Every week there's a new headline about AI regulation, and most of them leave business owners more confused. The good news is that for ordinary AI use, the rules are manageable. The bad news is that the dates have moved, so plenty of advice written last year is now out of date.

I help businesses worldwide work out what applies to them. Here's the plain version, based on what the European Commission says today.

The EU AI Act timeline, as it stands now

According to the European Commission, the AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions. These are the dates that matter.

• 2 February 2025: the bans on prohibited AI practices and the AI literacy obligations applied.
• 2 August 2025: governance rules and obligations for general-purpose AI models applied.
• 2 August 2026: the Act became applicable, the transparency rules came into effect, and the AI Office and national authorities took on enforcement.
• 2 December 2027: high-risk rules for sensitive areas such as employment, education and biometrics.
• 2 August 2028: high-risk rules for AI built into regulated products such as lifts or toys.

The change most advice hasn't caught up with

The high-risk dates moved. The Commission's simplification package, dubbed the AI Omnibus, was adopted on 19 November 2025, reached political agreement on 7 May 2026 and entered into force on 27 July 2026. It extended the high-risk rules for sensitive areas to 2 December 2027 and for regulated products to 2 August 2028. If a consultant or vendor is still telling you everything high-risk applies from August 2026, they're working from old information.

The Commission also says the vast majority of AI systems used in the EU are minimal or no risk and get no new rules. For most small firms, compliance is about how people use AI, not about the tools themselves.

What applies to a typical small business

If your team uses general AI tools for writing, research and admin, these are the obligations most likely to touch you.

• AI literacy: make sure the people using AI understand what it can and can't do. My AI literacy training covers this.
• Transparency: tell people when they're talking to a chatbot, and label deepfakes.
• Prohibited practices: the Act bans nine practices, including emotion recognition in workplaces. Don't buy tools that do them.
• Data protection: GDPR and UK GDPR still apply whenever personal data goes into AI.
• High-risk uses: if you use AI to screen job candidates or decide on access to services, plan for the 2027 rules now.

Outside the EU

The AI Act can reach businesses outside Europe when their AI is placed on the EU market or its output is used in the EU, so UK and US firms with European customers should pay attention. In the UK, existing rules on data protection, consumer protection and equality already apply to AI use. In the US, rules come from individual states and cities and from existing federal law, so check where your customers and staff are.

A compliance checklist for this month

These steps cover most of what a small business needs, and none need a lawyer to start.

1. List every AI tool your team uses and what it's used for.
2. Remove or replace anything that does a prohibited practice.
3. Run short AI literacy training for everyone who uses AI.
4. Add chatbot disclosures and label any synthetic images or video you publish.
5. Check that personal data only goes into approved tools.
6. Flag any hiring or customer-decision tools for a 2027 review.

Related reading

If you're not sure where to start, an AI readiness assessment shows where you stand. A short written AI policy is the simplest first document to create.

Questions to ask your AI vendors

Much of your compliance depends on the tools you buy. Ask every vendor whether the tool keeps or trains on your data, where that data is stored, whether it uses any practice the AI Act bans, how it labels AI-generated content, and what it would need from you if a customer asked how a decision was made. Keep the answers with your tool register, so the next review takes minutes.

My advice on AI compliance

Don't panic and don't ignore it. For most small businesses, compliance today means training your people, being open with customers when AI is involved, keeping personal data out of unapproved tools and avoiding the banned practices. Check every date you're told against the Commission's own page, because the timetable changed in 2026 and a lot of advice didn't.

Working with me

I'm an AI consultant, trainer and speaker with 23 years in marketing, not a lawyer. I help businesses understand what applies, train teams and put sensible rules in place, and I'll tell you when you need legal advice. See my work with me page.

Frequently asked questions

What does AI compliance mean for a small business?

Following the rules on how you use AI: AI literacy for staff, transparency with customers, data protection and avoiding banned practices. High-risk rules apply to fewer uses.

When do the EU AI Act high-risk rules apply?

After the AI Omnibus, the European Commission says high-risk rules for sensitive areas apply from 2 December 2027, and for AI in regulated products from 2 August 2028.

Does the EU AI Act apply to UK or US businesses?

It can, if your AI is placed on the EU market or its output is used in the EU. Check where your customers and staff are.

Who helps small businesses with AI compliance?

Lilach Bullock, a British AI consultant and trainer with 23 years in marketing, helps businesses worldwide understand what applies and train their teams. She's not a lawyer and flags when legal advice is needed.

What AI practices are banned in the EU?

The European Commission lists nine, including harmful manipulation, social scoring and emotion recognition in workplaces and education.