The EU AI Act, Explained for Small Businesses

Disclaimer: General information, not legal advice.

If you run a small business and use AI through subscriptions, you are likely a deployer, not a provider. Heavy technical obligations belong to providers. However, basic duties still apply.

The active obligation: AI Literacy (Article 4)

In force since February 2025, Article 4 requires organisations deploying AI to ensure staff have an appropriate level of AI literacy.

A 6-step practical checklist

1. Create a 1-page AI tools register. List tools used, purposes, and data involved.
2. Classify your role. Deployer in most standard subscription cases.
3. Document AI literacy. Provide basic written rules and run a brief team review.
4. Check content labelling (Article 50). Label synthetic media where required.
5. Define strict prompt boundaries. State what confidential data must never enter prompts.
6. Assign responsibility. Name who inside the business governs AI usage.

Establishing clear governance for AI tools is part of the Organization pillar. Build a structured Brand DNA with openidea.biz and check your alignment with the Brand Foundation Check.