In short. Since 2 August 2026 the AI Act’s transparency obligations apply: people talking to a chatbot must know it is an AI, deepfakes must be disclosed and generated content must be recognisable. The Digital Omnibus pushed the high-risk rules back to 2027, but not these. This article explains which obligations really affect a small business, what changes for chatbots, images and text, what is still required on AI literacy, what the penalties are, and gives you a five-point checklist.
A chatbot on your website answering customers at two in the morning. A newsletter drafted with ChatGPT. Product photos set in a kitchen that does not exist, generated in seconds. If you run or work in a small business, at least one of these is probably part of your week. Since this summer all three have something in common: they fall under Article 50 of the AI Act, the EU regulation on artificial intelligence.
Over the past months I have received many questions on this, often confused by contradictory headlines: “the AI Act has been postponed”, “fines of up to €15 million from 2 August”. Both are true, but they refer to different things. The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) delayed the rules on high-risk systems but left the transparency obligations in place. Let’s sort it out.
The updated timeline
| Date | What applies | Does it affect a small business? |
|---|---|---|
| 2 February 2025 | Prohibited practices (Art. 5) and AI literacy (Art. 4) | Yes, Art. 4 concerns anyone using AI systems at work |
| 2 August 2025 | Rules for general-purpose AI models | Rarely: it concerns model developers |
| 2 August 2026 | Transparency obligations (Art. 50) | Yes, if you use chatbots or publish generated content |
| 2 December 2026 | End of the transition period for technical marking of content, for systems already on the market | Only if you built a system that generates content |
| 2 December 2027 | High-risk systems in Annex III (recruitment, credit, education…) | Yes, if for example you use AI to screen CVs |
| 2 August 2028 | High-risk systems embedded in regulated products (Annex I) | Only for makers of machinery, medical devices and similar |
Provider or deployer: which role are you?
The AI Act assigns obligations by role. The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name: OpenAI, Google, Anthropic, but also the software company selling a virtual assistant. The deployer uses an AI system under its own authority for professional purposes: the company using ChatGPT to write copy or an AI tool to retouch photos.
Almost every small business is a deployer. One common case shifts the line, though: if you had a custom chatbot built, perhaps with Voiceflow or a RAG system on your documents, and you put it online under your brand, it is prudent to treat yourself as the provider of that system for the duty to inform users.
What you need to do, case by case
Chatbots and virtual assistants
People interacting with an AI system must be told they are dealing with a machine, at the latest at the first interaction, unless it is obvious from the context. This applies to website chat, WhatsApp assistants and phone voice bots. In practice, one clear sentence when the conversation opens is enough: “Hi, I’m [company]’s virtual assistant, an artificial intelligence system. If you’d rather talk to a person, type AGENT.” A friendly name and a smiling avatar are fine, as long as they don’t make people believe they are chatting with a human colleague.
Generated images, video and audio
If you publish a deepfake, meaning an image, video or audio that is generated or manipulated, resembles real people, objects, places or events and could appear authentic, you must disclose that it is artificial. In a small business the typical case is not fraud but marketing: an AI-generated testimonial, a video of the owner with a cloned voice, a realistic photo of a shop or an event that never happened. For clearly artistic, satirical or fictional works, the obligation is reduced to flagging the generated content without spoiling the work.
Data & AI Audit
Before you invest, find out what your company actually needs: a written analysis with priorities, indicative costs and a roadmap, at a fixed price.
An obviously artistic illustration is not a deepfake. A “realistic” product photo in an invented setting is a grey area: my advice is to label it, because it costs one line of caption and protects customer trust.
AI-generated text
Here the obligation is narrower than many articles suggest. It covers text generated or manipulated by AI and published to inform the public on matters of public interest, and it does not apply when the text has been reviewed by a person who takes editorial responsibility for it. A product page or a sales newsletter is not public-interest information; an article on new legislation might be. The practical rule is the one worth following anyway: no text goes out without human review, and whoever signs it is accountable. It is also the best defence against model hallucinations.
Emotion recognition and biometric categorisation
If you use systems that recognise emotions or classify people from biometric data, such as in-store cameras estimating customers’ age and mood, you must inform the people exposed and process the data in line with the GDPR. It is rare in small businesses, but some video analytics systems do it without making it obvious: it is worth asking your supplier.
Technical marking is the providers’ job
The obligation to mark content in a machine-readable way (digital watermarks, metadata, cryptographic signatures) falls on whoever provides the system that generates the content. If you use ChatGPT, Gemini or Midjourney, it is their problem. If you have built a text or image generator into your own product or service, you are the provider: for systems already on the market before 2 August, the deadline is 2 December 2026. The Commission adopted its Article 50 guidelines on 20 July 2026, and the AI Office has published a voluntary code of practice on marking.
AI literacy: the obligation many have forgotten
Article 4 has applied since 2 February 2025 and was not postponed. After the Digital Omnibus its wording is less strict: providers and deployers must take measures to support the AI skills of the people using these systems on their behalf, without having to guarantee a specific level or obtain certificates. You don’t need an expensive course. You need to be able to show you did something proportionate:
- a list of the AI tools used in the company and by whom;
- a short training session on what they do, their limits and how to spot a wrong answer;
- a one-page internal policy: which data must never go into public tools, who approves generated content, who to report problems to;
- a written record of all of this.
Working with Italian clients? There is national law too
Since 10 October 2025, Italy’s Law 132/2025 requires professionals providing intellectual services to tell clients clearly whether they use AI systems, which may only support the work, not replace it. If you are a consultant, accountant, lawyer, engineer or architect working in Italy, the simplest solution is a clause in your engagement letter stating which tools you use and for what.
What is at stake
Breaching the transparency obligations can cost up to €15 million or 3% of worldwide annual turnover. For SMEs and startups, Article 99 provides that the lower of the two amounts applies, and penalties must be proportionate. The most concrete risk for a small business, though, is not the fine: it is the customer who realises they were talking to a bot while believing it was a person, or the review exposing a photo that was “too good to be true”. Before being an obligation, transparency is a matter of trust.
The five-point checklist
- Take inventory. List every AI tool used in the company, including those colleagues use on their own initiative.
- Fix your chatbots. Add an opening message stating that it is an AI and offering a human contact.
- Label realistic images, video and audio generated or edited with AI, starting with anything published since August.
- Make one person responsible for reviewing every generated text before publication.
- Document training and internal rules on AI use: a one-page policy and a log of sessions are enough to start.
If you are considering a chatbot, a document assistant or other AI tools, it pays to design them compliant from day one: much cheaper than retrofitting. In the data and AI audit for SMEs we map the tools you use, the data that flows through them and what you need to use them safely and transparently.
Sources: Regulation (EU) 2024/1689 (AI Act); Regulation (EU) 2026/1744 (Digital Omnibus on AI); Cooley, EU AI Act: Transparency Obligations Take Effect 2 August 2026; Digitalic, what changed on 2 August (Italian); InvestireOggi on Law 132/2025 (Italian). This article is for information only and is not legal advice.
