If your business uses an AI chatbot or generates content with AI, one rule from the EU AI Act applies from 2 August 2026: you must clearly tell visitors they are talking to AI, not a human. For most small businesses that is the whole core, not the 35-million-euro fines from the LinkedIn headlines.
I read the full Regulation (EU) 2024/1689, including the omnibus changes approved in June 2026, so you do not have to. I am Tair Khamitov, I build websites and AI automation for small businesses in Bratislava. Most articles about the AI Act are written either for corporate lawyers or for clickbait headlines. This is the version for a cafe, e-shop or clinic owner: what actually applies to you, what you can safely ignore, and what you can settle in one afternoon.
Contents
1. The panic you keep hearing about the AI Act
Open LinkedIn and you find the same loop: "the AI Act changes everything", "fines up to 35 million euro", "your business must act now". Most of it is written by consultants who want to sell you an audit, or by law firms targeting corporations. For a sole trader with an e-shop, or a cafe with a booking bot, it is needless fear.
The reality is duller and cheaper. The AI Act is tiered by risk, and almost everything a normal small business does with AI (a chatbot, generating text, automating email) sits in the two lowest tiers, where the only real duty is transparency. Not an audit, not a certificate, not a lawyer on retainer.
The AI Act is not about banning AI. It is about people knowing when they are talking to a machine.
2. The AI Act sorts everything into four risk levels
The entire Regulation (EU) 2024/1689 rests on one idea: the higher the risk to people, the stricter the rules. Four levels:
- Unacceptable risk, banned outright (social scoring of citizens, manipulative subliminal techniques). A normal business is not here.
- High risk, AI-driven hiring, credit scoring, medical diagnostics. Strict documentation. Most small businesses are not affected.
- Limited risk, chatbots and AI-generated content. This is where the vast majority of small businesses sit. The duty: transparency under Article 50.
- Minimal risk, spam filters, AI in games. No obligations.
The question a small business should ask is not "do I have to comply with the AI Act?", but "which tier does what I do fall into?". For a chatbot and marketing text, the answer is almost always: limited risk.
3. Timeline: what applies when (after the omnibus)
The AI Act phases in over time. In 2026 the EU institutions agreed on the so-called digital omnibus, which pushed back the deadlines for high-risk systems. That matters, because the original dates still circulate online as if they were current. The state of play:
| Date | What starts applying | Small business? |
|---|---|---|
| 2 Feb 2025 | Banned practices + AI literacy (Art. 4) | Yes, literacy |
| 2 Aug 2025 | General-purpose AI (GPAI) + governance | Indirectly |
| 2 Aug 2026 | Transparency (Art. 50) + enforcement | YES, the main date |
| 2 Dec 2027 | High risk, Annex III (deferred by omnibus) | Rarely |
| 2 Aug 2028 | High risk in products, Annex I (deferred) | Rarely |
Source: Regulation (EU) 2024/1689 plus the omnibus amendment the EU institutions agreed in 2026. The high-risk dates moved; the general 2 August 2026 date stays in force (marking of AI-generated content has a transition until 2 December 2026 for systems placed on the market before then).
4. What a small business must do (and what it need not)
If you run an AI chatbot on your site, Article 50 applies from 2 August 2026: at the first interaction you must state clearly and distinguishably that the visitor is talking to AI, not a human, unless that is obvious. That is one sentence in the welcome message. That is all.
The second duty, in force since February 2025, is AI literacy. It sounds official; in practice it means the people in your business who use AI understand it at a basic level, what it can do, where it makes things up, when to double-check its output. For a small business that is a short internal briefing, not a certificate.
And what you need NOT do: no formal audit, no registering your chatbot, no lawyer on retainer, and no paying for an "AI Act certification" that someone is selling you. Those are either obligations for high-risk systems, or inventions to sell a service.
If you generate visuals or video with AI (deepfake-type content), those must be visibly marked and machine-readable. Ordinary marketing text that a human has read and approved does not fall under the marking duty, human editorial review is an exception written into Article 50 itself.
5. Fines: why 35 million euro is not about you
Yes, Article 99 allows fines up to 35 million euro or 7% of worldwide turnover. But that is the top band for banned practices, social scoring, manipulative systems. For breaching other obligations the ceiling is 15 million euro or 3%.
The key point for a small business: the regulation expressly requires the interests of SMEs and startups to be taken into account. For small and mid-sized enterprises the lower of the two values (the percentage or the amount) applies, not the higher. Fines must be proportionate and must not wipe out the firm's viability. The real risk for a cafe that forgets to label its chatbot? A request to fix it, not a business-ending fine.
Those headline millions are for firms doing banned things. You just have to be transparent.
6. Who supervises this in Slovakia
Member states had to designate national supervisory authorities. In Slovakia the framework is being built by MIRRI through a national law moving through 2026. For the part where AI processes personal data, the Office for Personal Data Protection is competent; product conformity is covered by other bodies (such as the Slovak Trade Inspection).
For an ordinary business owner this means one thing: the exact split of powers is still being finalised, but the obligations from the regulation apply directly regardless of which office ends up enforcing them. Do not wait for the national law, you can handle chatbot transparency either way.
7. Your compliance in one afternoon
A concrete path for a small business that uses AI. Three steps, no lawyer:
- Label the chatbot. One sentence in the first message: "You are chatting with an AI assistant; we will connect you to a human if needed." Article 50, done.
- Brief the team. 30 minutes: what AI can do, where it makes things up, when to verify output. That is your AI literacy, write down the date of the session.
- Mark AI visuals. Visibly mark AI-generated images and video. Text a human approves needs no marking.
When we build an AI chatbot or automation, the Article 50 disclosure is set by default, it is part of DevNova AI Automation, not an extra charge. How it fits the wider digitalisation path is covered in our guide to digitalising a small business, and a concrete bot deployment on an e-shop in our article on AI chatbots. Prices are public on our pricing page.
Frequently asked questions
Does my small business have to do anything right now? If you use an AI chatbot or generate content with AI, yes: from 2 August 2026 you must clearly label that it is AI. Most other obligations do not touch small businesses.
Am I at risk of 35-million-euro fines? In practice, no. The top rates are for banned practices that a normal small business does not do. For SMEs and startups the lower of the two values applies, and the fine must be proportionate.
Is the AI chatbot on my site a high-risk system? No. A customer-support chatbot falls under transparency (Article 50), not high risk. The only real duty: tell the visitor they are talking to AI.
What is the AI literacy that applies from February 2025? That the people using AI in your business understand it at a basic level, what it can do, where it errs, when not to rely on it. For a small business that is a short internal briefing, not a certificate.
Did the 2026 omnibus postpone any deadlines? Yes. The obligations for high-risk systems (Annex III) moved to 2 December 2027 and for product-embedded ones (Annex I) to 2 August 2028. The 2 August 2026 date for transparency stays in force.
Do I have to label AI-generated text on my blog? If the text informs the public on matters of public interest and has not had human editorial review, yes. Ordinary marketing text that you have read and approved does not fall under this duty.
Who enforces this in Slovakia? The supervisory framework is being built by MIRRI; for AI processing personal data the Office for Personal Data Protection is competent. The exact split of powers is being finalised by a national law during 2026.
About the author
Tair Khamitov is the founder of DevNova in Bratislava. He builds websites, e-shops and AI automation for small and mid-sized businesses across Central Europe, and reads regulatory texts to extract the one percent that actually touches an ordinary business owner. He is not a lawyer; this article is an orientation overview, not legal advice. For a specific case, consult a lawyer. Contact: b2b@devnova.eu.