- Table of Contents
- 1. What is the AI Act and why it concerns your small business
- 2. The deadline approaching: August 2026
- 3. The risk of fines: up to 7% of revenue
- 4. What your business needs to put in place now
- 5. Your roadmap to get ready
- Frequently Asked Questions (FAQ)
- Conclusion
Table of Contents
Frequently Asked Questions (FAQ)
1. What is the AI Act and why it concerns your small business
In August 2024, the European Union adopted the AI Act, the world's first regulatory framework dedicated to artificial intelligence. This regulation, which is coming into force gradually, sets strict rules for any business using AI tools within European territory.
Contrary to popular belief, this law isn't just aimed at tech giants. French small and medium businesses, including those in the Basque Country, are directly concerned as soon as they integrate AI solutions into their business processes. ChatGPT for writing emails, image-generation tools, virtual assistants, automated recruitment software: all of these technologies now fall under the regulation.
The principle is simple: if your business uses an AI system classified as “high-risk” or “limited-risk,” you must comply with specific obligations. And even for so-called “low-risk” AI uses, a minimum level of transparency is required toward your customers and employees.
The question is no longer whether the AI Act applies to you, but how to prepare effectively before the next regulatory deadline.
2. The deadline approaching: August 2026
The AI Act rolls out in phases. The first, which took effect in February 2025, mainly covered prohibited AI systems (subliminal manipulation, social scoring, emotion recognition in the workplace). The second phase, set for August 2025, targets general-purpose AI models.
But it's the third phase, set for August 2, 2026, that should get your attention as a small business owner. That's the date when most obligations for high-risk AI systems used by businesses will take effect.
What is a high-risk AI system?
AI tools used in the following areas are covered:
- Human resources management (automated recruitment, performance evaluation)
- Access to essential services (credit, insurance, education)
- Management of critical infrastructure
- Justice and public administration
- Biometric recognition systems
For a small business in the Basque Country, this could involve:
- Automated résumé-sorting software
- A customer-scoring tool for granting credit
- A predictive sales-analysis system
- An advanced customer-service chatbot
August 2, 2026 will mark a turning point. From that date on, using non-compliant AI systems will become illegal within European territory. Businesses therefore have less than 19 months to become compliant.
3. The risk of fines: up to 7% of revenue
The AI Act borrows its penalty logic from the GDPR. Fines are calibrated to be a deterrent, with a scale that can seriously hurt a small business.
The fine schedule
| Type of violation | Fine amount |
|---|---|
| Use of prohibited AI systems | Up to €35 million or 7% of global annual revenue |
| Non-compliance with obligations for high-risk systems | Up to €15 million or 3% of global annual revenue |
| Providing incorrect information to authorities | Up to €7.5 million or 1.5% of global annual revenue |
For a small business in the Basque Country with €500,000 in revenue, the maximum risk amounts to €35,000. That's enough to jeopardize the company's cash flow and survival.
Enforcement is taking shape
The European AI Office, which coordinates the implementation of the regulation, has already announced its intention to carry out targeted checks. In France, the CNIL (data protection authority) and the consumer-fraud watchdog (DGCCRF) will be authorized to record violations.
As with the GDPR, whose early years were marked by a degree of leniency before enforcement notably tightened, the AI Act will likely follow the same trajectory. Businesses that wait until the last minute risk being caught off guard.
4. What your business needs to put in place now
AI Act compliance for high-risk systems rests on six main pillars:
a) Risk assessment
Before deploying an AI tool, you must carry out a fundamental-rights impact assessment. This document analyzes the potential risks for the people affected (discrimination, privacy violations, etc.) and the mitigation measures planned.
b) Technical documentation
Every high-risk AI system must have complete documentation describing how it works, its performance, its limitations, and the data used to train it. This documentation must be kept up to date and made available to authorities on request.
c) Traceability and human oversight
The AI Act imposes a transparency principle: you must be able to explain how a decision was made by your AI system. In addition, any high-impact decision must be able to be reviewed and overridden by a human being.
d) Data quality
The datasets used to train or fine-tune your AI tools must be relevant, representative, and free of discriminatory bias. You must be able to demonstrate their quality.
e) Robustness and security
Your AI systems must be resilient to errors, inconsistencies, and malicious attacks. Fallback mechanisms must be able to correct or shut down the system in case of malfunction.
f) Informing users
Your customers and employees must be clearly informed of the use of AI. For chatbots, a mandatory notice must indicate that the user is interacting with a machine.
These obligations apply whether you develop your own AI tools or use solutions provided by third-party vendors. In the latter case, part of the compliance burden falls on the vendor, but you remain responsible for how the tool is used within your business.
5. Your roadmap to get ready
Given these requirements, doing nothing isn't a viable option. Here's a pragmatic approach for small businesses in the Basque Country:
Step 1: Inventory (January-February 2025)
Carry out a comprehensive audit of all the AI tools used in your business:
- Content-generation tools (ChatGPT, Midjourney, Copilot)
- CRM or marketing-automation solutions with predictive features
- Accounting or management software with built-in AI
- Recruitment or employee-evaluation tools
Step 2: Classification (March-April 2025)
For each tool identified, determine whether it falls into the prohibited, high-risk, limited-risk, or low-risk category. A specialized consultant's services can be useful for this phase.
Step 3: Compliance assessment (May-June 2025)
For high-risk systems, check with your vendors that they have the required certifications and documentation. Identify the gaps that need closing.
Step 4: Achieving compliance (July 2025 – July 2026)
Update your processes, train your teams, and draft the required documents. If certain tools can't be made compliant, plan to replace them.
Step 5: Ongoing maintenance (from August 2026)
Compliance isn't a one-time state but an ongoing process. Build in regular checks and keep your documentation up to date.
If you lack the internal resources to carry out these steps, specialized support is available. Mister Anderson offers AI Act compliance audits tailored to small businesses in the Basque Country.
Frequently Asked Questions (FAQ)
My business only uses ChatGPT. Am I affected by the AI Act?
Yes, even occasional use of ChatGPT or other content-generation tools can fall under the AI Act. If you use these tools for professional purposes (writing emails, creating marketing content), you must inform your recipients that AI was used. Furthermore, if you process personal data through these tools, you must ensure GDPR and AI Act compliance, particularly regarding data protection and transparency.
What's the difference between the GDPR and the AI Act?
The GDPR protects individuals' personal data. The AI Act regulates artificial intelligence systems themselves, independently of any personal data processing. An AI tool can be GDPR-compliant but not AI Act-compliant, and vice versa. The two regulations are complementary and apply cumulatively.
Aren't AI vendors responsible for compliance?
Vendors of high-risk AI systems do indeed have significant obligations. However, as a user (a “deployer” in AI Act terminology), you remain responsible for the compliance of how you use these tools. You must verify that your vendors meet their obligations and fulfill your own (informing users, human oversight, etc.).
What's the risk of not being compliant before August 2026?
Beyond the risk of fines of up to 7% of global revenue, a business using non-compliant AI systems risks cease-and-desist orders, certification withdrawals, and reputational damage. Customers and partners will increasingly ask for proof of AI Act compliance.
Are there exemptions for very small businesses?
The AI Act doesn't provide a specific exemption for micro-businesses or small businesses. Any entity using an AI system in the European market is subject to the same rules. However, some obligations can be scaled proportionally to the size of the business, particularly regarding technical documentation and dedicated resources.
How do I know if my tool is classified as “high-risk”?
The classification depends on how the AI system is used, not just its underlying technology. Check Annex III of the AI Act, which lists the high-risk domains (recruitment, credit assessment, justice, etc.). If your tool is used in one of these domains, it's probably covered. When in doubt, a specialized legal review is recommended.
Do I need to train my teams on the AI Act?
Yes, training is a key part of compliance. Your employees need to understand the limitations and risks of the AI tools they use, as well as the procedures to follow. Regular awareness training also helps avoid non-compliant usage (shadow IT) that escapes management's oversight.
Conclusion
The AI Act marks a turning point in European regulation. For small businesses in the Basque Country, the August 2026 deadline is neither as far off nor as trivial as it may seem. Preparation takes time, resources, and a clear picture of the AI tools deployed within the business.
The urgency is no reason to panic. Businesses that start their compliance process now have enough time to get there calmly. Those that wait until spring 2026 to act will expose themselves to major legal and operational risks.
Don't let regulation become a brake on your growth. Turn it into an opportunity to structure your use of AI and gain a competitive edge.