Most of what's written about the EU AI Act is aimed at companies that build AI: model developers, software vendors, makers of medical devices. Most of our clients don't build AI. They use it. A chatbot on the website, product descriptions drafted with ChatGPT, a generated image on a landing page.
The Act has a name for that: a deployer. The obligations for deployers are lighter than the headlines suggest, but a few already apply, and one of them has been in force since February 2025.
This isn't legal advice and we're not lawyers. It's the practical orientation we give clients, with links to the official texts. For anything involving hiring, credit or customer data, talk to a lawyer.
Are you a provider or a deployer?
The AI Act (Regulation (EU) 2024/1689) defines both in article 3:
- A provider develops an AI system, or has one developed, and puts it on the market or into service under its own name or trademark, paid or free.
- A deployer uses an AI system under its own authority, except for purely personal, non-professional use.
If you use ChatGPT, Claude, Gemini, Canva's image tools or a chatbot widget from a vendor in your business, you're a deployer of those tools. The company that makes them is the provider.
It gets less clear when you build something yourself. If you have a chatbot built on top of a model and put it on your website under your own brand, you may count as the provider of that chatbot. That's a question for a lawyer, not a blog post, and it changes which paragraphs of the Act apply to you.
What is the timeline now?
The Act entered into force on 1 August 2024 and applies in stages. In 2026 the EU also adopted the AI Omnibus, Regulation (EU) 2026/1744 of 8 July 2026, which entered into force on 27 July 2026 and moved some dates. Where things stand today:
- 2 February 2025: Prohibited practices and the AI literacy obligation
- 2 August 2025: Rules for general-purpose AI models (the big model makers)
- 2 August 2026: General application, including the transparency obligations in article 50
- 2 December 2026: Deadline for providers of generative systems that were already on the market before 2 August 2026 to comply with the machine-readable marking duty in article 50(2). The Omnibus added this as article 111(4). The same day, two new prohibitions start to apply: AI that generates intimate or sexually explicit material of identifiable people without their consent, and AI that generates child sexual abuse material
- 2 December 2027: High-risk systems in the areas listed in Annex III, such as recruitment
- 2 August 2028: High-risk AI built into regulated products, such as machinery and toys
The high-risk dates were originally 2 August 2026 for Annex III and 2 August 2027 for products. The Omnibus moved both. It did not move the transparency obligations, which have applied since 2 August 2026. The only exception is the grace period above, and that one is for providers, not for you.
What has to happen when you use a chatbot?
The Act's starting point is that people must know when they're talking to a machine. Strictly, article 50(1) puts that duty on the provider: the system has to be designed so people are informed, unless it's obvious to a reasonably well-informed person.
In practice, if the chatbot is on your website, it's your customer who's talking to it. Our advice is simple: label it. A line above the chat window that says it's an automated assistant, and a way to reach a person. It costs nothing, it covers you whichever role you turn out to have, and it's honest.
Article 50(5) adds that the information has to be clear and distinguishable, and given at the latest at the first interaction.
Do you have to label AI-generated content?
Two separate obligations, and they're easy to mix up.
Marking (providers). Article 50(2) requires providers of systems that generate synthetic audio, images, video or text to mark the output in a machine-readable way, so it can be detected as AI-generated. That's a job for the tool maker, not for you.
Labelling (deployers). Article 50(4) is the one that applies to you as a user. Two cases:
- Deepfakes. If you publish image, audio or video that's AI-generated or manipulated and looks like real people, places or events, you have to disclose that. For obviously artistic, creative, satirical or fictional work, the disclosure can be light enough not to spoil it.
- Text on matters of public interest. If you publish AI-generated text to inform the public on matters of public interest, you have to disclose it. Unless the text has been through human review or editorial control and someone holds editorial responsibility for it.
For most small businesses, that second exception is the relevant one. A blog post drafted with AI, then read, corrected and published under the name of someone in the business, has had human review and has an editor. A stream of auto-published AI articles with nobody checking them hasn't.
The Code of Practice. On 10 June 2026 the European Commission published a voluntary Code of Practice on marking and labelling AI-generated content. It has a section for providers, on the machine-readable marking in article 50(2), and one for deployers, on the labelling in article 50(4), including deepfakes and public-interest text. The Commission has also published EU icons for labelling. Voluntary, but it's the clearest picture of what "disclose" looks like in practice.
What is the AI literacy obligation?
Article 4 has applied since 2 February 2025 to providers and deployers. As amended by the AI Omnibus, it says you have to take measures to support the AI literacy of your staff who use AI systems on your behalf. It explicitly doesn't require you to guarantee any specific level for any individual, and the Commission and Member States now have a bigger role in supporting businesses, with particular attention to SMEs.
For a small business, that means something modest and real: the people who use AI tools at work know what the tools are for, where they go wrong, what not to paste into them, and who checks the output. A short internal note and a conversation count for more than a certificate.
When does a small business hit high-risk?
Rarely, but it happens. Annex III lists the high-risk areas, and two of them reach ordinary businesses:
- Recruitment and work decisions. AI used to filter CVs, rank candidates, or make decisions about promotion, termination or performance monitoring.
- Creditworthiness. AI used to evaluate whether a person is creditworthy, other than for fraud detection.
If you use an HR tool that screens applicants with AI, you're a deployer of a high-risk system. Those obligations apply from 2 December 2027. That's the moment to get specific advice, not to rely on an article like this one.
Who checks, and what are the fines?
In Spain the agency created for this is AESIA, the Agencia Española de Supervisión de Inteligencia Artificial, set up by Real Decreto 729/2023. The Spanish law that formally assigns the supervisory roles under the Act was still a bill when we wrote this: the Government sent the proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial to Congress on 26 May 2026, and as of October 2026 it has not been published in the BOE. Under that bill most supervision goes to AESIA, with the AEPD and the CGPJ in their own areas, and AESIA is the single point of contact. AESIA's website already hosts the government's practical guides on complying with the Act.
Breaking the article 50 transparency obligations can lead to fines of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher. For SMEs and start-ups, it's whichever is lower. The point isn't the number. It's that labelling a chatbot and reviewing your content are cheap compared to any of it.
A short checklist for deployers
- List the AI tools your business uses, and who uses them
- Chatbot on your site: labelled as automated, with a route to a person
- AI-generated images or video of real-looking people or events: disclosed
- AI-drafted texts: reviewed by a named person before they go out
- A short internal note on what staff may and may not do with AI tools
- AI used in hiring or credit decisions: get legal advice before 2 December 2027
- Personal data in AI tools: checked against your privacy policy and GDPR
If you remember one thing
- Using AI tools makes you a deployer. Most of the heavy obligations are for providers and high-risk systems.
- Label your chatbot and disclose deepfakes. Review AI-drafted text before you publish it.
- AI literacy has applied since February 2025. A short internal note is a sensible start.
If we build or maintain your website, labelling a chatbot or adding a disclosure to generated content is a small change. Book the call if you want us to look at what's on your site now.
Sources
- Regulation (EU) 2024/1689, the AI Act (EUR-Lex)
- Regulation (EU) 2026/1744, the AI Omnibus (EUR-Lex)
- European Commission: AI Omnibus enters into force
- AI Act Service Desk: article 111, transitional provisions (as amended, including the new paragraph 4)
- AI Act Service Desk: article 113, entry into force and application (as amended)
- AI Act Service Desk: article 5, prohibited practices (as amended)
- European Commission: AI Act regulatory framework and timeline
- AI Act Service Desk: article 3, definitions
- AI Act Service Desk: article 4, AI literacy (as amended)
- AI Act Service Desk: article 50, transparency obligations
- AI Act Service Desk: article 99, penalties
- AI Act Service Desk: Annex III, high-risk areas
- AI Act Explorer: Digital Omnibus on AI, transition dates
- European Commission: Code of Practice on marking and labelling AI-generated content
- Real Decreto 729/2023, Estatuto de AESIA (BOE)
- Ministerio para la Transformación Digital: press note of 26 May 2026 on the proyecto de Ley Orgánica de gobernanza de la IA (PDF)
- AESIA: practical guides for AI Act compliance
Builds websites and the systems behind them for small businesses in Spain and the Netherlands. Writes down the things clients ask twice.
