The EU AI Act: What It Actually Means for Your Small Business (A Plain-English Guide for 2026 and Beyond)

Last updated: June 2026

Introduction: The Law Nobody Told You About

If you run a small or medium-sized business in Europe — or you sell to European customers — there's a new piece of legislation that may already apply to you, whether you've heard of it or not.

It's called the EU AI Act (formally, Regulation (EU) 2024/1689), and it is the world's first comprehensive law specifically regulating artificial intelligence. It entered into force in August 2024, and its rules are now rolling out in phases through 2027 and beyond.

Here's the uncomfortable truth: most small business owners have never read it, many have never heard of it, and a surprising number are already subject to some of its obligations without realizing it. If your team uses ChatGPT, a customer service chatbot, an AI-powered hiring tool, or AI-generated marketing content — this law is talking to you.

"If your company uses any AI system — and it almost certainly does, even if you're not aware of it — you may already have a legal obligation under this regulation. It is not a recommendation. It is law."

The good news? For the vast majority of small businesses, the EU AI Act is far less frightening than the headlines suggest. Most SMBs are not building dangerous AI systems — they're using everyday tools like chatbots, writing assistants, and scheduling software. For these use cases, the obligations are modest, manageable, and often boil down to common sense: be transparent with your customers, train your staff, and don't use AI to manipulate or discriminate against people.

This article will walk you through, step by step and without the legal jargon, exactly what the AI Act is, who it applies to, what you actually need to do, what the real risks and fines are, and which "scary" claims about it are simply myths.

Part 1: What Is the EU AI Act, Really?

The Big Picture

The EU AI Act is a regulation — not a guideline or a recommendation, but binding law — adopted by the European Union in 2024. Its core purpose is to ensure that AI systems used in the EU are safe, transparent, non-discriminatory, and respectful of fundamental rights, while still allowing innovation to flourish.

Crucially, the Act does not regulate "AI" as a buzzword. It regulates specific uses of AI systems based on the risk they pose to people. This is the single most important concept to understand, because it determines almost everything else: what rules apply to you depend entirely on what you're using AI for, not on the fact that you're using AI at all.

The Risk-Based Pyramid

The AI Act sorts AI systems into four tiers:

• Unacceptable risk → Banned outright. A small list of AI practices considered so harmful to fundamental rights that they are simply prohibited across the EU, full stop. (More on this below — this is shorter and more specific than people assume.)
• High risk → Heavily regulated. AI systems used in areas like employment decisions, credit scoring, education, law enforcement, and critical infrastructure. These come with substantial obligations: documentation, risk management, human oversight, and registration.
• Limited risk → Transparency requirements. This is where most small businesses live. Think chatbots, AI-generated content, and systems that interact directly with people. The obligation here is primarily about disclosure — telling people they're dealing with AI.
• Minimal risk → Essentially unregulated. The overwhelming majority of everyday AI use — spam filters, inventory prediction, scheduling tools, internal productivity software — falls here, with no specific obligations beyond general best practice.

"The framework differentiates AI systems by the potential harm they may pose, imposing escalating obligations where risks increase — not by the technology itself, but by what it's used for."

Who Does It Apply To?

This is where many small business owners get confused, so let's be precise. The Act distinguishes between different roles in the "AI value chain":

• Providers — companies that develop AI systems or have them developed and place them on the market (e.g., a software company building an AI hiring tool).
• Deployers — companies that use an AI system in the course of their professional activities (e.g., a small business using that hiring tool to screen candidates).
• Importers and distributors — companies that bring AI systems from outside the EU into the EU market, or distribute them within it.

Here's the key point: most small businesses are "deployers," not "providers." You're not building AI — you're using AI tools built by someone else (OpenAI, Microsoft, Google, a chatbot vendor, an HR software company, etc.). Deployers generally have lighter obligations than providers, but they are not exempt.

And importantly, the Act applies based on where the AI system is used or where its output affects people — not based on where your company is headquartered. If you're a US-based company selling to EU customers and using AI in that process, the Act can apply to you too.

Part 2: The Timeline — What's Already in Force, and What's Coming

The AI Act didn't switch on all at once. It's being phased in over roughly three years, and — importantly — the timeline has recently changed. In May 2026, EU lawmakers reached a provisional agreement to significantly revise the rollout, pushing back some of the most burdensome deadlines and extending relief to more businesses. Here's where things currently stand:

Already in force (since February 2025)

• Prohibited practices (Article 5) — the small list of banned AI uses. These have been enforceable since 2 February 2025, with penalties applying since August 2025.
• AI literacy obligation (Article 4) — the requirement that staff using AI systems have a "sufficient level of AI literacy." This is also in force, though enforcement only fully begins once national authorities are operational.

In force since August 2025

• Obligations for providers of "general-purpose AI models" (think: the companies behind large language models like GPT, Claude, or Gemini) — transparency and documentation requirements at the model-provider level.
• Member states were required to designate national enforcement authorities.

The big shift: high-risk obligations delayed

Originally, the bulk of high-risk AI system obligations were set to apply from 2 August 2026. However, following the May 2026 provisional agreement (often referred to as the "Digital Omnibus" simplification package), enforcement of high-risk AI rules has been pushed back by roughly 16 months, with the new target date being December 2027 for many high-risk obligations — including, notably, AI systems used in employment decisions (hiring, monitoring, promotion, and termination).

"This 16-month extension represents a strategic window for European businesses — particularly smaller and mid-sized firms — to build governance frameworks without the pressure of immediate enforcement."

It's important to flag: as of this writing, this is a provisional agreement, not yet final law. The European Parliament and Council still need to formally adopt it. Until that happens, the original 2 August 2026 deadline technically remains the legal baseline. Businesses should treat the extension as likely but not yet certain, and continue preparing rather than assuming the deadline has disappeared.

Full application: 2027–2028

The most far-reaching provisions — including high-risk AI embedded in regulated products (machinery, medical devices, etc.) — are now expected to apply from 2 August 2027, with some product-integrated high-risk rules potentially shifting to 2028 under the proposed revisions.

What this means practically for a small business

For the overwhelming majority of SMBs — using mainstream AI tools for customer service, content, marketing, and operations — the most relevant deadlines right now are:

1. AI literacy (Article 4) — already a live obligation. You should be addressing this now.
2. Transparency rules for chatbots and AI-generated content (Article 50) — generally tied to the 2 August 2026 date.
3. Prohibited practices (Article 5) — already enforceable; check you're not inadvertently doing any of these (covered below — it's a short list, and most businesses aren't anywhere near it).
4. High-risk obligations — only relevant if you're using AI for things like automated hiring decisions, credit assessments, or employee monitoring/performance evaluation. If so, you now likely have until December 2027 (pending formal confirmation), but starting governance work now is strongly advised.

Part 3: The Eight Things You're Not Allowed to Do — Prohibited AI Practices

Let's start with the shortest and clearest part of the law: things that are banned outright, with no compliance pathway and no grace period. As of writing, Article 5 prohibits eight categories of AI practice:

1. Subliminal or manipulative AI that distorts a person's behavior in ways that cause them (or are likely to cause them) significant harm — for example, AI designed to exploit psychological weaknesses to push someone into a purchase they wouldn't otherwise make and that harms them.
2. Exploiting vulnerabilities of children, people with disabilities, or people in specific socio-economic situations, in ways that cause harm.
3. Social scoring — evaluating or classifying people based on their social behavior or personal characteristics in ways that lead to unfair or disproportionate treatment in unrelated contexts.
4. Predictive policing based purely on profiling — using AI to assess someone's likelihood of committing a crime based solely on personality traits or characteristics (without other concrete evidence).
5. Untargeted scraping of facial images to build or expand facial recognition databases (the "Clearview AI" scenario — scraping photos from social media or the internet to build a facial recognition tool).
6. Emotion recognition in the workplace or in educational institutions (with narrow exceptions for health and safety purposes).
7. Biometric categorization that infers sensitive characteristics — race, political opinions, religious beliefs, sexual orientation, etc. — from someone's biometric data.
8. Real-time remote biometric identification in public spaces for law enforcement purposes, except in narrowly defined, serious circumstances (e.g., searching for a missing child, or preventing an imminent terrorist threat).

"Article 5 enforces eight outright AI bans. No compliance pathway exists. Immediate cessation is the only legal option."

What this means for you, practically

Be honest: how many small businesses are doing any of this? Almost none. If you're running a marketing agency, a local shop, a consultancy, a trades business, or a professional services firm, you are extremely unlikely to be anywhere near these prohibitions.

The one area worth a moment's thought is #6 (workplace emotion recognition). If you've been considering AI tools that analyze employee facial expressions, tone of voice, or "engagement levels" during meetings or calls — that's now off the table in the EU, with very limited exceptions. Vendors selling "employee sentiment AI" for monitoring purposes should raise a red flag.

Beyond that — if your AI use is about customer service, content creation, scheduling, marketing, or back-office automation, you can set this entire section aside with confidence.

Part 4: AI Literacy — The Obligation Already in Force (and Most Companies Don't Know About It)

This is arguably the most under-the-radar part of the AI Act, and the one most directly relevant to every business that uses AI tools — including yours.

Article 4 requires that providers and deployers of AI systems ensure a "sufficient level of AI literacy" among their staff and anyone else operating AI systems on their behalf (this can include contractors and service providers).

"Article 4 requires organisations to take measures to ensure a sufficient level of AI literacy both of their staff and 'other persons dealing with the operation and use of AI systems on their behalf.'"

What it doesn't require

To calm any panic immediately:

• There's no requirement to test or certify employees' AI knowledge.
• There's no requirement to appoint a dedicated "AI Officer" or build a formal governance board.
• There's no single prescribed training program — the law deliberately avoids a one-size-fits-all approach.

What it does require

In practice, this means taking reasonable, proportionate steps to make sure people using AI tools in your business understand:

• What the tool does and doesn't do
• Its limitations and the risk of errors (e.g., AI "hallucinations")
• The basic legal and ethical considerations relevant to how it's being used (e.g., data privacy, non-discrimination)
• How to use it responsibly in the context of their specific role

A useful mental model: a junior staff member using ChatGPT to draft emails needs a different (lighter) level of literacy than an HR manager using an AI tool to shortlist job candidates. The law explicitly calls for a layered, proportionate approach.

Why this matters more than it looks

Two reasons this deserves real attention, even though the fines for Article 4 alone sit in a lower tier:

1. It's a foundation for everything else. If an untrained employee causes harm using an AI tool — say, by feeding sensitive customer data into a public AI tool, or by relying uncritically on biased AI output in a hiring decision — your company can be liable for that harm under existing law (GDPR, employment law, etc.), and a lack of AI training will likely be treated by regulators as an aggravating factor.
2. It's cheap and easy to fix. Unlike high-risk system compliance, which can require significant investment, AI literacy is largely about documentation, basic training sessions, and internal guidelines — work that a small business can realistically do in days, not months.

A practical starting point

A simple, defensible AI literacy program for an SMB might include:

• A short written AI usage policy (what tools are approved, what data can/can't be entered into them, who to ask if unsure)
• A one-time onboarding session (even 30–60 minutes) covering what AI tools the business uses, their limitations, and responsible use
• Role-specific guidance for higher-risk uses (e.g., anyone involved in hiring, customer communications, or financial decisions)
• A simple record of who's been trained and when

This is exactly the kind of foundational work that pays for itself — and it happens to be one of the easiest entry points for working with an AI consultant who can build this out for you quickly.

Part 5: Transparency — What You Owe Your Customers When AI Is Involved

This is the section most relevant to small businesses using customer-facing AI: chatbots, AI-generated marketing content, voice assistants, and similar tools. It's governed primarily by Article 50 of the AI Act.

The core principle: don't let people be fooled

The underlying idea is simple — people have a right to know when they're interacting with AI, or when content has been created or significantly altered by AI, particularly in contexts where it matters to them.

Chatbots and virtual assistants

If your business uses a chatbot or AI voice assistant for customer service, sales, or support, the rule is straightforward:

People must be informed that they are interacting with an AI system — and this disclosure must happen at the start of the interaction, not buried in a privacy policy.

The exception — "unless it's obvious from the circumstances" — is interpreted narrowly. A chatbot that talks like a human, using a friendly name and conversational tone, does not automatically qualify as "obvious." In practice, this means:

• A short, visible message at the start of a chat: "Hi, I'm an AI assistant. How can I help you today?"
• Clear labeling in the interface (not just a tiny disclaimer in a footer)
• The disclosure should be genuinely noticeable — not technically present but practically invisible

AI-generated content (images, audio, video, and text)

This is where many small businesses — particularly those using AI for marketing — need to pay attention.

• If your business generates synthetic images, audio, or video (e.g., AI-created marketing visuals, voiceovers, or video content) that could be mistaken for real, authentic content (a "deepfake" in the legal sense — content that "resembles existing persons, objects, places, entities or events" and could appear authentic), you generally need to disclose that it's AI-generated.
• For AI-generated text published on matters of public interest (think: a blog post discussing political or social topics, news-adjacent commentary), disclosure is required unless the content has undergone genuine human editorial review — meaning a real person has substantively reviewed and taken responsibility for it.
• For purely commercial content — product descriptions, marketing copy, a blog post about your services — the legal disclosure obligation is lighter, but the emerging best practice strongly favors transparency anyway, both for legal safety and for building trust with increasingly AI-aware consumers.

"The trigger turns on the publisher's purpose, not merely the subject matter... Such checks must be substantive and not limited to superficial matters or cursory approval."

What about AI tools you use internally, that customers never see?

Good news: if you're using AI to draft an internal memo, summarize a meeting, analyze your sales data, or generate a first draft that a human then substantially edits before it goes anywhere near a customer — none of the Article 50 transparency rules are triggered. This is about outputs that reach people, not the tools your team uses behind the scenes.

A practical transparency checklist for SMBs

• ✅ Does your chatbot or virtual assistant clearly identify itself as AI at the start of every conversation?
• ✅ If you use AI-generated images or video in marketing where realism could be mistaken for genuine photography/footage, do you disclose this?
• ✅ For blog content or articles touching on public-interest topics, has a human meaningfully reviewed and taken responsibility for AI-assisted drafts?
• ✅ Is your AI disclosure genuinely visible — not hidden in fine print?

Part 6: High-Risk AI — When Does This Actually Apply to a Small Business?

This is the part of the AI Act that generates the most fear — and the part that applies to the fewest small businesses in practice. But where it does apply, the obligations are substantial, so it's worth understanding clearly.

What counts as "high-risk"?

The AI Act lists specific categories of high-risk AI systems in its Annex III. The ones most likely to be relevant to an SMB include:

• AI used in recruitment and employment — CV-screening tools, AI-driven candidate ranking, automated interview analysis, and AI systems used to monitor, evaluate, or make decisions about employees (promotions, terminations, task allocation)
• AI used in creditworthiness assessments — if your business evaluates customers' creditworthiness using AI (e.g., for offering payment plans or financing)
• AI used in insurance risk assessment and pricing for life and health insurance
• Certain AI systems used in education (e.g., automated assessment/grading tools, if you run a training or education-adjacent business)

What if this applies to you?

If you're a deployer (not a provider) of a high-risk AI system, your obligations are generally lighter than those of the system's provider, but they still include things like:

• Using the system in accordance with its instructions for use
• Ensuring human oversight of the system's outputs
• Monitoring the system's operation and reporting serious issues
• In some cases, conducting a Fundamental Rights Impact Assessment (FRIA) before deployment
• Maintaining relevant documentation

The reassuring reality

For the vast majority of small businesses — retailers, restaurants, trades, professional services, marketing agencies, local consultancies — none of this applies, because they're not using AI for hiring decisions, credit scoring, or insurance pricing. If your AI use is about chatbots, content, scheduling, workflow automation, and internal productivity, high-risk obligations are simply not in your lane.

The one area where SMBs most commonly do brush up against this category is AI in hiring. If you've adopted (or are considering) an AI tool that screens CVs, ranks candidates, or analyzes interview performance — that's the trigger point to pay attention to, and as noted earlier, the deadline for these specific obligations has likely been pushed to December 2027, giving businesses meaningful runway to prepare.

Part 7: SME-Specific Relief — The Law Knows You're Not a Tech Giant

One of the most important — and least publicized — aspects of the AI Act is that lawmakers explicitly built in provisions recognizing that a five-person bakery and a multinational tech company shouldn't face identical compliance burdens.

Article 62 specifically addresses "measures for providers and deployers, in particular SMEs, including start-ups," and the broader regulatory direction (especially following the 2026 Digital Omnibus discussions) has moved toward expanding, not shrinking, this relief.

What SME-specific support looks like

• Simplified guidance and documentation templates — rather than building compliance documentation from scratch, smaller businesses are intended to have access to standardized templates
• Reduced fines for SMEs relative to large enterprises in proportion to their size and market presence
• Regulatory sandbox access — controlled environments where businesses (including SMEs) can test AI systems with regulatory support before full market deployment
• Priority access to AI regulatory sandboxes for SMEs and start-ups

Notably, recent proposed amendments would extend simplified compliance frameworks to companies with up to 750 employees and €150 million in annual revenue — meaning the "SME-friendly" treatment is intended to reach well beyond what most people picture as a "small business," covering a large share of the mid-market too.

"SME simplifications extended to mid-caps: the AI Act's simplified compliance framework for small- and medium-sized enterprises will be extended to companies with up to 750 employees and €150 million in annual revenue."

The bottom line for SMBs

Regulators have clearly signaled — through both the original text and the 2026 amendments — that they do not want the AI Act to crush small business innovation or create disproportionate burdens. The intent is to ensure proportionality: a five-person consultancy using ChatGPT for content drafting is not expected to maintain the same documentation as a company building autonomous medical diagnostic systems.

Part 8: Fines — What's the Real Financial Risk?

Let's address this directly, because the headline numbers are eye-catching and often quoted without context.

The AI Act establishes a tiered fine structure — notably higher than GDPR's maximum fines:

"Fine structure exceeds GDPR: up to €35M or 7% turnover (vs €20M / 4%)."

Now, here's the context that matters

These figures represent the absolute ceiling, calibrated for the largest companies in the world — the kind of fine designed to be meaningful to a company with tens of billions in revenue. For an SMB, several factors significantly change the practical picture:

1. "Whichever is higher" cuts both ways for small companies — but enforcement guidance and SME proportionality provisions mean actual fines imposed on small businesses are expected to be calibrated to their size and the severity/intent of the violation, not pulled from the maximum tier by default.
2. Enforcement is graduated. Regulators across Europe — much like with GDPR — are expected to prioritize education, warnings, and corrective action plans for first-time or minor violations, particularly for SMEs, before jumping to maximum fines. The pattern with GDPR enforcement over the past several years bears this out: massive fines have overwhelmingly targeted large platforms with systemic, repeated, or willful violations — not small businesses making good-faith efforts.
3. The realistic risk for most SMBs isn't a fine at all — it's reputational damage (a customer finding out your "human" chat support is an undisclosed bot and feeling deceived) or downstream liability (an untrained employee causes a data breach or discriminatory outcome, and the AI Act compliance gap becomes evidence of inadequate governance in a separate legal claim).

The honest risk assessment

If you're a small business using mainstream AI tools for content, customer service, and operations — and you take basic, reasonable steps (disclose AI chatbots, train your team, avoid the eight prohibited practices, be thoughtful about AI in hiring) — your realistic exposure to AI Act fines is very low. The fines exist to deter and punish serious, willful, large-scale violations — not to catch small businesses making a good-faith effort.

That said, "very low risk" is not "zero risk," and the cost of basic compliance is genuinely small relative to the cost of even a minor enforcement action or reputational hit. This is a case where modest proactive investment offers an excellent return.

Part 9: Debunking the Myths

Let's tackle the misinformation head-on. A lot of fear-based content about the AI Act is circulating, and much of it isn't accurate — or applies a "worst case for the biggest companies" framing to businesses it was never aimed at.

Myth 1: "The AI Act bans the use of ChatGPT and similar tools in business."

False. Using general-purpose AI tools like ChatGPT, Claude, Gemini, or Copilot for everyday business tasks — writing, research, summarization, brainstorming — is not prohibited or specifically restricted by the AI Act. The obligations that do apply (AI literacy, transparency if customer-facing) are about how you use these tools, not whether you can.

Myth 2: "Every business using AI needs to register with an EU authority."

False — for almost all SMBs. Registration requirements apply specifically to high-risk AI systems listed in Annex III, and primarily to providers of such systems. A small business using a chatbot or AI content tool has no registration obligation.

Myth 3: "If I get caught using AI without disclosing it, I'll face a €35 million fine."

Misleading. The €35 million / 7% figure is the maximum penalty reserved for the most serious category — prohibited practices (the eight banned uses covered in Part 3), which almost no ordinary business is anywhere near. Transparency violations sit in a lower tier, and SME proportionality principles apply throughout.

Myth 4: "The AI Act doesn't apply to my business because I'm not in the EU."

Often false. The AI Act has extraterritorial reach similar to GDPR. If the output of your AI system is used in the EU — for example, you're a US-based company with European customers receiving AI-generated content or interacting with an AI chatbot — the Act can apply to that activity, regardless of where your company is headquartered.

Myth 5: "AI literacy means I need to send my whole team to a certification course."

False. There is no certification requirement. AI literacy is about proportionate, role-appropriate awareness — which can often be achieved through internal policy documents, short training sessions, and practical guidelines tailored to how your business actually uses AI.

Myth 6: "The AI Act is basically dead now because of the 2026 changes — I can ignore it."

False, and risky. The May 2026 provisional agreement delays and simplifies certain high-risk obligations — it does not eliminate the law. Prohibited practices remain banned. AI literacy remains a live obligation. Transparency rules for chatbots and AI content remain on track. Treating the 2026 amendments as "the law went away" would leave a business unprepared for obligations that are very much still coming — just on a more humane timeline.

Myth 7: "Compliance requires expensive lawyers and consultants that only big companies can afford."

Partially false. While complex high-risk AI deployments do benefit from specialist legal advice, the obligations most relevant to typical SMBs — AI literacy and transparency — are primarily operational and policy-based, not legal-heavy. A half-day workshop, a short written policy, and some interface tweaks to a chatbot cover most of what's needed. This is squarely the kind of practical, high-value work an AI implementation partner can deliver efficiently.

Part 10: A Practical Action Plan for SMBs

Bringing it all together, here's a realistic, prioritized approach for a small or medium business:

Step 1: Take inventory (this week)

List every place AI is used in your business — chatbots, content generation tools, scheduling/automation tools, any HR or recruitment software, customer service tools, marketing platforms with AI features. You can't assess risk you haven't mapped.

Step 2: Check against the prohibited list (one-time check)

Run through the eight prohibited practices (Part 3). For nearly every SMB, this will be a quick "none of these apply" — but it's worth the ten minutes of certainty, especially regarding workplace monitoring tools.

Step 3: Build a lightweight AI literacy program (this month)

• Write a one-page AI usage policy
• Run a short team session on responsible AI use, data privacy, and tool limitations
• Document who's been briefed and when

Step 4: Audit customer-facing AI for transparency (this month)

• Does your chatbot disclose it's AI at the start of conversations?
• Do you use AI-generated images/video that could be mistaken for real?
• Review and adjust interface copy and disclosures as needed

Step 5: Flag any high-risk use cases (ongoing)

If you use — or are considering — AI in hiring, credit decisions, or employee monitoring/evaluation, treat this as a distinct workstream requiring more careful governance, with an eye on the (likely) December 2027 deadline.

Step 6: Keep a simple record

Regulators, much like with GDPR, will look favorably on businesses that can demonstrate good-faith effort and documentation — even if imperfect — versus those with no awareness or action at all.

Conclusion: Don't Fear It — Get Ahead of It

The EU AI Act is real, it's binding, and parts of it already apply to your business today. But for the overwhelming majority of small and medium businesses, it is not the existential compliance nightmare that alarmist headlines suggest.

The law was deliberately designed around proportionality — heavier obligations for genuinely high-risk uses (hiring algorithms, credit scoring, biometric surveillance), and lighter, common-sense obligations (transparency, basic AI literacy) for the everyday tools most businesses actually use.

The businesses that will struggle aren't the ones using AI thoughtfully with a bit of structure — they're the ones that ignore this entirely, get caught flat-footed by a customer complaint or a regulator's question, and have to scramble to explain why they never gave it any thought at all.

Getting ahead of this — with a simple AI usage policy, basic team training, and a quick check of your customer-facing AI tools — is a few days of focused work that can be folded directly into a broader AI adoption strategy. Done well, it's not a compliance burden bolted onto your AI journey — it's simply part of doing AI properly.

Sources

This article draws on the following sources, current as of June 2026:

1. Legalnodes — "EU AI Act 2026 Updates: Compliance Requirements and Business Risks" — https://www.legalnodes.com/article/eu-ai-act-2026-updates-compliance-requirements-and-business-risks
2. Latham & Watkins — "AI Act Update: EU Resolves to Change Rules and Extend Deadlines" — https://www.lw.com/en/insights/ai-act-update-eu-resolves-to-change-rules-and-extend-deadlines
3. Software Improvement Group — "A Comprehensive EU AI Act Summary (January 2026 update)" — https://www.softwareimprovementgroup.com/blog/eu-ai-act-summary/
4. Fisher Phillips — "EU Overhauls AI Act Just Before Key Deadline" — https://www.fisherphillips.com/en/insights/insights/eu-overhauls-ai-act-just-before-key-deadline
5. Legiscope — "EU AI Act Deadlines 2026-2027: Compliance Calendar + Fines" — https://www.legiscope.com/blog/eu-ai-act-timeline-deadlines.html
6. IJONIS — "EU AI Act for SMEs: Obligations, Deadlines, and Checklist" — https://ijonis.com/en/eu-ai-act-enterprises
7. Flap Consulting — "EU AI Act Compliance Guide: 2027 Deadlines & Strategy" — https://flapconsulting.com/en/blog/cumplimiento-ley-ia-ue
8. Modulos AI — "EU AI Act Prohibited Practices: The Complete List" — https://www.modulos.ai/blog/eu-ai-act-prohibited-practices/
9. EU AI Act Explorer — Article 5 (Prohibited AI Practices) — https://artificialintelligenceact.eu/article/5/
10. euaicompass.com — "All 8 Prohibited AI Practices Under Article 5: Explained" — https://euaicompass.com/article-5-prohibited-ai-practices-explained.html
11. Arthur Cox — "The EU Commission Guidelines on Prohibited AI Practices Under the AI Act" — https://www.arthurcox.com/knowledge/the-eu-commission-guidelines-on-prohibited-ai-practices/
12. Travers Smith — "The EU AI Act's AI Literacy Requirement – Key Considerations" — https://www.traverssmith.com/knowledge/knowledge-container/the-eu-ai-acts-ai-literacy-requirement-key-considerations/
13. Crowell & Moring — "Artificial Intelligence and Human Resources in the EU – Part 2: AI Literacy" — https://www.crowell.com/en/insights/client-alerts/part-2-ai-literacy-employer-ai-literacy-obligations-under-the-eu-ai-act
14. Delbion — "EU AI Act Article 4: AI Literacy Obligation for Providers and Deployers (2026)" — https://www.delbion.com/en/insights/mandatory-ai-training-eu-ai-act/
15. Iternal AI — "EU AI Act Article 4: Mandatory AI Literacy Training Explained (2026)" — https://iternal.ai/eu-ai-act-literacy
16. EU AI Act Explorer — Article 50 (Transparency Obligations) — https://artificialintelligenceact.eu/article/50/
17. EU AI Act Explorer — "The EU AI Act's Transparency Rules: A Practical Guide to Article 50" — https://artificialintelligenceact.eu/transparency-rules-article-50/
18. Bird & Bird — "Taking the EU AI Act to Practice: Understanding the Draft Transparency Code of Practice" — https://www.twobirds.com/en/insights/2026/taking-the-eu-ai-act-to-practice-understanding-the-draft-transparency-code-of-practice
19. euaicompass.com — "EU AI Act Article 50: Transparency & AI Content Labelling Guide" — https://euaicompass.com/eu-ai-act-article-50-transparency-guide.html
20. EU AI Act Explorer — "Key Issue 5: Transparency Obligations" — https://www.euaiact.com/key-issue/5

A Note on This Article

This article is provided for general informational purposes to help small business owners understand the landscape of the EU AI Act. It is not legal advice, and the regulatory situation — particularly regarding the 2026 amendments — remains subject to change as the formal legislative process continues. Businesses with specific compliance questions, particularly those using AI in employment, credit, or other high-risk contexts, should consult a qualified legal professional familiar with EU AI regulation.

I help small and medium businesses navigate AI adoption practically and responsibly — including the governance and literacy foundations covered in this article. [Take the free AI Readiness Assessment] to see where your business stands.