AI Act for freelancers and SMBs: what actually applies to you

By the QuantumSec team

When people talk about the AI Act, most think of large tech companies developing AI models. But the regulation also applies to anyone who simply uses third-party AI tools in their business: a customer service chatbot, a hiring screening tool, or an AI assistant for managing clients. If you're a freelancer or SMB using any of these tools, this guide explains what genuinely applies to you.

Why it affects you even if you don't develop AI

The AI Act distinguishes between a "provider" (who develops the AI system) and a "deployer" (who uses it within their organization). If you use a third party's AI tool to make or support decisions about people — job candidates, customers, employees — you are a deployer, and the regulation imposes direct obligations on you, not just on the tool's provider.

The most common use cases for an SMB or freelancer

Customer service chatbots powered by generative AI, CV screening or candidate evaluation tools, customer or vendor scoring systems, and AI assistants built into your CRM or ERP. Most fall under limited or minimal risk, with light obligations (mainly transparency: disclosing that people are interacting with AI), unless used for hiring decisions or credit scoring, where the risk rises to high.

What's already prohibited, with no size exceptions

Since February 2025, certain AI practices are prohibited for any business, regardless of size: social scoring systems, subliminal manipulation causing harm, exploitation of vulnerabilities of specific groups, and biometric categorization to infer sensitive traits (sexual orientation, political opinions, etc.). Being a freelancer does not exempt you from these prohibitions.

What to do if you use third-party AI in your business

Identify which AI tools you use and for what. Check whether any are used for decisions about people (hiring, credit, evaluation). If so, inform affected people that they are interacting with an AI system and keep human oversight over the final decision. For most SMBs and freelancers, this is proportionate and does not require a complex compliance project.

FAQ

Do I need to register anything if I use ChatGPT in my business?

If you use it as an internal productivity assistant, usually not. Obligations kick in when the system makes or supports decisions about external people (customers, candidates), not from the mere internal use of a generative AI tool.

Does the AI Act require me to hire a DPO like GDPR does?

There's no mandatory equivalent role for small SMBs. The more demanding governance obligations (like an AI compliance officer) are mainly aimed at providers of high-risk systems, not small-scale deployers.

What happens if I don't comply and I'm a freelancer?

Penalties are proportional to company size: the regulation provides that for SMBs and startups, fines are calculated using whichever is lower between the set percentages and the absolute figures, to avoid disproportionate penalties relative to their turnover.