The EU AI Act for a 10-person business: what applies, and when

If your business only uses AI tools such as ChatGPT or Copilot, the EU AI Act calls you a “deployer”, and three things apply to you today: help your staff understand the tools, avoid a short list of banned uses, and tell people when they’re talking to a bot or looking at a deepfake. Heavier duties apply only if you use AI to make decisions about people, such as hiring, staff reviews or credit, and the 2026 changes pushed those to 2 December 2027. Most of the rest of the law is written for the companies that build AI.

This is our reading of Regulation (EU) 2024/1689 as amended in July 2026, as of October 2026. It isn’t legal advice.

You’re a “deployer”, and that’s the light role

A provider develops an AI system, or has one developed, and puts it on the market or into service under its own name (Article 3(3)). A deployer is anyone “using an AI system under its authority”, except for personal, non-professional use (Article 3(4)). A 10-person firm that pays for ChatGPT or uses Copilot in Outlook is a deployer. OpenAI and Microsoft are the providers, and most of the paperwork is theirs.

You can become a provider without meaning to. The Commission’s transparency guidelines say an organisation that builds a chatbot in-house and runs it under its own name is its provider. Because the definition covers AI you “have developed” too, we’d assume the same for a chatbot someone builds for you. Using a general tool for a high-risk job can do it too (more on that below).

Article 4: help your team understand the tools

Article 4, on “AI literacy”, has applied since 2 February 2025. The Digital Omnibus on AI softened it in July 2026. Instead of ensuring “a sufficient level of AI literacy”, you now “take measures to support the development of AI literacy” of the people who use AI for you, and you don’t have to guarantee any particular level.

The Commission’s AI literacy Q&A covers the ChatGPT case directly: a company whose staff use it to write ad copy or translate text has to comply, and they “should be informed about the specific risks, for example hallucination” (an AI stating something false with confidence). No certificate is needed. An internal record of the training is enough.

For a small firm, we’d read that as a one-page note: which AI tools are approved, what data never goes into them, and that a person checks the output before it’s used.

Article 5: the banned uses, and the one that can reach an office

The bans in Article 5 have also applied since 2 February 2025. Most cover things a small business won’t do, such as social scoring or live facial recognition by police.

The one an ordinary business could walk into is point (f): AI that infers the emotions of people at work is banned, except for medical or safety reasons. A call-centre add-on that scores your staff’s mood from their voice falls under it.

From 2 December 2026, the Omnibus adds two bans: AI that generates sexual images of a real, identifiable person without consent, and child sexual abuse material.

Article 50: tell people when it’s AI

The transparency rules in Article 50 have applied since 2 August 2026. Three parts matter here:

• Chatbots. People talking to an AI must be told, unless it’s obvious (Article 50(1)). The duty is the provider’s, so an off-the-shelf support widget should handle it. If the bot runs under your name, assume the duty is yours. Assistants we build carry a clear label for this reason.
• Deepfakes. If you publish AI-made or AI-altered images, audio or video that resemble real people, places or things and could pass as real, you must say so (Article 50(4)). The guidelines count an AI product photo that makes the product look better than it is. A real product shown against an AI background usually doesn’t count, as long as it doesn’t mislead.
• Text. Only AI text published to inform the public on matters of public interest needs a label, and not if a person reviewed it and someone holds editorial responsibility. The guidelines put ads and product descriptions outside this rule unless they make health, safety or sustainability claims. Emails and internal documents don’t count as published.

The notice must be clear and come at the first interaction at the latest (Article 50(5)). A separate 2 December 2026 deadline, for hidden watermarks, is the providers’ job.

Hiring, staff reviews and credit: high-risk from December 2027

Annex III lists the “high-risk” uses. Two can reach a small business: AI used to recruit, filter or evaluate candidates, or to decide on promotions, dismissals, tasks or performance (point 4), and AI that judges whether a person is creditworthy (point 5(b)), which could matter if you sell on instalments.

If you use a tool built for one of these jobs, Article 26 asks you to:

• use it as the provider’s instructions say
• give a trained person the authority to oversee it
• keep its logs for at least six months
• tell staff before you use it at work, and tell people when it helps decide about them
• stop using it, and tell the provider and the authority, if it seems to put people at risk

The Omnibus moved these from 2 August 2026 to 2 December 2027.

The trap is a general tool used for one of these jobs. Under Article 25(1)(c), if you turn an AI system, “including a general-purpose AI system”, to a high-risk purpose, you become its provider, with the conformity checks and documentation that brings. The Commission’s draft guidelines on high-risk classification (May 2026, still a draft as of October 2026) agree, and treat a tool that ranks candidates as high-risk even when recruiters can override it.

So in our reading, pasting fifty CVs into ChatGPT and asking for the top five could make you a provider. Scheduling interviews or sending “we got your application” emails are narrow tasks that the draft guidelines leave outside the high-risk rules. If you want AI anywhere near a hiring or credit decision, talk to a lawyer first. See also our post on approval steps.

The dates, after the 2026 changes

The Commission proposed the Digital Omnibus on AI on 19 November 2025. It became Regulation (EU) 2026/1744, published on 24 July and in force since 27 July 2026. It moved the high-risk dates, softened Article 4 and added the two new bans. Its relief for SMEs and slightly larger “small mid-caps” mostly lightens providers’ paperwork. It left the deployer duties in Articles 26 and 50 as they were.

Date	What applies	Touches you?
2 Feb 2025	AI literacy, banned uses	Yes
2 Aug 2025	Rules for AI model makers	Your suppliers
2 Aug 2026	Labelling; enforcement starts	Yes
2 Dec 2026	Two new bans	Yes
2 Dec 2027	High-risk uses (Annex III)	If hiring or credit
2 Aug 2028	AI inside regulated products	Rarely

Fines, and who enforces them in Romania

Under Article 99, a banned use can cost up to 35 million euros or 7% of worldwide turnover, and a breach of the deployer or labelling duties up to 15 million euros or 3%. Larger companies face whichever is higher. An SME, which a 10-person firm normally is, faces whichever is lower (Article 99(6)). With an illustrative turnover of 1 million euros, the ceilings are 70,000 and 30,000 euros. Article 4 has no fine level of its own; national law sets it.

In Romania, a government memorandum proposed ANCOM as the main market surveillance authority. In a statement on 24 July 2026, ANCOM said the national law was still being drafted and that no authority can sanction anyone until it’s in force. As of October 2026 we couldn’t find an adopted law. The duties apply anyway.

What you can ignore, and a check to run this week

Unless you build AI products, you can set aside the rules for AI models, conformity assessments, CE marking, technical documentation, EU database registration and watermarking. Those are provider duties.

Then run this check:

1. List every AI tool your team uses, and what for.
2. Mark anything that touches hiring, staff reviews or credit decisions, and take those to a lawyer well before December 2027.
3. If you have a website chatbot, check that its first message says it’s an AI.
4. Look through your marketing for realistic AI images of people, or product shots that flatter the real thing, and label them.
5. Write the one-page AI note, go through it with the team, and keep the date.

The Commission’s free AI Act Compliance Checker is a rougher version of step 2. If you’re about to put AI into a process, our free automation plan maps the steps and where a person signs off, which helps with step 1.