The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force in August 2024 and applies in stages. If your business uses tools such as ChatGPT, Copilot or a website chatbot, some rules already affect you. The good news: for most small businesses the obligations are manageable.
What already applies
Since 2 February 2025, certain uses of AI are banned, such as social scoring of people or manipulation that exploits vulnerabilities. A typical small business does not come near this.
Since the same date, businesses that use AI must support AI literacy among their staff (Article 4). In practice, the people using these tools should understand what they do, their limits and their risks. The EU agreement of May 2026 softened the wording of this duty but did not remove it.
What applies from 2 August 2026
The transparency obligations (Article 50). If you have a chatbot that talks to customers, people must know they are talking to an AI. If you publish AI-generated text, images or video to inform the public, you must say so in certain cases.
What has been postponed
The obligations for high-risk systems, for example AI that screens job applicants or assesses customers' creditworthiness. These were due in August 2026. Under the so-called Digital Omnibus agreement of May 2026 they move to 2 December 2027, and to August 2028 for AI built into regulated products. If you use AI to make decisions about people, it is still worth preparing.
What you can do this week
- List the AI tools your team uses, including free ones.
- Note what each one is used for and whether it handles personal data.
- Run a short training session and keep a record of the date and attendees. It helps you show you meet Article 4.
- If you have a chatbot, add a clear notice: "You are talking to an automated assistant".
- Check whether any tool makes decisions about people. If it does, get advice.
Who supervises in Spain
The Spanish Agency for the Supervision of Artificial Intelligence (AESIA), based in A Coruña, is the agency responsible for supervising the Act. For personal data, the Spanish Data Protection Agency (AEPD) remains in charge.
This article is for information only and is not legal advice. Deadlines can change: always check the current version of the Act.