- Since August 2, 2026, three concrete Article 50 transparency obligations apply: disclose that a chatbot is AI, label AI-generated or AI-edited content, and mark deepfakes as artificial.
- These obligations apply to deployers, not just developers — under the Act, a deployer is anyone using an AI system under their own responsibility, even if they built none of it. Running ChatGPT for support tickets makes an SMB a deployer.
- Fines are capped by proportionality for SMEs and small mid-caps: the ceiling is whichever is lower of the percentage or fixed amount, not whichever is higher — in practice, 3% of turnover is the real ceiling for most small businesses, not the €15M headline figure large enterprises face.
- Almost none of the enterprise-tier obligations (conformity assessments, technical documentation for high-risk systems, foundation-model provider duties) apply if you’re using off-the-shelf tools like ChatGPT, Claude, or Gemini rather than building or fine-tuning your own model.
The bottom line: if a small business is using ChatGPT, Claude, or Gemini for support tickets, content, or internal workflows — not building or fine-tuning a model — the EU AI Act’s August 2026 transparency rules apply, but the enterprise-scale compliance machinery most coverage describes does not. Our earlier coverage of the EU’s slow-moving AI safety rules flagged this transparency deadline as the next concrete enforcement date to watch, and it has now arrived. Most SMBs panic-read headlines written for foundation-model providers like OpenAI and Anthropic, when almost none of that tier applies to a company just using their tools.
What actually changed on August 2, 2026?
The European Commission’s transparency obligations under Article 50 took effect: providers and deployers of AI systems must disclose when a user is interacting with a chatbot rather than a human, label content that was generated or substantially edited by AI, and mark synthetic audio, image, or video content (deepfakes) as artificial. These are disclosure requirements, not design or safety requirements — the bar is telling people they’re dealing with AI, not proving the AI is safe.
Does the EU AI Act even apply to a small business that didn’t build an AI model?
Yes, and this is the part most SMBs miss. The Act’s obligations attach to two roles: providers (who build or substantially modify a model) and deployers (who use an AI system under their own responsibility). This is the same adoption pattern our SMB AI adoption gap analysis found driving most small-business AI usage: tool-first, model-agnostic. A small business running customer support through ChatGPT, drafting marketing copy with Claude, or generating product images with Gemini is a deployer under that definition — even though it wrote zero lines of the underlying model. The transparency obligations under Article 50 explicitly apply to both roles, including small and mid-sized deployers.
Watch out: “I just use the tool, I didn’t build it” is not an exemption. It’s the exact scenario Article 50 was written to cover.
What do SMEs and small mid-caps get that large enterprises don’t?
Proportionality on penalties. The Act caps fines at whichever is lower — the percentage of turnover or the fixed euro amount — for SMEs and small mid-caps, including startups. Large enterprises face fines up to €15 million or 3% of global annual turnover, whichever is higher. For most small businesses, that flip means the real ceiling is 3% of turnover, not the €15M headline number that dominates coverage. Compliance guidance is also required to take company size into account, with separate performance indicators expected for SMEs versus larger providers.
What does NOT apply if you’re just using off-the-shelf AI tools?
The obligations that generate the scariest headlines — conformity assessments, technical documentation requirements, and the foundation-model-provider duties that apply to companies like OpenAI and Anthropic — are triggered by building, training, or substantially modifying a model, or by deploying a genuinely high-risk system (biometric identification, credit scoring, employment screening at scale). A small business using ChatGPT for support tickets, Claude for content drafts, or Gemini for internal research is not a foundation-model provider and is very unlikely to be operating a high-risk system under the Act’s risk tiers.
Pro Tip: Before reading any EU AI Act compliance checklist, ask one question first: are we providing a model, or deploying someone else’s? Most of the checklist items enterprise coverage lists only trigger for providers.
What should a small business actually do to comply?
Three concrete steps cover the realistic obligation set for a tool-user SMB: add a visible disclosure that any chatbot or automated support flow is AI-driven, not human; label any AI-generated or AI-edited marketing content, images, or video that a customer might otherwise assume is human-made; and if any synthetic media (voice, image, video) is customer-facing, mark it as AI-generated rather than letting it pass as authentic. None of this requires a legal team, a conformity assessment, or new technical documentation — it requires a disclosure line in a chat widget and an “AI-generated” label on relevant content.
Pro Tip: Document the disclosure decision once, even briefly (what’s labeled, where, since when) — proportionality protections under the Act still expect deployers to show they made a reasonable, size-appropriate effort, not a comprehensive enterprise compliance file.
What’s the actual risk if a small business ignores this?
Enforcement authorities can issue fines up to €15 million or 3% of global annual turnover for companies generally, with the proportionality cap applying for SMEs. For a small business, the real exposure is bounded well below the headline enterprise number — but “the fine is smaller for us” is not the same as “there’s no fine.” The three Article 50 disclosures are cheap to implement and expensive to ignore relative to the cost of adding them.
Where do most SMB use cases actually fall in the Act’s risk tiers?
The Act sorts AI systems into four risk tiers: unacceptable risk (banned outright — social scoring, manipulative subliminal techniques), high-risk (biometric identification, credit scoring, employment screening at scale, critical infrastructure control), limited-risk (chatbots, deepfakes, AI-generated content — the Article 50 transparency tier), and minimal-risk (spam filters, AI-enabled inventory tools, most internal productivity uses). The overwhelming majority of tasks a small business hands to ChatGPT, Claude, or Gemini — drafting content, summarizing documents, answering support questions, generating images — fall into limited-risk or minimal-risk. High-risk obligations only attach if the SMB is deploying AI to make or materially influence decisions about people’s access to a job, credit, housing, or a similarly consequential outcome.
Pro Tip: The one common SMB use case that can cross into high-risk territory is AI-assisted resume screening or candidate ranking for hiring. If a small business uses any AI tool to filter or score job applicants, that specific workflow — not the business’s AI usage generally — deserves a closer look against the high-risk criteria, even though everything else the business does with AI stays in the low-obligation tier.
How does this compare to what larger AI-adjacent companies are dealing with right now?
It’s a different regulatory universe. Foundation-model providers and companies deploying genuinely high-risk systems are managing conformity assessments, technical documentation obligations, and — for the largest models — systemic-risk requirements tied to compute thresholds. A small business using off-the-shelf tools is not in that conversation at all; its entire realistic obligation set is the three Article 50 disclosures covered above. The gap between “what OpenAI and Anthropic have to do” and “what a 12-person marketing agency using ChatGPT has to do” is enormous, and most SMB-targeted compliance content collapses that gap into one undifferentiated checklist — which is exactly the panic-reading problem this piece is trying to correct.
- Using ChatGPT, Claude, or Gemini for business tasks makes an SMB a “deployer” under the EU AI Act — not exempt just because you didn’t build the model.
- Three concrete disclosures took effect August 2, 2026: label chatbots as AI, label AI-generated/edited content, mark deepfakes as artificial.
- SME fine ceilings are capped at whichever is lower (percentage or fixed amount) — in practice, 3% of turnover, not the €15M enterprise headline figure.
- Conformity assessments, technical documentation, and foundation-model-provider duties only trigger for companies that build or substantially modify models, or deploy genuinely high-risk systems — not for tool-users.
Per the European Commission, transparency obligations that took effect August 2, 2026 require disclosing AI chatbot interactions, labeling AI-generated or AI-edited content, and marking deepfakes as artificial.
Frequently Asked Questions
Does the EU AI Act apply to my small business if I only use tools like ChatGPT?
Yes. Using an AI system under your own responsibility makes you a “deployer” under the Act, and Article 50’s transparency obligations apply to deployers as well as providers — regardless of company size.
What are the three transparency obligations that took effect in August 2026?
Disclosing that a chatbot is AI rather than a human, labeling AI-generated or AI-edited content, and marking deepfakes (synthetic audio, image, or video) as artificial.
Are the fines the same for small businesses as for large enterprises?
No. SMEs and small mid-caps get the fine capped at whichever is lower — percentage of turnover or fixed amount — while large enterprises face whichever is higher. In practice this makes 3% of turnover the real ceiling for most small businesses, not the €15M figure that applies to larger companies.
Do I need a conformity assessment or technical documentation to use ChatGPT for my business?
No. Those obligations apply to providers building or substantially modifying models, or to genuinely high-risk system deployments — not to a business using an off-the-shelf tool for support, content, or internal workflows.
What counts as a “deployer” under the EU AI Act?
Anyone using an AI system under their own responsibility without having developed it themselves — this includes a small business running customer support through a chatbot built on someone else’s model.
How do I actually comply without hiring a compliance team?
Add a visible AI disclosure to chatbots, label AI-generated or AI-edited customer-facing content, and mark any synthetic media as AI-generated. Document what you labeled and when as a reasonable, size-appropriate effort.
Last updated: 2026-08-26
