AI Act for the self-employed and SMBs: what actually applies to you
By Kike Gandia · Co-Founder & CEO, OSCP
The EU Artificial Intelligence Act (AI Act) applies to self-employed professionals and SMBs that use AI, not only to those who develop it: if you deploy an AI system in your professional activity, you are a "deployer" and have obligations of your own covering transparency, human oversight and staff training. This guide explains what applies to you depending on the risk level of your use case, from when, and what concrete steps to take.
Why it affects you even if you don't develop AI
The AI Act distinguishes between a "provider" (who develops the AI system) and a "deployer" (who uses it within their organization). If you use a third party's AI tool to make or support decisions about people — job candidates, customers, employees — you are a deployer, and the regulation imposes direct obligations on you, not just on the tool's provider.
The most common use cases for an SMB or self-employed professional
Customer service chatbots powered by generative AI, CV screening or candidate evaluation tools, customer or vendor scoring systems, and AI assistants built into your CRM or ERP. Most fall under limited or minimal risk, with light obligations (mainly transparency: disclosing that people are interacting with AI), unless used for hiring decisions or credit scoring, where the risk rises to high.
What's already prohibited, with no size exceptions
Since February 2025, certain AI practices are prohibited for any business, regardless of size: social scoring systems, subliminal manipulation causing harm, exploitation of vulnerabilities of specific groups, and biometric categorization to infer sensitive traits (sexual orientation, political opinions, etc.). Being self-employed does not exempt you from these prohibitions.
The AI Act's four risk levels, with SMB examples
The AI Act does not regulate "AI" as a block: it classifies each system by the risk of its use case, and the obligations follow from that. This is the table you need in order to place your own tools.
| Risk level | What it means | Typical SMB example |
|---|---|---|
| Unacceptable | Banned since February 2025 | Social scoring of customers; biometric categorization to infer sensitive traits |
| High risk | Strong duties: documentation, human oversight, registration | Automated CV screening; credit scoring; AI that evaluates employees |
| Limited risk | Transparency obligation | Customer-service chatbot: you must disclose that it is an AI |
| Minimal risk | No specific obligations | Drafting emails with ChatGPT; generating marketing images; transcribing meetings |
Most self-employed professionals and SMBs operate in the bottom two levels. The jump to high risk almost always happens for the same reason: using AI to decide about people — who gets hired, who gets credit, who gets evaluated.
What to do if you use third-party AI in your business
Identify which AI tools you use and for what. Check whether any are used for decisions about people (hiring, credit, evaluation). If so, inform affected people that they are interacting with an AI system and keep human oversight over the final decision. For most SMBs and self-employed professionals, this is proportionate and does not require a complex compliance project.
FAQ
How does the AI Act relate to GDPR? Does complying with one cover the other?
No: they are separate obligations that stack. GDPR governs the processing of personal data; the AI Act governs the AI system itself, even when no personal data is involved. A chatbot that only answers product questions may fall outside GDPR and still carry a transparency duty under the AI Act. And the other way round: using AI to screen CVs triggers both at once — high risk under the AI Act, and automated decision-making about people under GDPR Article 22. In practice they are documented together, but complying with one does not exempt you from the other.
Do I need to register anything if I use ChatGPT in my business?
If you use it as an internal productivity assistant, usually not. Obligations kick in when the system makes or supports decisions about external people (customers, candidates), not from the mere internal use of a generative AI tool.
Does the AI Act require me to hire a DPO like GDPR does?
There's no mandatory equivalent role for small businesses. The more demanding governance obligations (like an AI compliance officer) are mainly aimed at providers of high-risk systems, not small-scale deployers.
What happens if I don't comply and I'm self-employed?
Penalties are proportional to company size: the regulation provides that for SMBs and startups, fines are calculated using whichever is lower between the set percentages and the absolute figures, to avoid disproportionate penalties relative to their turnover.
Related service
Related content
- EU compliance calendar 2026-2030 (interactive)
- Deploying AI in the enterprise without opening a security hole
- Classify the data before you paste it into an AI
- Solutions by company profile
- AI governance and safe AI use
- Cybersecurity for SMBs
- AI system penetration testing
- AI-generated code security audit
- Regulatory compliance in cybersecurity