Do you use ChatGPT to draft emails, summarise documents or generate visuals for social media? Since August 2, 2026, the AI Act - the European regulation on artificial intelligence - has entered its most concrete phase for businesses. And if you run a small or mid-sized company, the question is no longer whether the text applies to you, but how.
One thing to get out of the way first: this is not a European-companies-only problem. Like the GDPR before it, the AI Act follows the market rather than the head office. If you sell into the EU, serve European customers or publish content they read, you are inside its scope whether you are based in Lyon, Leeds or Los Angeles.
The good news: the press badly overstated the urgency. Plenty of articles announced that the heaviest obligations - facial recognition, credit scoring, automated hiring - kicked in this summer. That is wrong, and it caused needless confusion for tens of thousands of business owners. What actually applies since August 2, 2026 is narrower, but very real: transparency. Here is how to tell whether you are covered, and what to do this week.
This is not the first time a technical European text has produced alarming shortcuts in the general press - the GDPR got exactly the same treatment when it came into force. Better to start from solid ground than from scary headlines: this guide relies only on the text of the regulation and the dates it sets, not on loose interpretations.
📌 TL;DR
Since August 2, 2026, the AI Act requires transparency on AI-generated content and finally allows regulators to fine. High-risk rules, on the other hand, are delayed to 2027-2028: no need to panic if you just use ChatGPT for your emails. This article helps you work out whether you are covered, what to do this week, and what the real penalties look like for a small business.
In this article
What changed on August 2, 2026
On August 2, 2026, two things flipped for good: the transparency obligations of Article 50 became applicable, and national authorities finally gained the power to impose fines. Here is what that means for you in practice.
- A chatbot has to disclose that it is an AI, not a human.
- Content generated or heavily modified by AI (image, video, audio) has to be marked in a machine-readable format.
- A deepfake has to be declared as such.
- Published text that comes from an AI has to disclose its artificial origin.
- Emotion recognition and biometric categorisation systems have to inform the people they are applied to.
Concretely: if you publish a blog post written with the help of ChatGPT, or an AI-generated visual on your social channels, you now have to say so. That can be a simple note at the foot of the page, a line in the image metadata, or a sentence in your caption. The point is not to discourage the use of AI, but to stop your audience from mistaking machine-generated content for human work without knowing it.
There is a second change, quieter but just as real: the AI literacy obligation. It has existed since February 2, 2025, but until now nobody could enforce it. Since August 2, 2026, failing to train your teams in the use of AI has become a breach that authorities can act on.
The European Commission has also had its supervisory powers reinforced over providers of general-purpose models - the companies behind ChatGPT, Claude, Gemini and the rest. That does not affect you directly as an end user, but it does mean the tools you rely on every day are themselves under closer watch.
The most common mistake: high-risk rules are delayed
If you read that your company had to be compliant with the "high-risk" rules by August 2, 2026, you were misinformed. Those obligations do not apply yet - and that is good news for the vast majority of small businesses.
What many articles announced, and got wrong
Automated hiring, credit scoring, biometrics and certain uses in education are examples of "high-risk" systems. Many outlets claimed they had to be compliant by August 2, 2026. That is not the case. Those obligations have been pushed back to December 2, 2027 for standalone systems, and to August 2, 2028 for systems embedded in products that are already regulated, such as medical devices or connected toys.
So if you use automated CV screening software or a scoring tool to assess credit applications, you have more time than you were told to get compliant. But do not conflate the two regimes: the Article 50 transparency rules apply already, with no grace period. High risk and transparency are two separate systems, on two different clocks.
Are you covered? Three questions to find out
You do not need a lawyer to work out whether the AI Act applies to you. Three questions are enough to place your situation - and for most small business owners the answer fits in one sentence: you are covered by transparency, you are probably not covered by high risk.
For a sense of scale, take the French market, where adoption lags the rest of Europe: 40 % of French companies have adopted AI, against a 54 % European average. Both figures come from Unlocking France's AI Potential 2026, run by Strand Partners for AWS across 1,000 French companies. Among those that have adopted AI, 64 % use it only in basic ways: automating repetitive tasks or deploying off-the-shelf tools. Among small and mid-sized businesses, Bpifrance Le Lab counts only one in three using AI daily, from a survey of 1,209 executives. If that description fits you, you are in the majority, and the questions below concern you directly.
1. Do you generate content with an AI and then publish it?
If you use ChatGPT, Midjourney or an equivalent tool to produce text, images or video that you publish on your site, your social channels or in your communications, the Article 50 marking obligation applies to you. It is not hard to comply with, but it does mean doing it deliberately rather than by default.
2. Does a visitor to your site interact with a chatbot or a biometric recognition system?
If you have installed a customer support chatbot, or a tool that analyses your users' emotions or faces, you have to say so clearly. Again, that is a transparency obligation, not a high-risk one.
3. Do you use a system that makes automated decisions with a heavy impact on people?
Automated hiring, credit scoring, access to an essential service: if the answer is yes, you are potentially in the "high-risk" regime. But remember that its obligations only come into force in December 2027, or even August 2028. You have time to get organised - no reason to panic.
If you answered yes only to the first two questions, you can move ahead calmly with the checklist below. If you answered yes to the third, it is worth starting to document your processes now, even though the legal deadline is still far off - that kind of work is rarely done well under time pressure.
If you are not sure which tools your team actually uses day to day, our complete beginner's guide to AI helps you take stock. And if you are looking for free options to cover your everyday needs, our comparison of the best free AI tools is a good starting point.
What to do, concretely, this week
No need for a three-month legal audit. Here are the concrete actions a small business can put in place this week to be in line with the obligations that already apply.
- List the AI tools your team actually uses: writing, visuals, chatbot, customer support.
- Add a visible note to the content you publish that was generated or heavily modified by AI (blog post, visual, video).
- Check that your chatbot or conversational assistant introduces itself clearly as an AI, not as a human.
- If you use an emotion recognition or biometric categorisation tool, inform the people concerned.
- Train your team in the basics of responsible AI use - the literacy obligation is now enforceable, and a single awareness session is enough for many small businesses.
- If you are considering a system with a heavy impact on people (hiring, credit), start documenting your processes. You have until late 2027 or 2028, but you may as well get ahead.
This list is not exhaustive, but it covers the bulk of what is enforceable today. None of these actions requires a serious budget or deep legal expertise: it is mostly about making visible what was already happening quietly inside your company, and making sure your team knows why. If you are on your own or in a very small team, these six points amount to half a day of real work - the hard part is usually starting, not doing them.
You do not have to do all of it in one week. What matters is starting: a checklist scribbled today beats an audit postponed indefinitely.
Penalties, tier by tier
Article 99 of the regulation sets three tiers of penalties, not a single headline number - and a specific rule protects SMEs and startups. Here is how it breaks down.
| Breach | Cap | Reference |
|---|---|---|
| Prohibited practice (Article 5) | €35M or 7 % of global turnover | Art. 99 §3 |
| Provider, deployer and importer obligations — including Article 50 transparency | €15M or 3 % of global turnover | Art. 99 §4 |
| Incorrect or misleading information supplied to the authorities | €7.5M or 1 % of global turnover | Art. 99 §5 |
In each case it is the higher of the two amounts that applies - except for you. Article 99 §6 caps fines for SMEs and startups at the lower of the two thresholds, not the higher. That difference matters: for a small company, the real cap almost always lands on the fixed amount rather than the percentage of turnover.
Two figures circulate wrongly. The "6 % of turnover" comes from an earlier draft and does not appear in the adopted text. And the €7.5M figure is often presented as the penalty for transparency breaches: that is inaccurate, Article 50 transparency sits in the €15M tier.
For a company whose turnover is modest on a European scale, that lower cap changes real exposure quite a lot: worth knowing before panicking at headlines that compare the AI Act to the GDPR without ever mentioning this carve-out in favour of small players.
The full timeline through 2028
The AI Act has been rolling out in phases since February 2025, and two deadlines remain beyond August 2, 2026 if you are considering higher-impact systems. Here is the complete timeline.
| Date | What applies |
|---|---|
| February 2, 2025 | Prohibited practices, governance, AI literacy obligation |
| August 2, 2025 | Rules for general-purpose AI models (GPAI) |
| August 2, 2026 | Transparency (Article 50) applicable, authorities empowered to fine |
| December 2, 2027 | Standalone high-risk systems |
| August 2, 2028 | High-risk systems embedded in already regulated products |
The line to remember is the middle one: that is the one that concerns you today. For now, the last two deadlines only ask one thing of you - do not forget them, and document your high-impact AI projects as you go rather than at the last minute.
For a wider view of the European debate between regulation and competitiveness, and the political context the AI Act sits in, our article on AI regulation in Europe versus innovation covers the bigger picture.
FAQ - Frequently asked questions
Here are the questions small business owners ask most often about the AI Act, with short, sourced answers and no unnecessary legal jargon, so you can make up your mind quickly.
Does the AI Act apply to my small business if I am based outside the EU?
Yes, in most cases. The AI Act applies to any company that develops or deploys AI systems in the European Union, whatever its size, and it follows the market rather than the head office. A small business based in Manchester, Austin or Toronto that sells to European customers and publishes AI-generated content falls under the Article 50 transparency obligations, exactly like a large European group.
I only use ChatGPT to write internal emails. Am I covered?
The Article 50 marking obligation covers published content, not internal use such as drafting emails. But as soon as you publish something generated or heavily modified by AI - a blog post, a social media update, a visual - transparency applies.
What are the penalties if I ignore the transparency obligation?
A breach of the Article 50 transparency obligation falls under the tier set by Article 99 §4 of the regulation: up to 15 million euros or 3 % of global annual turnover, whichever is higher. For SMEs and startups, Article 99 §6 caps the fine at the lower of the two thresholds, which changes real exposure considerably. Beware of two figures that circulate wrongly: the 6 % of turnover comes from an earlier draft and does not appear in the adopted regulation, and the 7.5 million euro figure is sometimes mistaken for the transparency penalty, which in fact sits in the 15 million euro tier.
Do I already have to comply with the high-risk rules?
No, not yet. Those obligations have been pushed back to December 2, 2027 for standalone high-risk systems, and to August 2, 2028 for systems embedded in products that are already regulated, such as medical devices or connected toys. If you do not use automated recruitment, credit scoring or biometrics, this does not concern you right now.
What is the AI literacy obligation, and does it apply to me?
It is the obligation to train your teams in a minimum, responsible use of AI. It has existed since February 2, 2025, but it only became enforceable - that is, punishable - on August 2, 2026. Any company that deploys or uses AI systems is covered, including small businesses.
Who enforces the AI Act?
Since August 2, 2026, the competent national authorities in each member state have had the power to investigate breaches and impose fines. The European Commission holds extended supervisory powers specifically over providers of general-purpose AI models.
How do I actually label AI-generated content?
The regulation asks for marking in a machine-readable format for images, video and audio generated or modified by AI, and disclosure of artificial origin for published text. In practice, a visible note along the lines of content generated with the help of AI on the published item meets the spirit of the text.
What to remember
August 2, 2026 did not turn AI compliance into an obstacle course for small businesses. What applies today is handled with a checklist and a training session, not with a dedicated legal department. The part that scares people - high risk - does not come into force until 2027 and 2028.
If you take one thing from this article: you are probably covered by transparency, you are probably not covered by high risk, and the penalty cap for a small business is the lower of the two thresholds, not the higher. Take the time to list your AI tools this week, train your team, and document what you do - that is more than enough to be in order today.
Check it yourself
On a regulatory topic, do not take my word for it. The consolidated text of Regulation (EU) 2024/1689 is public on EUR-Lex, and Article 99 sets out the penalty regime paragraph by paragraph. The European Commission keeps its page on the regulatory framework for AI up to date, timeline included.
Want to follow how this file evolves? Subscribe to the EverydayAITech newsletter to get my decoded analyses every week.
🚀 Stay ahead on AI
Get the latest AI news, tools and tips delivered to your inbox every week.
About the author: Flavien Hue has been testing and analyzing artificial intelligence tools since 2023. His mission: democratizing AI by offering practical and honest guides, without unnecessary technical jargon.