Does the EU AI Act Apply to a Small Business?
Most small businesses are not building high-risk AI. Some are caught anyway, and the deciding factor is not where you are based.
Erin Moore
Fractional Chief AI Officer
The EU AI Act sorts AI systems into risk tiers, and the obligations attach to what the system does rather than to how large your company is. A twelve-person business selling into the EU can be in scope while a thousand-person business using AI only for internal drafting is largely outside it.
Verify anything specific against the primary sources before acting on it. This area moves, secondary summaries go stale quickly, and nothing here is legal advice. The official text on EUR-Lex is authoritative; the EU AI Act explorer is a more readable way in.
How the tiers work
The Act separates systems by risk, including an unacceptable-risk category that is prohibited outright, and a high-risk category that carries documentation, transparency and oversight duties. Below those sit lighter transparency obligations, and then everyday uses that attract little or nothing.
The practical consequence for most small businesses: your internal summarisation and drafting tools are unlikely to be high-risk, while anything touching employment decisions, credit, education access or safety components deserves a careful look.
When a non-EU business is caught
Geography of incorporation is not the test. What matters is whether your system is placed on the EU market or its output is used in the EU. A US company whose AI-assisted screening tool is used by an EU customer should assume it needs to look properly rather than assume distance protects it.
What to do before you have certainty
Three things are useful regardless of how the classification lands, and all three are things you should have anyway:
Know what you run. A current AI risk register listing each system, the data it touches and its owner. Every compliance conversation starts here.
Know what your vendors do. Their answers to the security questionnaire, on file. If your vendor is the one with the obligation, you still need evidence.
Have human oversight where consequences are real. Someone accountable who can overrule the system — the substance of most oversight requirements and, independently, just good practice.
For organisations handling personal data in the UK, the ICO's AI and data protection guidance covers adjacent obligations that often bite sooner. NIST's AI Risk Management Framework is not a legal instrument but maps closely enough to be useful preparation.
The proportionate response
Do not build an enterprise compliance function for a five-person company. Do work out honestly whether anything you run touches the high-risk categories, and get advice on that specific question rather than on AI regulation in general. A focused hour with counsel beats a generic compliance project.
Frequently asked questions
Does the EU AI Act apply to small businesses? It can. Obligations attach to what a system does and whether it reaches the EU market, not to company size. Internal drafting tools are usually low concern; systems touching employment, credit or safety deserve a proper look.
Does it apply to companies outside the EU? It can, where a system is placed on the EU market or its output is used there. Being incorporated elsewhere is not by itself a defence.
What should we do first? Build a register of what you actually run and what data it touches, collect your vendors' answers in writing, and ensure a named human can overrule any consequential system.
Is this legal advice? No. Verify against the official text and take advice on your specific systems — this area changes and summaries age quickly.
Further reading
Tagged with:
Ready to Automate Your Business?
Let's discuss how AI automation can deliver measurable ROI for your organization in 90 days or sooner.