EU AI Act - What Every Small Business Owner Must Know

The EU AI Act (Regulation 2024/1689) applies to every business whose employees use ChatGPT, Gemini, Copilot or other AI tools - regardless of company size. Since 2 February 2025, Article 4 requires you to ensure that people using AI understand how the tool works, its limitations and its risks. From 2 August 2026 enforcement begins - breaches of operator obligations carry fines up to 15M EUR or 3% of turnover, while the top tier (35M EUR or 7%) applies only to prohibited practices, not to ordinary business use of AI. Three concrete obligations for a small business: 1) documented AI Literacy training for every person using AI, 2) a register of AI tools in use (Shadow AI counts too), 3) GDPR compliance when entering client data - the free ChatGPT trains on your prompts. Preparing the audit, training and documentation takes 2-4 weeks.

If your employees use ChatGPT for writing emails, Gemini for data analysis, or Copilot in Excel - you have been subject to the AI Act since February 2025. It does not matter whether you have 3 people in your company or 300.

Most small business owners across Europe are unaware of this obligation. Yet the key deadlines begin on 2 August 2026. This article explains what you need to do, how much time you have, and how to prepare - without legal jargon.

Updated July 2026. Clarifies the scope of Art. 50 (what needs a label and what does not), distinguishes a chat built on an AI model from a plain decision tree, and updates the status of the Polish act on artificial intelligence systems.

What is the AI Act and why it applies to you

The AI Act (EU Regulation 2024/1689) is the world's first comprehensive law regulating artificial intelligence. It was passed by the European Parliament in March 2024 and applies across all EU member states.

The regulation does not only concern companies that build AI systems. It applies to any entity that uses AI. If your employee uses an AI tool at work - even the free version of ChatGPT - your company is a "deployer" under the AI Act.

That means concrete obligations. The most important one for small businesses is Art. 4 - the requirement to ensure AI competency among people who use these tools.

Art. 4 - the AI Literacy obligation

Article 4 of the AI Act is clear: providers and deployers of AI systems must ensure a "sufficient level of AI literacy" among people who operate or use those systems.

In practice, this means:

• You need to know which AI tools are used in your business - including those employees installed on their own (Shadow AI).
• Everyone using AI should understand how these tools work, their limitations, and potential risks.
• You need to document this - saying "they know" is not enough. You need evidence: training records, materials, attendance lists.

Art. 4 does not require trainer accreditation - it requires documented team competency and training quality. What counts is practical knowledge, complete documentation, and genuine preparation of staff to work with AI.

What you specifically need to do

Preparing for Art. 4 of the AI Act comes down to three steps.

Step 1: Audit of AI tools in your business

Create a list of every AI tool your business uses. Not just the official ones - check what employees have installed on their own too. Common places where AI "hides":

• ChatGPT, Claude, Gemini - for writing emails, proposals, content
• Microsoft Copilot - built into Office 365
• Canva AI, Adobe Firefly - for graphics
• Grammarly, DeepL - for translations and proofreading
• CRM tools with AI features (e.g. HubSpot, Salesforce Einstein)
• Browser extensions with AI

For each tool, record: who uses it, what for, and what data it processes. This will be the basis for scoping your training. The tool audit is also a good moment to plan AI process automation -- which of these tools can be combined into a coherent workflow.

Step 2: Employee training

Training should cover:

• How AI works - what a language model is, why it "hallucinates", what a prompt is
• Tool limitations - when AI gets things wrong, what data can be entered and what cannot
• Data security - what happens to data entered into ChatGPT, the difference between the free and paid versions
• Practical use - how to prompt effectively, how to verify outputs, when not to trust AI
• Legal context - key facts about the AI Act and company obligations

Training does not need to last a week. For most small businesses, a one-day workshop tailored to your sector and the tools you actually use is enough. Also check whether you qualify for AI training funding from KFS or BUR -- it covers up to 80% of costs.

Step 3: Documentation

After training you should have:

1. Training plan - a programme tailored to roles in the business (different for sales, different for accounting)
2. Training materials - presentation, exercises, checklists
3. Attendance records - who participated and when
4. Completion certificates - for each participant
5. Post-training report - findings, recommendations, follow-up plan

This documentation is your proof of compliance with Art. 4. In the event of an inspection, you present specific files - not promises.

Implementation timeline

The AI Act does not take effect all at once. Different provisions have different deadlines:

• February 2, 2025

  Art. 4 - AI Literacy. Obligation to ensure AI competency. Formally in force from this date.

• August 2, 2025

  Prohibited AI practices. Ban on social scoring systems, subliminal manipulation, and emotion recognition in the workplace.

• August 2, 2026

  Enforcement of fines. Supervisory authorities may impose financial penalties for non-compliance. This is the deadline you need to prepare for.

• December 2, 2027

  High-risk AI systems. Full requirements for AI systems in recruitment, lending, and healthcare. Deferred from August 2026 by the Digital Omnibus package (EU provisional agreement reached in May 2026, pending formal adoption).

Polish supervisory body - KRiBSI

The AI Act is enforced at the national level. In Poland, market supervision over AI will be carried out by the Commission for AI Development and Security (KRiBSI - Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji) - a new body established under the Polish AI Systems Act.

Legislative status (July 2026): The Sejm passed the act on 11 June 2026, the Senate returned amendments, and the Sejm accepted almost all of them. The act now awaits the President's signature. Until it enters into force, sector regulators perform supervisory functions within their remit - UODO (data protection), UOKiK (consumers), KNF (financial sector).

What KRiBSI will do once the act enters into force:

• Issue administrative decisions - including imposing fines for AI Act violations
• Run regulatory sandboxes - safe testing of AI systems before they reach the market
• Issue individual opinions - businesses may seek interpretation of specific cases
• Run education and awareness initiatives - training, materials, market information campaigns

Fines for non-compliance

The AI Act provides for three tiers of fines:

• Prohibited AI practices: up to 35 million euros or 7% of annual turnover
• Operator obligations (including Art. 50 - transparency) and high-risk AI systems: up to 15 million euros or 3% of annual turnover
• Providing false information to supervisory authorities: up to 7.5 million euros or 1% of annual turnover

For a small business these figures may seem abstract. But the regulation refers to "proportionate penalties" - meaning the supervisory authority will consider the size of the business, the severity of the breach, and whether you took any corrective action.

The worst position is doing nothing. A business that can show a training plan, documentation, and completion certificates - even if imperfect - is in a far better position than one that was unaware of the obligation.

ChatGPT and GDPR - is your business breaking the law

Pasting personal data (customer names, tax IDs, HR records, email contents) into the consumer version of ChatGPT violates GDPR. ChatGPT, Gemini, and Claude in their free tiers use your prompts to train models, which qualifies as transferring data outside the EEA without legal basis. Solution: "Team/Enterprise" tiers disable training, or choose tools with explicit "data privacy" mode.

We checked the source policies in detail in our article on where your company's data goes when you use AI.

The most common mistake by a business owner: an employee pastes a customer email into ChatGPT and asks "rewrite this in a friendlier tone". The email contains a name, email address, sometimes a phone number. That is personal data under GDPR. ChatGPT (Free, consumer Plus) stores it and may use it to train the model. This violates Art. 6 GDPR (no legal basis for processing) and Art. 44-49 (transfer of data outside the European Economic Area without safeguards).

3 most common ChatGPT data leaks in small businesses

• Customer lists for analysis: "Help me group these customers" + a spreadsheet with names, phone numbers, addresses. The entire spreadsheet goes into model training.
• Business email content: "Write a reply to this email" + the pasted message with sender data. Name, email, signature with company - all goes to OpenAI.
• HR documents: "Summarize this employment contract". Name, ID number, employee address - the whole document in the prompt, the whole document in training.

Scale of the problem: a 2024 Cyberhaven study found that 11% of data pasted into ChatGPT by employees is sensitive (customers, finance, HR). In a typical 30-person business that means several leaks per week - completely unintentional.

How to use ChatGPT in a GDPR-compliant way

1. Choose a business tier: ChatGPT Team/Enterprise, Claude Team, Gemini Business. These tiers disable training on your data by default and include a Data Processing Agreement (DPA). Cost: from approximately $25/user/month.
2. Create an AI policy for employees: one A4 page. What is allowed (anonymous content, code, concepts). What is not (customer personal data, HR records, financial data, passwords). Each employee signs that they have read the policy.
3. Run training on safe AI usage: 90% of leaks are not hacker attacks - they are employee mistakes. Training + checklist + concrete "yes/no" examples = 80% risk reduction.

GDPR and AI Act compliance go hand in hand. Art. 4 of the AI Act requires training employees on AI use - the same training covers GDPR concerns. See our AI training for small businesses - it covers both regulations in a single workshop.

Art. 50 - when you must label AI content (and when you don't)

The second obligation that reaches small businesses is transparency - Article 50 of the AI Act. It applies from 2 August 2026 and was not postponed by the Digital Omnibus package (what moved was high-risk systems, pushed to December 2027).

This is where most businesses get it wrong: the fact that a text was written with AI does not, by itself, trigger a labelling duty. Product descriptions, client emails, posts on your company blog - none of these need a label. The duty is narrower:

• Deepfakes - images, video or audio depicting people or events that never happened, which someone could reasonably take as authentic
• Text informing the public on matters of public interest (health, fundamental rights, the environment, consumer protection). Pure product advertising and corporate communications fall outside this. There is also an exception where a person has reviewed the content and holds editorial responsibility for it
• Chats talking to customers - people have the right to know they are dealing with AI, at the latest on first interaction
• Marketing materials with synthetic faces or voices - where they could pass for real people

One caveat: not every chat widget counts as an AI system. If your chat runs on rules a person wrote ("press 1 for opening hours, 2 for contact"), the AI Act does not treat it as AI. Recital 12 excludes systems based solely on rules defined by natural persons, and the deciding factor is whether the system infers. If a language model sits behind the chat and composes its own answers, it is an AI system and the duty applies to you.

In practice: if your site runs a chat built on a language model, add a notice such as "You are chatting with an AI assistant". If you use an AI-generated voice or face in advertising, label it. Ordinary business copy written with AI needs no label. And the responsibility sits with your company as the deployer, not with the vendor of the tool.

How 30Elevate can help

We combine practical AI knowledge with the realities of small business. Our AI training covers both practical skills and the documentation required under Art. 4 of the AI Act.

What you get after the workshop:

• Training plan tailored to your industry and team roles
• Training materials (presentation + checklists)
• Hands-on exercises with the AI tools you actually use
• Attendance records and completion certificates for each participant
• Post-training report with recommendations

One workshop - and your team's competency is raised and your documentation is in order. We do not promise an "AI Act compliance certificate" (because no such formal document exists), but we give you everything Art. 4 requires.

The trainer holds Google AI certifications and has hands-on experience deploying AI systems in businesses. The training is delivered in language that works for a business owner - not a developer.

Frequently asked questions

Does the AI Act apply to my small business?

Yes. If your employees use any AI tools - even ChatGPT for writing emails - Art. 4 of the AI Act requires you to ensure adequate competency. Business size and sector do not matter.

What fines apply for lack of AI Literacy compliance?

Art. 99 of the AI Act does not list Art. 4 among the provisions carrying their own penalty tier. Gaps in AI literacy act as a factor in other breaches - the supervisory authority weighs whether the company prepared its staff, and a trained team works in your favour. For small and medium businesses, a fine is capped at the lower of the two values (the fixed amount or the percentage of turnover), not the higher.

Do I need an AI Act certificate?

A formal "AI Act compliance certificate" does not exist. Art. 4 requires documented competency - a training plan, materials, attendance records, and a completion certificate. What matters is the trainer's expertise and the quality of documentation.

When does AI Act enforcement begin in the EU?

Art. 4 (AI Literacy) has formally applied since February 2, 2025. Enforcement of fines begins in August 2026. This gives businesses time to prepare, but it is best to start now.

What is the AI Literacy obligation under Art. 4?

Art. 4 requires that every person operating an AI system in a company has a sufficient level of competency. This includes understanding how AI tools work, recognizing limitations and risks, and being able to critically evaluate AI-generated outputs. The obligation applies to both employees and the business owner.

How do I conduct an AI tools audit in my company?

Create a list of all AI tools used in your company - from ChatGPT to Canva AI to CRM automations. For each tool, record: who uses it, what for, what data it processes, and what risk category it falls under according to the AI Act. Most small business tools fall into the minimal or limited category.

What AI documentation must a business maintain?

Art. 4 requires documentation of: a list of AI tools used, a training plan with scope and timeline, training materials, attendance records, and completion certificates. A simple folder with these elements is sufficient in case of an inspection.