If you run a small business and you've started hearing about the "EU AI Act", you might assume it's aimed at big tech companies building artificial intelligence - not at a hotel, a shop, a clinic, or a café. For most of the law, that's true. But two parts of it reach ordinary businesses that simply use AI, often without thinking of it that way - and one of those parts is already in force.
This guide explains, in plain English, what the EU AI Act is, which bits actually touch a small Irish business, the dates that matter, and what you realistically need to do. No technical background required.
What is the EU AI Act?
The EU AI Act (formally Regulation (EU) 2024/1689) is the world's first comprehensive law governing artificial intelligence. It took effect across the EU in 2024 and is being switched on in stages over several years. Like the European Accessibility Act, it applies directly in Ireland.
Its core idea is to regulate AI according to risk. Most obligations fall on AI that can seriously affect people's lives - the "high-risk" category, such as AI used for recruitment decisions, credit scoring, or medical devices. A separate, much lighter set of rules applies to everyday AI that interacts with the public, and these are the ones a typical small business needs to know about.
The short version: if your business uses an AI chatbot, an AI assistant, or AI-generated text or images, two specific duties apply to you - transparency and AI literacy. Everything else in the Act is very likely someone else's problem.
Does it apply to my small business?
There is no general small-business exemption. The Act applies based on what you do with AI, not how big you are. In practice, the two duties below catch a surprising number of ordinary businesses:
- You've added an AI chatbot or "virtual assistant" to your website (very common on booking, support, and contact pages).
- You publish AI-generated content - blog posts written by AI, or AI-generated images on your pages.
- Your staff use AI tools in the business - ChatGPT for marketing copy, an AI tool for emails, an AI design tool, and so on.
If any of these sound like you, read on. If none do - you have no AI on your site and your team uses no AI tools - then for now these duties don't bite, though it's worth revisiting as AI creeps into everyday software.
The dates that matter
The Act switches on in phases. These are the milestones relevant to a small business:
| Date | What happens |
|---|---|
| 2 Feb 2025 | The AI-literacy duty (Article 4) comes into force - already law today, with no grace period. Also, a small set of "unacceptable-risk" AI practices are banned outright. |
| 2 Aug 2026 | The transparency rules (Article 50) apply - the chatbot and AI-content disclosure duties that most SMEs need to act on. |
| 2027–2028 | The bulk of the high-risk rules apply (recently pushed back). These are unlikely to affect a typical small business at all. |
Article 50: the transparency rules
From 2 August 2026, Article 50 requires that people are told when they're dealing with AI, and that AI-generated content is identifiable. For a small business, this comes down to two things.
1. Your chatbot must say it's a chatbot
If visitors can interact with an AI system on your site, you must make sure they know it's AI - and the disclosure has to be obvious in the interaction itself. A line buried in your terms and conditions doesn't count. A vague label like "Assistant" that a user could reasonably mistake for a person doesn't count either. A clear "You're chatting with our AI assistant" does.
Common trap: "But my web designer added the chatbot, not me." It doesn't matter. If the chatbot runs on your site and your visitors use it, the duty to disclose sits with you as the business deploying it. The fix is usually small - but it has to be there.
2. AI-generated content must be marked
If you publish content that was generated or significantly manipulated by AI - images, text, audio, or video - it must be marked so people can tell it's artificial. There's particular emphasis on content that could mislead, such as realistic AI images of people or places, and on AI text published to inform the public on matters of public interest.
Article 4: the AI-literacy duty
This is the one most businesses have never heard of, and it's already law - in force since February 2025. Article 4 says that any organisation using AI must ensure its staff (and anyone operating AI on its behalf) have a "sufficient" level of AI literacy.
That sounds heavier than it is. There's no exam and no fixed number of training hours. "Sufficient" means, in proportion to how you use AI, your people understand:
- What the AI tool actually does, in plain terms;
- Where it fails or gets things wrong;
- How to recognise a wrong, biased, or misleading output;
- How to handle data responsibly when using it, including personal data under GDPR;
- When not to rely on it.
For a typical small business, meeting this duty means a short written AI-use policy, a brief staff training session, and - crucially - keeping a record that you did it. The effort has to be real and documented; that record is your evidence you took reasonable steps.
Worth knowing: because Article 4 has no grace period, a business using AI today is technically already expected to have this in place. The good news is it's quick and cheap to put right with the correct templates.
What is not your problem
It's just as useful to know what you can safely ignore. Unless your business is genuinely building or deploying AI that makes significant decisions about people, the following almost certainly don't apply to you:
- High-risk AI obligations - the heavy documentation, conformity assessments, and registration duties. These target AI used for things like hiring, credit scoring, and biometric identification, and the deadlines were recently pushed to 2027–2028 anyway.
- General-purpose AI model rules - these fall on the companies that build large AI models (think the makers of ChatGPT), not on businesses that use them.
Being clear about this matters: the AI Act is broad, but the part that lands on an ordinary Irish SME is narrow and manageable.
Penalties, honestly
You'll see alarming headline figures attached to the AI Act - tens of millions of euro, or percentages of global turnover. Those maximums are aimed at serious breaches by large operators. For SMEs, the Act specifically requires that fines are capped at the lower of the percentage or the fixed amount, and that enforcement is proportionate and takes the economic viability of small businesses into account.
So the honest picture for a small Irish business is not "a €15 million fine". It's a genuine legal obligation and a reputational risk - the kind that documented, reasonable steps are designed to address. We'd rather tell you that plainly than scare you with a number that was never meant for you.
Who enforces it in Ireland
Ireland has taken a distributed approach rather than creating one single AI regulator. A new National AI Office is being established by August 2026 to coordinate, sitting over roughly fifteen existing sectoral regulators that act as market-surveillance authorities in their own areas - for example the Central Bank for financial services, Coimisiún na Meán for online platforms and media, and the Data Protection Commission wherever personal data is involved.
For a small business, the practical takeaway is the same as with the accessibility law: this is being taken seriously, it's arriving now, and the smart move is to take documented, reasonable steps before anyone comes asking.
What should I do next?
If your website has an AI chatbot or AI-generated content, or your team uses AI tools, three practical steps cover most of the ground:
- Make sure any AI on your site clearly discloses that it's AI, in the interaction itself.
- Mark AI-generated content so people can tell it's artificial.
- Put a short AI-use policy in place, brief your staff, and keep a record that you did.
Our AI Act check does the website side of this for you automatically and gives you ready-to-use templates for the policy, the AI-use register, and the staff briefing. It's included in our Standard and Large audits, alongside the accessibility review - so you cover both new EU laws in one go. Your free homepage check covers accessibility and will flag an undisclosed AI chatbot if it spots one.
Check your site against both EU laws
Start with a free homepage check, or go straight to a Standard or Large audit to include the full AI Act check.