Guide
The EU AI Act for small and mid-sized companies
The EU AI Act is the European Union's regulation on artificial intelligence. Most small and mid-sized companies are not building AI models — they use AI tools made by others. This guide explains, in plain language, where such companies usually stand and what sensible first steps look like.
Provider or deployer?
The Act places different obligations on organisations depending on their role. A provider develops an AI system or places it on the market. A deployer uses an AI system under its own authority in a professional context. A company using a chatbot, a writing assistant or AI features in its HR software is typically a deployer for those systems.
Risk levels
The Act takes a risk-based approach. A small set of practices is prohibited. Some uses are classed as high-risk — for example certain uses in employment and recruitment, education, or access to essential services — and carry heavier obligations. Some systems, such as chatbots and generated content, carry transparency obligations. Most everyday productivity uses fall into lower-risk categories.
AI literacy
Providers and deployers are expected to take measures so that staff dealing with AI systems have a sufficient level of AI literacy. For most companies this is the most immediate, practical item: knowing who uses which tools and making sure they understand the risks.
Timing
The Act entered into force in 2024 and applies in stages over several years, with different dates for prohibited practices, AI literacy, general-purpose AI models and high-risk systems. Check the current official timeline for the obligations that apply to you, as dates and guidance can be updated.
Practical first steps
- Make an inventory of the AI tools and AI features in use, including inside existing software.
- Record what each is used for, who uses it and which vendor provides it.
- Flag uses that affect people's rights or opportunities, such as hiring, for closer review.
- Adopt an AI policy and an acceptable use policy, and train staff.
- Keep evidence: decisions, training records and vendor information.
How TrustPack AI helps
TrustPack AI guides you through this inventory and assessment, applies a transparent set of governance rules to your answers, and generates your policies, registers and an action plan. It shows governance readiness — it does not certify compliance, and specialist review is recommended for regulatory decisions.
This guide is general governance information, not legal advice. Specialist review is recommended before relying on it for regulatory decisions.