What the EU AI Act means for small businesses using AI agents

If you run a small business in Europe and use AI agents — a chatbot on your website, an n8n workflow that answers emails, a Zapier automation that screens leads — you've probably heard that the EU AI Act "applies to everyone". That's half true. It applies to almost everyone in some way, but for most small businesses the real obligations are short and very manageable.

This guide explains, in plain English, what the AI Act asks of a small business that uses AI agents rather than building AI models. It's not legal advice — whether and how the Act applies to you depends on your exact use case — but it should help you understand where you stand and what to do next.

The AI Act in one paragraph#

The AI Act (Regulation (EU) 2024/1689) is the EU's law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. Instead of regulating "AI" in general, it sorts AI uses into risk levels and attaches obligations to each one, depending on what role you play. A company training a large model has very different duties from a café using a chatbot to take reservations.

Step 1: Work out your role#

The Act mainly distinguishes between two roles:

• Provider — whoever develops an AI system (or has one developed) and puts it on the market or into service under their own name or trademark. OpenAI, Anthropic and Google are providers of the models. A software company selling an AI product is a provider of that product.
• Deployer — whoever uses an AI system in the course of their professional activity. A dental clinic using an AI receptionist is a deployer.

Most small businesses using AI agents are deployers. You connect a model to your tools and use it for your own business.

There's one important exception. If you build AI-powered automations and offer them to clients under your brand — as many automation agencies and freelancers do — you may be the provider of that system. Providers have more obligations, especially if the system falls into the high-risk category. If that's you, read the high-risk section carefully.

Step 2: Work out the risk level#

Prohibited practices#

A short list of uses has been banned since 2 February 2025. They include manipulative techniques that cause significant harm, exploiting people's vulnerabilities, social scoring, untargeted scraping of facial images, emotion recognition in workplaces and schools (with narrow exceptions), and certain kinds of biometric categorisation and predictive policing.

A normal business agent that answers emails or books appointments is nowhere near this list. But it's worth a quick sanity check — for example, an "AI that reads employees' emotions from webcam video" would be prohibited.

High-risk systems#

High-risk is where most of the Act's weight sits. It covers AI used in sensitive areas listed in Annex III, including:

• Employment — screening CVs, ranking candidates, deciding promotions or terminations, monitoring workers' performance.
• Access to essential services — assessing creditworthiness, pricing life and health insurance, evaluating eligibility for public benefits.
• Education — deciding admissions, grading, detecting cheating.
• Biometrics, critical infrastructure, law enforcement, migration and justice.

This is the category small businesses most often stumble into by accident. An n8n workflow that automatically rejects job applicants based on an AI score is very likely high-risk. The same workflow that only summarises CVs for a human who makes every decision is a much weaker case — the Act has specific carve-outs for systems that only perform narrow preparatory tasks and don't materially influence the outcome.

If you deploy a high-risk system, you have to (Article 26): use it according to the provider's instructions, assign human oversight to people with the competence and authority to do it, monitor how it works, keep the logs it generates (at least six months, unless other law says otherwise), make sure input data you control is relevant, and inform workers or affected people where required.

Limited risk: the transparency rules#

This is the category that touches almost every small business with a customer-facing AI. Under Article 50:

• Chatbots and voice agents must make it clear to people that they're talking to an AI, unless it's obvious from the context.
• AI-generated or manipulated images, audio and video that look real ("deepfakes") must be disclosed.
• AI-generated text published to inform the public on matters of public interest must be disclosed, unless it has gone through human review and someone takes editorial responsibility.

In practice: add a line like "You're chatting with our AI assistant" to your chatbot, and don't present AI-generated media as real.

Minimal risk#

Everything else — spam filters, drafting internal emails, summarising documents, categorising support tickets — is minimal risk. The Act adds no specific obligations here beyond AI literacy (below). Most back-office AI agents live in this category.

Step 3: Know the dates#

In late 2025 the European Commission proposed a "Digital Omnibus" package that would push back some high-risk deadlines and simplify parts of the Act, including for smaller companies. Check the current status of those changes before you plan around a specific high-risk date — but don't wait for them to start on the basics, which are useful either way.

The obligation that already applies to you: AI literacy#

Article 4 asks providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff who deal with AI systems on their behalf. It has applied since February 2025.

For a small business this doesn't mean certification. It means the people who set up and supervise your agents understand what the tools can and can't do, their typical failure modes (hallucinations, prompt injection, bias), and when to step in. A short internal guide, a one-hour session and a record that it happened go a long way.

What about fines?#

Fines under Article 99 go up to:

• €35 million or 7% of worldwide annual turnover for using prohibited practices,
• €15 million or 3% for breaching most other obligations (including deployer and transparency duties),
• €7.5 million or 1% for supplying incorrect or misleading information to authorities.

For large companies the higher of the two amounts applies. For SMEs and start-ups, it's the lower one. The Act also asks authorities to take the size and economic situation of the business into account. Nobody should panic over a missing chatbot disclaimer — but these numbers show the EU is serious, especially about high-risk and prohibited uses.

Don't forget the GDPR#

The AI Act sits on top of existing law, not instead of it. If your agents process personal data — and almost all customer-facing agents do — the GDPR still applies in full: a legal basis for processing, data minimisation, contracts with your AI providers, and the rules on solely automated decisions with legal or similarly significant effects (Article 22 GDPR). For many small businesses the GDPR remains the more immediate concern.

A practical checklist for small businesses#

1. List your AI agents. For each one, write down what it does, which tools it can use and what data it sees. Include "small" automations.
2. Classify each one. Prohibited (stop), high-risk (dig deeper, maybe get advice), transparency (add disclosures) or minimal risk.
3. Check your role. Using AI for your own business makes you a deployer. Selling AI automations under your brand may make you a provider.
4. Add AI disclosures to chatbots, voice agents and AI-generated media.
5. Keep humans in charge of consequential decisions. Hiring, credit, refunds, cancellations: let the agent prepare, let a person decide — and make that person's approval quick and recorded.
6. Keep logs. Record what each agent did, what it read and who approved what. If you're in the high-risk category, keep logs for at least six months.
7. Train your team. Give everyone who works with your agents a short briefing on how they fail and when to intervene, and write down that you did it.
8. Review your vendors. Check your AI providers' terms, data processing agreements and where data is stored.
9. Write it down. A two-page document that explains your agents, risk levels and oversight is worth more than you think when a client or authority asks.

Where Halto fits#

Halto was built for exactly the "keep humans in charge" and "keep logs" parts. It sits between your agents and their tools, checks each action against your rules, sends risky ones to your phone for approval and keeps an audit log of every action, every approval and who made it. On the Pro plan, it can generate an EU AI Act report that documents your human oversight and logging, so you can show your work to clients, auditors or regulators.

To be clear: no tool makes you "AI Act compliant" by itself, and Halto's report isn't legal advice. But good oversight and good records are the foundation of almost every obligation above, and they also happen to make your agents much safer to run.

If you'd like to see what that looks like for your own agents, you can start for free or compare plans.

---

This article is general information, not legal advice. The AI Act and its guidance are still evolving; for decisions about your specific situation, talk to a qualified lawyer.