The SME Guide to the EU AI Act
A plain-English translation of Regulation (EU) 2024/1689. Understand your obligations without reading 144 pages of legal text.
1. What is the EU AI Act?
The EU AI Act is the world's first comprehensive legal framework for artificial intelligence. It assigns obligations based on the risk level of the AI system rather than the underlying technology itself. If you develop, distribute, or simply use an AI system within the EU, this regulation likely applies to you.
2. The Four Risk Tiers
Unacceptable Risk
Strictly prohibited systems.
- • Social scoring
- • Cognitive behavioral manipulation
- • Real-time biometric identification (with strict law enforcement exceptions)
High Risk
Subject to strict compliance obligations (Annex III & IV).
- • HR recruitment and screening tools
- • Educational admittance systems
- • Medical devices
- • Critical infrastructure management
The vast majority of SME compliance budgets will be spent ensuring that High-Risk systems meet their obligations, which include generating technical documentation (Annex IV), establishing a continuous risk management system (Article 9), and maintaining high-quality training datasets (Article 10).
3. Are you a Provider or a Deployer?
Your obligations differ vastly depending on your role in the AI value chain:
- Providers: You develop an AI system and put it on the market under your own name or trademark. You bear the heaviest compliance burden (CE marking, EU database registration, Annex IV documentation).
- Deployers (Users): You use an AI system in a professional context (e.g., your HR team uses a third-party AI screening tool). You must ensure human oversight (Article 14), monitor for anomalies, and keep logs.
Unsure of your risk tier?
Don't guess. Use our free, 3-minute risk classifier to determine your exact obligations and get a downloadable report.
Start the Free Assessment