EU AI Act Compliance Starter Kit: 5 Steps for Small Teams

Small teams tend to bounce off the EU AI Act because it looks like a job for a legal department. It is not. Most of the Act does not apply to most tools. The parts that do apply follow a clear order you can work through in an afternoon.

This starter kit walks a small team through five steps, in sequence, using only official Commission sources. Each step tells you whether you can stop or must continue.

What you need before starting

• A list of the AI tools and systems your team actually uses or builds.
• For each one, a one-line note on what it does and who it affects.
• The official AI Act text and the AI Act Service Desk open in a tab for reference.

Step 1: Check whether the Act even applies

The Act only governs an “AI system” as defined in Article 3(1). Plenty of ordinary software does not meet that definition. If a tool falls outside it, the Act’s obligations do not attach at all.

The Commission published guidelines on the definition, which break it into seven elements. Run each tool through the 7-element test first. Anything that fails it drops out of scope here.

Step 2: Rule out prohibited uses

Article 5 bans some AI practices outright. These prohibitions have applied since 2 February 2025. This is the one step with no grace period, so it comes early.

The banned practices include harmful manipulation, exploiting vulnerabilities, social scoring, certain biometric categorization, untargeted facial-image scraping, and emotion inference in workplaces and schools. The Commission’s guidelines on prohibited practices give worked examples.

The 2026 Digital Omnibus added a further prohibition on AI practices that generate non-consensual intimate or sexual content and child sexual abuse material. Check your uses against the current list, not last year’s list.

Step 3: Classify the risk. Is any of it high-risk?

If a tool is an in-scope AI system and is not prohibited, the next question is whether it is high-risk. This is where the heaviest obligations live, and where most small teams either are, or definitely are not.

High-risk classification runs through Article 6 and Annex III, which lists the use cases that count. Recruitment and worker management are the cases agencies hit most commonly. Work through the Annex III test. If none of your uses match, you avoid the high-risk regime entirely.

Be honest at this step about whether you are the provider or the deployer. Ordinary customization can quietly turn a deployer into a provider. That trap is covered in Article 25: When You Become the AI ‘Provider’.

Step 4: Meet the transparency duties

Even outside high-risk, Article 50 imposes transparency duties on certain systems. You must tell people they interact with an AI, and mark AI-generated or manipulated content such as deepfakes.

For most small creative and marketing teams, this is the step that applies. The practical how-to is in adding AI disclosures that comply with the Act.

Under the 2026 Digital Omnibus, providers of generative AI systems already on the market before 2 August 2026 got a transitional period to comply with the content-marking obligations, extended to 2 December 2026. Do not read that as permission to skip disclosure. Read it as a short runway.

Step 5: Handle AI literacy and your records

The Act expects the people who operate AI on your behalf to have a baseline of AI literacy. The 2026 Digital Omnibus reshaped the original standalone obligation, but the agreed position still expects providers and deployers to support AI literacy among their staff, alongside Member State efforts.

Finally, keep a simple internal record of which AI systems you use, what each is for, and its risk classification. A lightweight AI system register is the single most useful artifact a small team can maintain. It is how you prove, later, what a system was and was not meant to do.

Know your deadlines

The Act applies in stages, and the 2026 Digital Omnibus adjusted the high-risk dates. The current picture:

The high-risk dates above reflect the 2026 Digital Omnibus agreement. Confirm them against the final text published in the Official Journal before you rely on them for planning.

What you can do now

Run your tool list through the five steps once. Most small teams find that most of their tools stop at Step 1 or Step 3. A few trigger Step 4 transparency duties, and only some hit the high-risk regime at all.

Knowing which of your systems sit where is the whole point. It turns an intimidating regulation into a short, ordered checklist you can revisit each time you adopt a new tool.

Related reading on The Science Talk

This guide complements EU AI Act Article 4: What AI Literacy Requirements Mean for European Research Institutes, a closer look at the literacy duty referenced in Step 5.

Want more guides like this? Browse all AI Guides or get in touch →