EU AI Act Checklist for Small Business: 6 Articles That Matter
A practical EU AI Act checklist for small business — the six articles that actually apply, what each demands, and links to the full guide on each one.
Most SMEs and agencies file the EU AI Act as someone else’s problem. It has more than 180 articles of dense legal text. The text looks written for hyperscalers and regulators, not a five-person creative studio or a research consultancy. That view is wrong. This is a practical EU AI Act checklist for small business. Six articles decide almost everything a small team needs to know. This is the one-page map to them.
We have written a full deep-dive on each of these six articles separately. This piece is the index. Read it first, then follow whichever link matches where you are.
Key takeaways: Two of these six obligations (Articles 4 and 5) apply since February 2025. That date is not a future deadline, though the July 2026 Omnibus has since lightened what Article 4 asks of you. One article (62) exists only to help you, not to burden you. If your agency rebrands, fine-tunes, or repurposes any AI tool for a client, read Article 25. Most teams have never read it, but most need it.
The EU AI Act checklist for small business: 6 articles at a glance
| Article | What it demands | Applies to |
|---|---|---|
| Art. 3 | Are you a provider or a deployer? This article defines the roles the rest of the Act depends on | Everyone: the gateway question |
| Art. 4 | AI literacy among staff, freelancers, and contractors — simplified by the July 2026 Omnibus | Anyone with a team, in force since Feb 2025 |
| Art. 5 | This article bans red lines outright: workplace emotion recognition, dark-pattern design, face-scraping | Everyone, in force since Feb 2025 |
| Art. 25 | You can become the legal “provider” by rebranding, modifying, or repurposing a tool | Agencies doing white-label or custom AI work |
| Art. 50 | Disclose AI-generated content clearly, before the reader reaches it | Anyone publishing AI-assisted content, from 2 Aug 2026 |
| Art. 62 | Free support: sandbox priority, reduced fees, AI Office templates | SMEs and start-ups: the part most teams never claim |
Art. 3 — Are you even in scope?
First, check your role. Article 3 sets out the roles the entire Act is built on. A provider develops an AI system and places it on the market. A deployer uses one under its own authority. Most of the Act’s obligations depend on which side of that line you sit on.
For a deeper walkthrough of how to classify your own tools, see the official 7-element test for what counts as an “AI system” and the provider-vs-deployer test for the GPAI Code of Practice.
Art. 4 — You already have a literacy duty
Article 4 covers AI literacy among staff and anyone who operates AI systems on your behalf, including freelancers and contractors. It has applied since 2 February 2025, six months earlier than most teams assume — but the July 2026 Digital Omnibus, Regulation (EU) 2026/1744, simplified the company-level requirement, shifting the leading role onto the Commission and Member States. Most coverage still describes the stricter original wording.
Full breakdown, including what “sufficient” actually means in practice: Article 4 for creator agencies and small teams.
Art. 5 — The red lines that apply to everyone, today
Article 5 has also applied since 2 February 2025. It bans specific practices outright, with no risk assessment and no exception for small operators. Four bans realistically touch an ordinary tool stack: workplace emotion recognition, manipulative dark-pattern design, untargeted facial-image scraping, and biometric categorization by protected traits. The July 2026 Omnibus amendment added two more bans, on AI-generated non-consensual intimate images and CSAM. Those two bans apply from 2 December 2026.
Full checklist to run your own tools through: the 4 Article 5 practices you’re banned from using.
Art. 25 — How your agency could accidentally become a “provider”
Article 25 is the one clause most agencies never read. If you rebrand a tool under your own name, substantially modify it, or repurpose a general-purpose model into a high-risk use, you can legally become the “provider.” That status brings the full conformity-assessment and documentation burden that was meant to sit with your vendor.
Full breakdown of the three triggers and the contract clause that decides who carries the risk: Article 25 — when you become the AI “provider”.
Art. 50 — The one deadline everyone’s heard of
Article 50 requires clear, distinguishable disclosure when content is AI-generated or manipulated. Show the disclosure before a reader’s first exposure to the content, not buried in end credits or a linked policy page. This is the transparency obligation most creator-facing coverage of the Act focuses on. It applies from 2 August 2026.
Full placement guidance for blog posts, social media, video, and podcasts: how to add AI disclosures that comply with the EU AI Act.
Art. 62 — The support most teams don’t know they can claim
Article 62 is the part of the Act that works in the small team’s favor. It gives priority access to national regulatory sandboxes, reduced conformity-assessment fees, a direct advice channel with your national authority, and free standardized templates from the AI Office.
Full breakdown of how to actually claim each measure: Article 62 — free support SMEs can claim.
Common questions on the EU AI Act for small business
Does the EU AI Act apply to a business with under 10 people? Yes. Size does not exempt you from the Act’s obligations. Size changes how those obligations are enforced. Article 99(6) caps fines for SMEs and start-ups at the lower of the applicable percentage or amount thresholds, instead of the higher figures large companies face. Article 62 also gives you support most teams never claim.
What is the single most-missed obligation for small teams? Article 25. Most agencies assume they are a “deployer” using someone else’s tool. They never realize that rebranding, substantially modifying, or repurposing a tool can legally make them the “provider” instead, with the full compliance burden that status brings.
Do I need to worry about fines right now? For most small teams, no. The highest-profile deadlines, such as Article 50 transparency and most Annex III high-risk obligations, either have not arrived yet or moved to December 2027 under the 2026 Omnibus amendments. Articles 4 and 5 are the exception. Both have applied since February 2025.
Where do I start if I have done nothing about this yet? Run the 7-element test on your actual tool stack first. It tells you whether the Act applies to a given tool at all, before you check any specific article.
How to use this map
Bookmark this page instead of any single article. The Act’s obligations phase in over several years, and which of these six matters most to you will shift as your team, tools, and deadlines change. Revisit this page every quarter, or whenever you adopt a new AI tool or take on a new type of client work.
If you need to work out which of these six apply to your team, or you have read one and want to talk through what it means for your setup, get in touch →
Related reading on The Science Talk
See also EU AI Act Article 4: What AI Literacy Requirements Mean for European Research Institutes on The Science Talk. This piece gives background on how these obligations reach ordinary organizations, not just AI developers, from the research-institute angle.
Browse all Perspectives or get in touch →
Found this useful? Share it or read more perspectives.