to verify outputs, when not to trust AI
• Legal context - key facts about the AI Act and company obligations

Training does not need to last a week. For most small businesses, a one-day workshop tailored to your sector and the tools you actually use is enough. Also check whether you qualify for AI training funding from KFS or BUR. In 2026, KFS covers up to 90% of costs for micro-businesses and up to 70% for other employers, and regional PSF programs up to 85%.

Step 3: Documentation

After the training, keep these on file:

1. Training plan - a program tailored to roles in the business (one for sales, another for accounting)
2. Training materials - presentation, exercises, checklists
3. Attendance records - who participated and when
4. Completion certificates - for each participant
5. Post-training report - findings, recommendations, next steps

The law does not require this documentation, but it is the simplest proof that you took the measures Art. 4 asks for. In the event of an inspection, you present specific files - not promises.

Implementation timeline

The AI Act does not take effect all at once. Different provisions have different dates, and the Digital Omnibus package (Regulation (EU) 2026/1744 of 8 July 2026) moved some of them. We checked each date against the legal text:

Polish supervisory body - KRiBSI

The AI Act is enforced at the national level. In Poland, AI market supervision falls to the Commission for AI Development and Security (KRiBSI - Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji) - a new body established under the Polish AI Systems Act.

Legal status (checked October 23, 2026): the Polish AI Systems Act (Journal of Laws 2026, item 1003) has been in force since August 11, 2026. The provisions on inspections, proceedings and fines run by KRiBSI apply from October 28, 2026. Pamela Krzypkowska is the Commission's Chair. The Sejm appointed her, and the Senate gave its consent on September 24, 2026 (Monitor Polski 2026, item 946). The Chair has to convene the Commission's first meeting by November 11, 2026, the deadline set in the act (Art. 125(3)).

What KRiBSI does:

• Issue administrative decisions - including imposing fines for AI Act violations
• Run regulatory sandboxes - safe testing of AI systems before they reach the market
• Issue individual opinions - businesses may seek interpretation of specific cases
• Run education and awareness initiatives - training, materials, market information campaigns

Fines for non-compliance

The AI Act provides for three tiers of fines:

• Prohibited AI practices: up to EUR 35 million or 7% of annual turnover
• Operator obligations (including Art. 50 - transparency) and high-risk AI systems: up to EUR 15 million or 3% of annual turnover
• Providing false information to supervisory authorities: up to EUR 7.5 million or 1% of annual turnover

For a small business these figures may seem abstract - and the regulation accounts for that. Art. 99(6) is explicit: for SMEs and start-ups the fine may not exceed the lower of the two values, the fixed amount or the percentage of turnover. A large corporation pays the higher one, a small business the lower. Art. 99(7) additionally requires the authority to weigh the severity and duration of the breach, the size and turnover of the operator, and any mitigating factors. Documented training plus a tool register is exactly such a factor.

The worst position is doing nothing. A business that can show a training plan, documentation, and completion certificates - even if imperfect - is in a far better position than one that was unaware of the obligation.

ChatGPT and GDPR - is your business breaking the law?

Pasting personal data (customer names, tax IDs, HR records, email contents) into the consumer version of ChatGPT risks breaching GDPR. On personal accounts, not only free ones, ChatGPT, Gemini and Claude may use your chats to train models. ChatGPT (Free, Plus, Pro) does so by default, Claude (Free, Pro, Max) only with your consent (you can usually switch this off in settings). The consumer version also gives your company no data processing agreement (Art. 28 GDPR). The fix: use a "Team/Enterprise" tier, which disables training, or choose a tool with an explicit "data privacy" mode.

We checked the source policies in detail in our article on where your company's data goes when you use AI.

The most common mistake by a business owner: an employee pastes a customer email into ChatGPT and asks it to "rewrite this in a friendlier tone." The email contains a name, an email address and sometimes a phone number. That is personal data under GDPR. ChatGPT (Free, consumer Plus) stores it and, unless you switch the option off, may use it to train the model. Your company then hands a customer's data to a provider without a data processing agreement, and the customer has no idea it left the company.

The 3 most common ChatGPT data leaks in small businesses

• Customer lists for analysis: "Help me group these customers" + a spreadsheet with names, phone numbers, addresses. The entire spreadsheet lands on the provider's servers and, in a consumer tier, may be used to train the model.
• Business email content: "Write a reply to this email" + the pasted message with sender data. Name, email, company signature - it all goes to OpenAI.
• HR documents: "Summarize this employment contract". Name, ID number, employee address - the whole document lands on the provider's servers.

The scale of the problem: Cyberhaven's 2023 analysis found that 11% of data employees pasted into ChatGPT was confidential, and its 2024 report put the share of sensitive data entered into AI tools at 27.4%. In a typical 30-person business, such leaks can happen regularly - and almost always unintentionally.

How to use ChatGPT in a GDPR-compliant way

1. Choose a business tier: ChatGPT Business/Enterprise, Claude Team, Google Workspace with Gemini. These tiers disable training on your data by default and include a Data Processing Agreement (DPA). Cost per user per month, excluding tax, vendor prices checked October 28, 2026: Google Workspace Business Standard with Gemini $16.80 on flexible monthly billing ($14 with an annual commitment). Claude Team and ChatGPT Business cost $25 on monthly billing ($20 billed annually). Plan comparison: Claude vs ChatGPT for business.
2. Create an AI policy for employees: one A4 page. What is allowed (anonymous content, code, concepts). What is not (customer personal data, HR records, financial data, passwords). Each employee signs to confirm they have read the policy. The full document - eight sections, costs, updates - is covered in our guide to an AI policy for business.
3. Run training on safe AI use: most leaks start with an employee mistake, not a hacker - the Verizon DBIR finds a human element in the majority of breaches year after year. That is why training with a checklist and concrete "yes / no" examples does more than another tool.

GDPR and AI Act obligations go hand in hand. Training is the simplest way to meet Art. 4 of the AI Act, and the same training can cover GDPR rules. See our AI training for small businesses - it covers both regulations in a single workshop. The policy and the training both sit inside something larger: an AI governance framework - the owner, register and review rhythm that keep them current after the rules or the tools change.

Do I have to label AI-generated content?

In most cases, no. An email, a proposal, a product description or a social post written with AI needs no label. Article 50 of the AI Act has applied since August 2, 2026. For a typical business, three situations require informing people or labeling content. A customer is talking to an AI chat. You publish a deepfake. Or AI writes text informing the public on matters of public interest, and nobody has reviewed it. A fourth case (Art. 50(3)) applies to businesses that use emotion recognition or biometric categorization systems. They must inform the people exposed to the system.

The idea behind the rule is simple: people should not be misled. It does not ask you to disclose every use of ChatGPT. Here is what the regulation says, provision by provision:

• Chats and assistants (Art. 50(1)). A system that talks to people has to tell them it is AI, unless that is obvious from the context. This duty sits with the provider of the system.
• Watermarking (Art. 50(2)). Machine-readable marking of generated images, audio and text is a duty for the providers of the generators, such as OpenAI or Google. A business using those tools does not mark anything itself.
• Emotion recognition and biometric categorization (Art. 50(3)). A business that uses such a system must inform the people exposed to it. This duty sits with the deployer.
• Deepfakes (Art. 50(4)). A deepfake is an AI image, audio or video that resembles real people, places or events and could pass for authentic. If you publish one, disclose it. In a clearly artistic, satirical or fictional work, a notice that does not spoil the work is enough.
• Text on public matters (Art. 50(4)). The label applies to text published to inform the public on matters of public interest. The duty falls away when the text has gone through human review or editorial control and someone holds editorial responsibility for the publication.

One caveat: not every chat widget counts as an AI system. If your chat runs on rules a person wrote ("press 1 for opening hours, 2 for contact"), the AI Act does not treat it as AI. Recital 12 excludes systems based solely on rules defined by natural persons, and the deciding factor is whether the system infers. If a language model sits behind the chat and composes its own answers, it is an AI system and the duty applies to you.

In practice: if your site runs a chat built on a language model, add a notice such as "You are chatting with an AI assistant." If an ad uses a realistic AI voice or face that someone could take for a real person, label it. Ordinary business copy written with AI needs no label. If the agent was built for you and runs under your brand, the duty is yours, because the AI Act treats you as the provider. An off-the-shelf chat has to come with the notice built in by its maker, and you shouldn't switch it off. Labeling deepfakes and public-interest text is always the duty of the company that uses them.

How 30Elevate can help

We combine practical AI knowledge with the realities of small business. Our AI training covers both practical skills and the records that show what you did under Art. 4 of the AI Act.

What you get after the workshop:

• Training plan tailored to your industry and team roles
• Training materials (presentation + checklists)
• Hands-on exercises with the AI tools you actually use
• Attendance records and completion certificates for each participant
• Post-training report with recommendations

One workshop raises your team's skills and puts your documentation in order. We do not promise an "AI Act compliance certificate", because no such formal document exists. We give you the materials and records that show you met the Art. 4 obligation.

The trainer holds the Google AI Essentials certificate and Anthropic certifications (Claude API, Model Context Protocol, agent skills), plus hands-on experience deploying AI systems in businesses. The training is delivered in language that works for a business owner - not a developer.

Frequently asked questions

Does the AI Act apply to my small business?

Yes. If your employees use any AI tools - even ChatGPT for writing emails - Art. 4 of the AI Act requires you to support the development of AI literacy among those people. Business size and sector do not matter. The regulation does not cover purely personal, non-professional use of AI.

Do I have to label AI-generated content?

Usually not. An email, proposal, product description or post written with AI needs no label. Art. 50 requires you to label deepfakes, meaning realistic images, audio or video that could pass for real. Customers also need to know they are talking to an AI chat. A third case is AI text on public matters that nobody reviewed before publication. A separate case (Art. 50(3)) covers businesses that use emotion recognition or biometric categorization systems. They must inform the people exposed to the system.

When does Poland's AI law take effect?

The Polish AI Systems Act of 3 July 2026 (Journal of Laws 2026, item 1003) has been in force since August 11, 2026. The provisions on inspections, proceedings and fines run by KRiBSI apply from October 28, 2026. The act does not replace the AI Act: the EU regulation applies in Poland directly, and the act names who enforces it.

What fines apply for lack of AI Literacy compliance?

Art. 99 of the AI Act does not list Art. 4 among the provisions carrying their own penalty tier. Gaps in AI literacy act as a factor in other breaches - the supervisory authority weighs whether the company prepared its staff, and a trained team works in your favor. For small and medium businesses, a fine is capped at the lower of the two values (the fixed amount or the percentage of turnover), not the higher.

Do I need an AI Act certificate?

A formal "AI Act compliance certificate" does not exist. Art. 4 requires measures that support AI literacy, not a certificate or any specific documents. A training plan, materials and attendance records are good practice because they show what you did.

When does AI Act enforcement begin in Poland?

Art. 4 (AI Literacy) has applied in Poland since February 2, 2025, because the regulation applies directly. The penalty rules in Chapter XII have applied since August 2, 2025, and Art. 50 and the obligations of AI deployers have applied since August 2, 2026. Poland's supervisory body is KRiBSI. Its Chair was appointed in September 2026, and the Commission's first meeting has to take place by November 11, 2026.

What is the AI Literacy obligation under Art. 4 of the AI Act?

Art. 4 requires the company to take measures that support AI literacy among the people who use AI systems on its behalf. This covers how AI tools work, their limitations and risks, and the ability to critically evaluate AI outputs. The rule does not require each person to reach a set level - it requires sensible measures that fit how AI is used.

How do I conduct an AI tools audit in my company?

Create a list of all AI tools used in your company - from ChatGPT to Canva AI to CRM automations. For each tool, record: who uses it, what for, what data it processes, and what risk category it falls under according to the AI Act. A chat tool for writing or an image generator is not on the Annex III list of high-risk uses. It is different when AI screens job candidates or assesses creditworthiness.

What AI documentation must a business maintain?

Art. 4 does not require any specific documentation. It is still worth keeping a list of the AI tools you use, a training register, training materials and attendance lists. A folder like this shows a regulator or a client that you took action. If a breach ever occurs, it can also count as a mitigating factor (Art. 99(7)).