AI · 4 min read ·
The EU AI Act for SMEs: what to do now
Do you use ChatGPT, Copilot or other AI tools? The EU AI Act also applies to users. Here is how to work out your role, the risk classes and the first steps.
AI has arrived in most companies without anyone noticing. Someone writes quotes with ChatGPT, someone else summarises meetings with Copilot, and a chatbot may be answering in customer service. The EU AI Act applies to all of this, not only to technology companies that develop AI.
The good news is that for most small and medium-sized businesses the obligations are reasonable. You do need to know them, though, and some have already been in force for a long time.
AI literacy has required action since February 2025
Article 4 of the Act requires a company that uses AI to ensure its staff have a sufficient level of AI literacy. The obligation has applied since 2 February 2025, and it concerns every company where AI is used at work.
In practice, employees need to understand what AI can and cannot do, what data may be entered into it and why its answers must be checked. No heavy qualification is required. Short training tailored to your own tools and clear usage guidelines often go a long way. Keep a record of the training so that you can show you have taken care of it.
Four risk classes
The Act divides the use of AI by risk:
- Prohibited practices: for example manipulating people, social scoring and emotion recognition in the workplace. These bans have applied since February 2025.
- High risk: AI that significantly affects people's position, such as screening job applicants, evaluating staff, assessing creditworthiness or critical infrastructure. These face the strictest requirements.
- Transparency obligations: for example a chatbot must say that it is AI, and AI-generated images or video must be labelled in certain situations.
- Minimal risk: most everyday use, such as drafting texts, translations and spam filtering. There are no special requirements, but the literacy obligation applies here too.
Changes have been proposed to the timetable for the obligations of high-risk systems, so treat exact future dates with caution. If you use AI in recruitment, for example, it is still worth starting your preparations now.
Deployer or provider?
The obligations depend on your company's role. A provider develops an AI system or puts it on the market under its own name. A deployer uses AI made by someone else in its own operations. Most companies are deployers.
For a high-risk system, the deployer must among other things use the system according to the instructions, appoint a competent person to oversee it, monitor its operation, keep the logs and tell employees if AI is used in decisions that concern them. The provider is responsible for the heavier work: risk management, technical documentation, conformity assessment and post-market monitoring.
Note that your role can change. If you build AI into your own product, sell it under your own name or substantially change what a system is used for, you may become a provider.
ISO/IEC 42001: a structure for managing AI
ISO/IEC 42001 is the standard for AI management systems. It helps organise the use of AI the same way ISO/IEC 27001 organises information security: responsibilities, risk assessment, rules and continuous improvement. The structure is consistent, so if you already have an information security management system, AI management can be added to it. Certification is not mandatory, but the standard is a good way to show customers that AI is used in a controlled way.
What should you do now?
- Map which AI tools are actually used in the company, including those nobody has officially acquired.
- Collect the tools in an AI register and assess the risk class of each and your own role.
- Write AI usage guidelines: what AI may be used for and what data must not be entered into it.
- Arrange AI literacy training and keep a record of it.
- Check the tools' data protection and security settings and the contracts.
- Make sure that AI visible to customers, such as a chatbot, says that it is AI.
Foregon helps you get AI under control in a practical way. Take a look at our AI services or the fixed-price AI Start package, which covers the mapping, risk classification, usage guidelines and literacy training in one go.