The EU AI Act Deadline Is Here: What Smaller Businesses Should Check First

Europe’s high-risk AI requirements are entering a decisive phase, and smaller businesses should not assume regulation matters only to the companies building frontier models.

An organisation may use AI inside recruitment, credit assessment, education, healthcare, security, customer service or workplace management. The legal obligations depend on the system and its use—not merely the size of the buyer.

The first practical step is an inventory. List every AI-enabled tool, its supplier, the data it receives, the output it produces and the person responsible for reviewing that output.

Next, identify systems capable of significantly affecting people. A tool that improves spelling is different from one that ranks job applicants or influences access to an essential service.

Supplier documentation also matters. Businesses should understand what the vendor promises, where data travels, how performance is tested and what happens when the model changes.

Human oversight must be real. A person cannot meaningfully review a decision if they lack time, information or authority to challenge it.

Compliance should not become a paperwork theatre. The point is to make risks visible before they become harm.

Smaller organisations do not need to solve every question alone, but they do need to know what they are using. Responsible AI begins when somebody can answer: what does this system do, and who is accountable for it?