This guide explains the rules in plain words. It is not legal advice. For a decision about your own business, ask a lawyer.
Who the rules apply to
The AI Act gives different duties to different roles. Two of them matter for a small business.
Most small businesses are deployers. Some are also providers without realising it: if you built your own chatbot on top of an AI model and run it on your site under your name, you may count as its provider. Using AI privately, outside your work, is not covered.
Size doesn't exempt you. A one-person business that uses AI in its work has the same transparency duties as a large one. What changes with size is the maximum fine (see fines below).
The four things to check
For most small businesses, the AI Act comes down to four questions. The first three are legal duties under Article 50. The fourth is good practice that makes the first three easy to show.
Does your chatbot say it's an AI? Article 50(1)
People must be told they are interacting with an AI system, unless it's obvious from the context. The legal duty sits mainly with the chatbot's provider, who must design it to tell people. But it's your website and your customers, so check what they actually see. The simplest fix is one sentence in the chatbot's first message.
Are realistic AI images, audio and video labelled? Article 50(4)
A deepfake is AI-made or AI-changed image, audio or video that looks like real people, objects, places or events and could falsely seem real. If you publish one, you must say it was made or changed with AI. For clearly artistic, satirical or fictional work, the label can be light, so it doesn't spoil the work. A product photo with an AI background that looks like a real place is worth labelling; an obvious cartoon is not a deepfake.
Is AI-written public-interest text disclosed? Article 50(4)
If you publish AI-generated text to inform the public on matters of public interest, you must disclose it, unless a person reviewed it and someone holds editorial responsibility. Ordinary product descriptions and marketing emails are usually not "matters of public interest". News-style articles about public matters can be.
Do you have an AI-use page? Good practice
No article of the AI Act asks for a page called "How we use AI". But a short page listing where you use AI, what it does and how to reach a person makes your disclosures easy to find and shows you took the rules seriously. Link it from your footer and your chatbot.
All disclosures must be clear and easy to notice, and given at the latest when the person first interacts with the AI or first sees the content.
The free AI Act check looks for a chatbot and AI images on your site and tells you what's missing. No login.
The duty on AI makers: machine-readable marking
Article 50(2) asks providers of generative AI, the tools that make text, images, audio or video, to mark what they produce in a machine-readable way, so it can be detected as AI-made. This is a duty for the makers of those tools, not for a business that uses them.
There is one transition: generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to add the marking. Systems released on or after 2 August 2026 had to mark from day one.
If you built your own generative tool and offer it to others, talk to a lawyer about this duty.
What does not apply to most small businesses
The high-risk rules
Most of the AI Act's length is about "high-risk" AI systems: strict rules on risk management, documentation and human oversight. They cover AI used in sensitive areas listed in the Act, and AI built into regulated products. A bakery's chatbot or an AI-written newsletter is not high-risk.
The AI "Digital Omnibus", in force since July 2026, moved these dates. The rules for high-risk systems listed in Annex III now apply from 2 December 2027, and for AI built into regulated products (Annex I) from 2 August 2028.
One area to watch: using AI to screen job applicants or make decisions about staff is a high-risk use. If you plan to do that, read up before December 2027.
The rules for general-purpose AI models
Companies that build large general-purpose AI models, the ones behind popular chatbots, have their own set of duties. A business that only uses those models through an app doesn't carry them.
What still applies: AI literacy
Since 2 February 2025, businesses that use AI have been expected to look after their staff's AI literacy. The Omnibus softened this to supporting staff AI literacy. In practice: a short briefing for anyone who uses AI at work on what it's good at, where it goes wrong, and your house rules.
Three common situations
A restaurant with a booking chatbot
The restaurant uses a chatbot from a booking software company. The software company is the provider and should have designed the chatbot to say it's an AI. The restaurant is the deployer. Its job: open the chat as a guest would, make sure the first message says it's an AI, and ask the software company to fix it if not. Keep a dated screenshot.
An online shop with AI product photos
The shop places its products in AI-made settings: a vase on a kitchen table that doesn't exist. If the picture could pass for a real photo, label it, for example "Image created with AI" under the picture. The product descriptions, written with an AI tool and checked by the owner, are ordinary marketing text and usually need no label.
A web agency running chatbots for clients
The agency builds a chatbot on an AI model and installs it on ten clients' websites under the agency's name. The agency is likely the provider, so the duty to design the chatbot to say it's an AI sits with it. Each client is a deployer and should still check its own site. If the agency's tool also makes images or text for clients, ask a lawyer whether the marking duty applies to it.
Fines
Breaking the Article 50 transparency rules can be fined up to €15 million or 3% of worldwide annual turnover, whichever is higher. For small and medium businesses and start-ups, the cap is whichever of the two is lower. National authorities enforce the rules, and fines are set case by case.
Your checklist, step by step
- List every place you use AI: website chatbot, social posts, images, emails, product texts, customer service, hiring.
- Open your website chatbot as a customer would. Does its first message say it's an AI? If not, change the greeting or ask your chatbot provider to.
- Go through the images, audio and video you published since 2 August 2026. Label any realistic AI-made or AI-changed ones.
- Check whether you publish AI-written articles about public matters. If you do, either have a person review them and take editorial responsibility, or add a disclosure.
- Write a short AI-use page and link it from your footer and your chatbot.
- Give your staff a 15-minute briefing on your AI rules. Note the date.
- Keep dated proof: screenshots of the chatbot greeting, labelled images and your AI-use page.
- Re-check every month, and every time you change your website or add an AI tool.
Example wording you can use
Short and plain works best. Adapt these to your business.
Hi! I'm Bakery Studio's virtual assistant, an AI. I can help with orders and opening hours. Want a person instead? Type "human".
Γεια σας! Είμαι ο ψηφιακός βοηθός του Bakery Studio, ένα σύστημα τεχνητής νοημοσύνης. Μπορώ να βοηθήσω με παραγγελίες και ωράριο. Θέλετε να μιλήσετε με άνθρωπο; Γράψτε «άνθρωπος».Image created with AI·
Photo edited with AI
Εικόνα δημιουργημένη με τεχνητή νοημοσύνη · Φωτογραφία επεξεργασμένη με τεχνητή νοημοσύνηThis article was written with the help of AI.
Το άρθρο γράφτηκε με τη βοήθεια τεχνητής νοημοσύνης.Put the chatbot sentence in the very first message, not behind a link. Put image labels on or right next to the image, where people see them.
Timeline
| Date | What applies | Who it affects |
|---|---|---|
| 2 Feb 2025 | AI literacy; banned AI practices | Everyone using or making AI |
| July 2026 | AI Digital Omnibus in force: high-risk dates moved, Article 50 unchanged | — |
| 2 Aug 2026 | Article 50 transparency: chatbots, deepfakes, public-interest AI text, marking | Most businesses using AI with customers |
| 2 Dec 2026 | Machine-readable marking for generative AI already on the market before 2 Aug 2026 | Makers of generative AI tools |
| 2 Dec 2027 | High-risk rules for Annex III uses (for example hiring) | Businesses using AI in listed sensitive areas |
| 2 Aug 2028 | High-risk rules for AI in regulated products (Annex I) | Product makers |
How Omni Agent helps
The AI Act Officer is a bot that checks your website every month. It finds your chatbot and checks its greeting, looks for AI images without a label, writes and updates your AI-use page, fixes what it can with your OK, and keeps dated proof of each check. It is part of the EU Compliance Team. Omni Agent checks and fixes what it can and keeps dated proof. It is not legal advice.
Questions
I'm a one-person business. Does the AI Act apply to me?
Yes, if you use AI in your work in the ways Article 50 covers, such as a chatbot on your website or realistic AI images. There is no size exemption for these transparency rules. The maximum fine for small businesses is the lower of €15 million or 3% of turnover.
Was Article 50 delayed by the Digital Omnibus?
No. The Omnibus moved the high-risk rules to 2 December 2027 and 2 August 2028. The transparency rules in Article 50 still apply from 2 August 2026. The only transition is for machine-readable marking by makers of generative AI already on the market, until 2 December 2026.
I use AI to write my product descriptions. Do I have to label them?
Usually not. The text rule covers AI-written text published to inform the public on matters of public interest, and ordinary product descriptions usually aren't that. Many businesses mention AI use on an AI-use page anyway.
Do AI images on my social media need a label?
If an image could be mistaken for a real photo of real people, objects, places or events, yes: say it was made or changed with AI. Many social platforms also offer their own AI label, which you can use.
Does Omni Agent make me compliant?
The AI Act Officer checks your website, fixes what it can with your OK, and keeps dated proof. It covers the common Article 50 cases for small business websites. It is not legal advice, and it doesn't replace a lawyer for unusual cases.
Sources
- Regulation (EU) 2024/1689, the AI Act, EUR-Lex. Articles 3, 4, 50 and 99.
- EU AI Act Omnibus agreement: postponed high-risk deadlines and other key changes, Gibson Dunn.