Skip to content

EU AI Act for SMEs: which risk class are you in?

17 August 2026 · 2 min read · EU AI Act · GDPR · SME

The European AI law sounds heavy. For most SMEs it is manageable. Here is how to work out in ten minutes which risk class your AI use falls into.

Four empty boxes on a whiteboard, from small to large, with a marker pen beside them.

The EU AI Act has been in force since August 2024 and is being phased in until 2027. Business owners often ask me whether they need to do anything now. The short answer: probably not much. The long answer is below.

Four classes, one that matters

The law divides AI systems into four classes: prohibited, high risk, limited risk and minimal risk. Prohibited use, such as social scoring, rarely comes up in everyday SME work. One pitfall: measuring the emotions of staff or job applicants with AI is not allowed. High risk is rare too.

When is it high risk?

High risk is AI that makes decisions about people. Think of screening job applicants or assessing credit applications. If you use AI for that, strict requirements apply. Then you call me before the build, not after.

Limited risk: the chatbot

A chatbot on your website falls under limited risk. The main requirement: visitors must know they are talking to AI. One line in the chat window takes care of that. The same applies to AI images that look like real photos of people, places or events.

Minimal risk: almost everything

Preparing quotes, summarising emails, sorting invoices, drawing up schedules. This is minimal risk. The law sets almost no requirements here. One thing applies to all AI use: your team must know what it uses and where it goes wrong. That is called AI literacy, Article 4. A short training session covers it. The GDPR still applies as normal.

How to work it out yourself

  • Does the AI make decisions about people? Then it is high risk.
  • Does the AI talk to customers, or do you use it to make lifelike images? Then limited risk: disclose it.
  • Does the AI do internal work, with no decisions about people? Then minimal risk.

For each system, write down which class it falls into and why. One line per system is enough. That document is your evidence if anyone ever asks.

Unsure about a system you already use?

Read about the AI Scan

Frequently asked questions

Does a customer service chatbot fall under the EU AI Act?

Yes, as limited risk. You must disclose that it is a chatbot. Beyond that, it is mainly the GDPR rules that apply to the data going in.

When is an AI system high risk?

When it makes decisions about people or weighs heavily in that decision: screening applicants, assessing credit, triage in emergency care. Then strict requirements on documentation and oversight apply.

Do I need to register anything as an SME?

Not for limited or minimal risk. You do write down, per system, which class it falls into and why. For high risk, you call me before the build.

Written by Sinyo Swildens, ai consultant for dutch smes in Amsterdam.

Also on this topic

One call. After that you know what AI will deliver for you.

You pick a time. No preparation needed.

Book a callAll articles