The EU AI Act applies to any business placing AI systems on the EU market, regardless of location. Your obligations depend on your role—provider, deployer, importer, or distributor—and the risk category of your AI system. Small businesses must still check their compliance duties carefully.
The EU Artificial Intelligence Act (AI Act), Regulation (EU) 2024/1689, applies to businesses placing AI systems on the EU market or whose AI is used in the European Union, regardless of where the company is based. Whether you're a provider, deployer, importer, or distributor, your obligations hinge on both your role under the Act and the risk level of your AI systems. For European SMEs, a scope check and clear role analysis are crucial first steps to understand your compliance duties as rules come into force from August 2026.
- The Act covers AI systems offered or used in the EU, even from non-EU companies.
- Obligations depend on your role: provider, deployer, importer, or distributor.
- Risk category—prohibited, high-risk, limited, or minimal—sets your duties.
- SMEs face some simplifications but must comply if providing high-risk AI.
Does the EU AI Act apply to your business?
The EU AI Act's scope is extraterritorial: it applies not only to companies established in the EU, but to any business—worldwide—that places AI systems on the EU market or whose AI outputs are used in the Union. Even if your business is based outside the EU, you must comply if your AI products reach EU users or customers. The scope is set out in Article 2 of the Act and captures a wide range of activities, from developing or supplying AI to simply using third-party AI systems for business purposes in the EU.
Which businesses and AI activities are in scope?
The Act applies to organizations developing AI, marketing it in the EU, or deploying it in business processes that affect people within the Union. This includes providers, deployers, importers, and distributors. Even if you are only integrating external AI models (such as general-purpose AI tools) or customizing them for users in Europe, your business may fall within the regulation’s scope [2]. Company size does not exempt you; startups and SMEs must check if their activities qualify, especially when dealing with high-risk AI systems or supplying third-party tools to the EU market.
What role do you have: provider, deployer, importer or distributor?
The AI Act assigns obligations based on your role. A ‘provider’ is an entity that develops or markets an AI system. A ‘deployer’ is any organization that puts an AI system to use locally, such as for HR, credit scoring, or customer interaction. An ‘importer’ is responsible for bringing AI systems from outside into the EU market, while a ‘distributor’ is involved in the supply chain within the Union but doesn’t alter the AI system. Your compliance duties and necessary documentation depend on this categorization: providers face conformity assessments, technical files, and post-market monitoring, while deployers and distributors must observe transparency, record-keeping, and respond to identified risks [2].
How does the AI system’s risk category affect your obligations?
The AI Act introduces a risk-based framework: prohibited, high-risk, limited risk, and minimal risk. Prohibited systems are banned outright. High-risk systems—such as those for biometric identification, CV screening, or critical infrastructure—carry the heaviest obligations, including conformity assessments, technical documentation, logging, and ongoing monitoring. Limited-risk systems, like chatbots, require only transparency notices to inform users they’re interacting with AI. Minimal or no-risk applications are largely exempt from requirements. Accurately identifying the risk level is vital, as it shapes what you must implement and document.
What should small businesses check first?
SMEs and startups should start by mapping all AI systems they develop, sell, or deploy, and then define their role for each system. Conducting a risk classification helps prioritize which systems face strict obligations. For example, if your SME only deploys off-the-shelf productivity AI, requirements may be limited to transparency and user information. If you produce or customize AI models, obligations expand, especially for high-risk use cases. While support mechanisms and some exemptions exist for small enterprises, there’s no blanket exemption for high-risk AI providers.
Typical Problems
Small and medium-sized enterprises often struggle to understand the complex compliance requirements and conduct proper risk assessments. This situation increases the need for targeted legal and technical support to ensure correct categorization and documentation, especially as failing to recognize all obligations as a provider or deployer may lead to compliance gaps [2]. Non-EU businesses might underestimate the Act’s reach, failing to check if their AI is used in the EU or being imported, exposing them to liability.
Current Developments
The AI Act was formally adopted in 2024, with the first significant obligations coming into force on 2 August 2026. High-risk systems and general-purpose AI models will be prioritised in enforcement. As implementation nears, sector-specific guidance and further standards are expected to help clarify risk classifications and roles, addressing the widely reported confusion among organizations on mapping their AI systems’ regulatory status.
When do the EU AI Act rules apply?
Full application of the AI Act will occur in phases. Most obligations relevant to SMEs—such as high-risk system requirements and general-purpose AI transparency—begin from August 2026. Early preparation is key: organizations are expected to document and assess their AI activities well in advance. The European Commission and newly established AI Office will offer additional guidance and monitoring as enforcement approaches.
Conclusion
Every business considering AI—whether providing, importing, deploying, or distributing—must assess if and how the EU AI Act applies to its activities. Start by mapping your AI systems, defining your role, checking risk levels, and preparing essential documentation. As enforcement dates approach and more guidance emerges, SMEs should keep compliance a priority. Starting early and seeking specialised advice can help navigate this transformative new regulation confidently.
Quellen
[2] EU AI Act: Scope, obligations and what it means for your business (Fieldfisher, 2024-01-15)
