Contents11
- 01Are you a “deployer” or a “provider” under the AI Act?
- 02What applies, and since when?
- 03Which uses of AI have been prohibited since 2025?
- 04When does a use of AI become “high-risk”?
- 05Does a chatbot have to say it is an AI?
- 06What does “AI literacy” mean for your teams?
- 07What does the GDPR already require when you use AI?
- 08Eight steps to use AI within the rules
- 09What does an SME that does nothing risk?
- 10Where to start
- 11Frequently asked questions
The AI Act is not aimed only at the developers of models. An SME that has ChatGPT write its proposals or lets its CRM score its prospects is using AI, and both the European regulation and the GDPR already give it obligations, most of which come down to a few organisational steps.
This guide, from our Business AI: private and at the right cost section, takes stock in October 2026, on the text as revised in July 2026. These obligations are part of the rules to set, the last of the five questions in our guide to integrating AI in business. It is not legal advice: for a sensitive use, have your case checked by your data protection officer (DPO) or a lawyer.
In short
Your obligations depend on your role: having an assistant developed and running it under your name makes you a provider, with more obligations.
The timetable: 2 February 2025 for the prohibitions and AI literacy, 2 August 2026 for transparency, 2 December 2027 for high-risk systems (recruitment, staff, credit).
The GDPR comes on top: a contract with each supplier, a register, an impact assessment if the risk is high.
The starting point is an inventory of your uses, including the accounts opened by your teams.
Are you a “deployer” or a “provider” under the AI Act?
Your obligations depend on your role. According to Article 3 of the AI Act, a deployer uses “an AI system under its authority”, in a professional setting. An SME that opens ChatGPT or Copilot accounts for its teams, or that switches on the AI in its CRM, is a deployer.
A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether or not it charges for it. An SME that has an assistant developed and runs it under its own name therefore becomes its provider, with additional obligations.
A common case is fine-tuning a model on your own data. According to the CNIL (France’s data protection authority) in its questions and answers on generative AI, it makes you responsible for it, including as a provider under the AI Act, “but only in respect of that fine-tuning”.
What applies, and since when?
Regulation (EU) 2024/1689 applies in stages, according to Article 113, in the version revised by Regulation (EU) 2026/1744 of 8 July 2026, which postponed the high-risk rules:
- 1 August 2024
The regulation enters into force.
- 2 February 2025
Prohibited practices (Article 5) and AI literacy (Article 4), for every company that uses AI.
- 2 August 2025
Penalties apply.
- 2 August 2026
Transparency (Article 50) for chatbots, deepfakes and some generated text, for their providers and deployers.
- 2 December 2026
Two prohibitions added by the revision, on intimate images generated without consent and on child sexual abuse material.
- 2 December 2027
Rules for the high-risk systems of Annex III, including Article 26, for recruitment, staff management and credit.
- 2 August 2028
Rules for high-risk systems built into products that are already regulated (Annex I).
Which uses of AI have been prohibited since 2025?
Article 5 lists the prohibited practices. Three can concern an SME:
- inferring the emotions of your employees at work, except for medical or safety reasons: a tool that read the mood of your sales staff in their voices or on their faces in a video call is prohibited;
- scoring people on the basis of their social behaviour or personality, when that score leads to their being treated unfavourably outside the context in which the data was collected, or in a disproportionate way;
- manipulating a person, or exploiting a vulnerability linked to their age, a disability or their social or economic situation, in a way that causes them significant harm.
A tool that does any of these things must be stopped, whatever the size of the company.
When does a use of AI become “high-risk”?
High risk depends on the use, not on the tool. Among the areas of Annex III of the regulation, four concern an SME:
- recruitment: targeted job adverts, sorting of applications, evaluation of candidates;
- staff management: promotion, dismissal, task allocation, performance monitoring;
- a person’s creditworthiness or credit score, excluding fraud detection;
- pricing of life and health insurance.
Watch out
Article 6 provides for exemptions, for example for a narrow procedural task or a preparatory task, but an Annex III system that profiles people is “always” high-risk.
From 2 December 2027, the deployer of a high-risk system must, according to Article 26:
- use it in accordance with its instructions for use;
- assign human oversight to people “who have the necessary competence, training and authority”;
- monitor it, suspend it if there is a risk and report serious incidents;
- keep the system’s logs for at least six months;
- inform the employees concerned and their representatives before using it at work;
- inform the people subject to a decision that it makes or helps to make.
For credit and insurance, Article 27 adds an impact assessment on fundamental rights. A system already in service before that date is covered only if it later undergoes significant changes in its design (Article 111). The GDPR already governs these decisions through its Article 22, presented below.
Does a chatbot have to say it is an AI?
Yes, since 2 August 2026. Article 50 requires that people know they are interacting with an AI system “at the latest at the time of the first interaction”, unless that is obvious to a person who is “reasonably well-informed, observant and circumspect”.
The text places this obligation on the provider: if your chatbot was developed for you and runs under your name, it is yours. With a software vendor’s tool, it is first the vendor’s, but you choose what your visitors see, and a first message announcing an automated assistant settles the matter.
The same article requires deepfakes, and certain generated texts published to inform the public, to be flagged, unless there has been human review under editorial responsibility.
What does “AI literacy” mean for your teams?
This is the obligation that concerns the most SMEs. In its version rewritten in July 2026, Article 4 asks you to take “measures to support the development of AI literacy” in your staff and in those who use these systems for the company, without any obligation to “guarantee any specific level of AI literacy of any individual”. It is a best-efforts obligation: no qualification to demand, but an approach you can demonstrate, and the European Commission is to publish practical examples of how to comply.
The CNIL points out who is answerable:
In the general case, it is the user organisation that will bear legal responsibility if its staff misuse AI.
A useful training course comes down to three points:
- a generative model is not a knowledge base: it produces the most probable answer, not necessarily the true one;
- some data never goes into a consumer service: personal data, trade secrets;
- every answer is checked and not copied as it stands.
What does the GDPR already require when you use AI?
As soon as a model receives personal data, that is processing within the meaning of the GDPR. Three articles in its Chapter IV matter here:
- Article 28: a contract with each service provider that processes data for you, the model’s developer included, which also governs transfers;
- Article 30: an entry in your register of processing activities;
- Article 35: an impact assessment (DPIA) before any processing that poses a high risk to individuals.
Article 22 additionally governs decisions based solely on automated processing, and Chapter V transfers outside the Union.
The CNIL specifies that a company that connects a model to its own knowledge base (RAG) is responsible for that processing when the base contains personal data. How it works is explained in RAG applied to a company’s documents.
Eight steps to use AI within the rules
- Take an inventory of your uses
Do not forget the accounts your teams opened on their own, and note for each one the data it receives.
- Classify your data
What can go to a supplier, what stays with you. The options are compared in the four levels of private AI.
- Write a usage policy
The CNIL recommends a policy “clearly defining the authorised and prohibited uses”. Our guide to AI governance offers one, the company AI policy in five lines.
- Train your teams
Keep a record of who was trained and when.
- Set the rules with your suppliers
Contract, transfers, and reuse of your data switched off when the plan allows it.
- Keep the register
Also carry out the impact assessment if one is required, with your DPO if you have one.
- Inform the people concerned
The visitors to your chatbot and, for a high-risk tool used at work, the employees and their representatives.
- Review regularly
Once a year for example, ask users for their views on the system’s usefulness and limits; the CNIL recommends gathering them during the first months and first years of use.
What does an SME that does nothing risk?
The penalties in Article 99 have applied since 2 August 2025, and their ceiling depends on the breach:
of worldwide annual turnover or €35 million: the ceiling for a prohibited practice
of worldwide annual turnover or €15 million: the ceiling for a breach of the deployer or transparency obligations
For each breach, the ceiling applied is the higher of the two as a general rule, and the lower of the two for an SME. The text also provides for warnings and non-monetary measures, and Member States take the interests of SMEs and their economic viability into account.
The GDPR has its own penalties, imposed in France by the CNIL. The most common risk remains what you do not see: a customer file pasted into a consumer account, a decision about an employee that nobody can explain.
Where to start
The inventory and the classification of data come first: they feed the register, show whether a use is approaching high risk and prepare the policy. On its page using generative AI in very small businesses and SMEs, the CNIL gathers the four practical guides from France Num (a French government programme that helps small businesses go digital), designed with the CPME (a French federation of small and mid-sized companies) and the CNIL.
To get a written grid of what can go to which supplier, and models tested on your own content, see our AI at the right cost offer. For a high-risk use, your DPO or a lawyer has the last word.
Frequently asked questions
Does an SME that only uses ChatGPT fall under the AI Act?
Yes, as a deployer: it must look after AI literacy among the people who use it and must not use it for a prohibited practice. The high-risk rules concern it only if it uses AI to recruit, manage its staff or score credit. The GDPR, for its part, applies as soon as personal data is entered.
What changes on 2 August 2026?
The regulation becomes applicable as a whole, with a few exceptions. For an SME, what is new is transparency: a chatbot must present itself as one, unless that is obvious, and deepfakes must be flagged. The July 2026 revision, on the other hand, postponed the Annex III high-risk rules to 2 December 2027.
Can you enter customer data into ChatGPT?
Not with a consumer account. With a business plan, you need a data-processing contract, controlled transfers and reuse of your data switched off where possible. The CNIL advises avoiding, as far as possible, sending personal data to a service used through an API, and writes that an on-premises deployment generally seems safer for such data and for sensitive documents.
Do you need an impact assessment (DPIA) to use AI?
Not systematically. The GDPR requires one before processing that carries a high risk, for example a systematic and extensive evaluation of individuals, based on automated processing, that is used to make decisions significantly affecting them. Your DPO, if you have one, must be consulted, and for a high-risk system, the provider’s information helps in carrying it out.
Sources
- Article 3 of the AI Act (new tab)ai-act-service-desk.ec.europa.eu
- Its questions and answers on generative AI (new tab)cnil.fr
- Article 113 (new tab)ai-act-service-desk.ec.europa.eu
- Article 5 (new tab)ai-act-service-desk.ec.europa.eu
- Annex III of the regulation (new tab)ai-act-service-desk.ec.europa.eu
- Article 6 (new tab)ai-act-service-desk.ec.europa.eu
- Article 26 (new tab)ai-act-service-desk.ec.europa.eu
- Article 50 (new tab)ai-act-service-desk.ec.europa.eu
- Article 4 (new tab)ai-act-service-desk.ec.europa.eu
- Chapter IV (new tab)cnil.fr
- Article 22 (new tab)cnil.fr
- Chapter V (new tab)cnil.fr
- Article 99 (new tab)ai-act-service-desk.ec.europa.eu
- Using generative AI in very small businesses and SMEs (new tab)cnil.fr
Jim · founder of Brain Plus AI
Also in business ai
Choose and price9 min
Private AI in business: the four levels of control
A "private" AI is not a product, it is a degree of control over your data. We distinguish four levels, from an API used as is to a model installed on your premises, and a simple way to choose task by task.
Stepping back8 min
Automated decisions: can AI decide on its own?
An algorithm may be more consistent than a manager in a hurry, but a decision that affects a person's life has to be explainable and open to challenge. The law leans clearly one way: the two positions, our view, and the rule to adopt without waiting for 2027.
Stepping back8 min
Should you disclose that a text was written by AI?
Transparency owed to the reader, or a detail of how the text was made, like a spell checker? The EU AI Act settles it only halfway, with a criterion that is useful well beyond the law: does a human answer for the text?