AI Act: small business obligations since August 2, 2026

You have five employees. Two of them open ChatGPT every morning. Nobody ever decided that. And since August 2, you are the one accountable. Don’t panic. What the law asks of you fits on a single page. We’ll walk you through it.

The problem: “the AI Act is for large corporations”

That’s what you hear everywhere. It’s wrong.

The AI Act is the European regulation on artificial intelligence. Since August 2, 2026, most of its framework, including national penalties, has applied. Three obligations concern you right now:

prohibited practices (Article 5);
transparency towards the people you deal with (Article 50);
the duty to ensure AI training and literacy for the people who use it (Article 4).

Good news along the way: the “Digital Omnibus”, adopted by the Council of the EU on June 29, 2026, pushed back to December 2, 2027 the obligations for so-called high-risk systems, including automated CV screening and employee evaluation. So you have time on that front. But not on the other three.

And accountability applies from the very first employee who uses an AI tool at work. Five people, three people, two people: it’s the same.

The diagnosis: take the shadow AI test

“Shadow AI” is AI running in your business without you knowing. Neither forbidden nor governed. Just invisible.

Four questions. Answer honestly.

Does someone on the team have a ChatGPT, Claude or Gemini account (sometimes a personal one) and use it for work?
Is Copilot enabled in your Microsoft 365?
Have your business tools added AI features (Canva, Notion, your CRM, your accounting software)?
Does an automation somewhere call a language model?

A single box ticked = your business deploys AI within the meaning of the regulation. And you are the one answerable for it. Not the software vendor.

Rest assured: for a small business, almost all uses (drafting an email, generating a visual, summarizing meeting notes) fall under limited or minimal risk. You are asked for transparency and literacy. Not a 200-page regulatory file.

The real risk is not knowing. You can’t govern what you can’t see.

The fix: three actions, four weeks

In this order. Without tying anyone up full time.

1. Take stock of your artificial intelligence uses

One table. Five columns: which tool, who uses it, for what, with which data, what sensitivity level. A spreadsheet is enough.

The method that works: a 45-minute team meeting, with one rule announced upfront: nobody will be penalized for what they declare. Otherwise, shadow AI stays in the shadows and your table is worthless.

2. Set an IT policy that covers AI

Once uses are visible, you decide. Three columns: allowed, governed, forbidden.

For example:

drafting a sales email → allowed;
pasting a customer file into a consumer chatbot → forbidden;
using AI to pre-screen candidates → governed, with systematic human review.

Two to four pages. Not forty. It must be readable by everyone and felt as a protection, not as yet another set of house rules.

3. Appoint an AI lead

Article 4 requires AI literacy. For a small business, that means: one properly trained person, who passes the basics on to the team and keeps the policy alive.

Not a lawyer, not an engineer. The right person knows your processes, already uses AI, and wants to own the topic.

Your 4-week schedule: week 1, the inventory. Week 2, decisions and policy v1. Week 3, a one-hour presentation to the team. Week 4, you appoint the AI lead and schedule their training.

What you really risk (hint: it’s not the fine)

You may have seen a LinkedIn post waving around €35 million fines. Breathe.

Those amounts target tech giants and prohibited practices. They are proportionate to company size, and the text explicitly asks authorities to take the interests of SMEs into account. In France, regulators consistently take the same approach: support first.

The real stake is commercial.

Starting this year, your prime contractors, key accounts and insurers are adding AI compliance to their supplier questionnaires and tenders. Being able to answer “yes, our uses are mapped, our policy exists, our AI lead is trained” is an argument that reassures and sells. An awkward silence will always cost more than a fine.

And there is a blind spot: 77% of small business owners believe AI will increase cyberattacks, up from 66% a year earlier (Mastercard/Ifop barometer on the digitalization of freelancers and very small businesses, 6th edition, conducted among 630 owners of businesses with 1 to 9 employees in April 2026). Fear for data security has even become the reason for rejecting AI for 20% of reluctant owners, twice as many as in 2024. A policy that clearly states what never gets pasted into a consumer chatbot is also cybersecurity.

The four mistakes we see everywhere

Waiting. The inventory takes honesty, the policy takes decisions, the AI lead takes training. Nothing huge. But nothing you can do the night before.

Banning everything. You block ChatGPT? Usage moves to personal phones. You get exactly the opposite of what the regulation asks. Governing protects better than banning.

Buying an audit and filing it away. A deliverable dated June 2026 says nothing about your uses in January 2027.

Making nobody responsible. An obligation everyone carries a little is an obligation nobody really carries. Without a named lead, the policy becomes a forgotten PDF.

What now?

The AI Act is not a one-off exam. Your tools change every month, and so do your team’s habits. Your August inventory will be partly out of date by December.

That’s why the right answer is not a one-off audit, but an internal reflex: someone who updates the table, evolves the policy and governs new uses as they appear.

Three actions. Four weeks. One person who owns the topic. Over to you!

Not sure where to start your AI inventory? iokoo is an IT expert available 24/7 for small businesses: they can already help you set up your documents and guide you through it, and if needed, an AI expert will offer you a focused discussion. Try iokoo and let’s review your uses together.

Sources: Regulation (EU) 2024/1689 on artificial intelligence, August 2, 2026 deadline; “Digital Omnibus”, adopted by the Council of the EU on June 29, 2026; Mastercard/Ifop barometer “The digitalization of freelancers and very small businesses”, 6th edition, June 2026.

AI Act: what a 5-person business must have in place since August 2