The short version: the EU AI Act does not charge you extra for being a one-person team. It sorts every AI system into a risk tier first, then attaches obligations to the tier — not to your headcount. Most small developer and utility tools land in the minimal or limited tiers and owe almost nothing. The obligations that actually bite (high-risk conformity) were pushed out to 2 December 2027, and only apply if your tool touches a specific list of sensitive uses.
I spent a few weeks turning the regulation's obligations into a checklist, and the part that surprised me most was how little of it applies to the average SaaS utility. Here's the practical map.
The Act is risk-based, not size-based
Regulation (EU) 2024/1689 (the "AI Act") took effect on 1 August 2024, but its duties arrive in stages. The single mental model that matters:
The law asks "how risky is what this system does?" — not "how big is the company behind it?"
So a five-person startup and a bank owe the same duties for the same risk tier. The good news for small teams is that most of what we build never enters a high-risk tier in the first place.
There are four tiers:
| Tier | What it means | Examples | What you owe |
|---|---|---|---|
| Prohibited (Art. 5) | Uses banned in the EU | Social scoring, untargeted facial-image scraping | Nothing — you can't ship it at all |
| High-risk (Art. 6) | Listed safety/rights uses | CV screening, credit scoring, medical devices | Conformity assessment, docs, oversight |
| Limited / transparency (Art. 50) | Users should know it's AI | Chatbots, deepfake generators | Disclosure + labeling |
| Minimal | Everything else | Spam filters, forecast tools, code helpers | Nothing |
Most small AI tools are minimal or limited risk
This is the part the panic overlooks. A regex generator, a SQL explainer, a code-review bot, an internal summarizer — these are minimal-risk systems. They carry no obligations under the Act. You don't register them, you don't file anything, you don't need a conformity assessment.
The only catch is that if your tool interacts with a human, it may trip the transparency tier (Art. 50):
- If a user might reasonably think they're talking to a person, you must tell them it's AI.
- If you generate or manipulate image/audio/video, you should mark it as synthetic.
- AI-generated text published to inform the public should be disclosed.
Those duties are lightweight and have applied since 2 August 2025. If your tool is a background utility that doesn't pose as human and doesn't generate media, you're clear.
The high-risk triggers that actually catch small teams
High-risk status comes from Annex III (specific use cases) or from being a safety component of an Annex I regulated product. The Annex III areas that a small B2B tool is most likely to touch:
- Employment and worker management — CV filtering, candidate scoring, performance monitoring, promotion decisions.
- Essential services — creditworthiness / credit scoring, insurance risk pricing, benefits eligibility.
- Education — admissions, exam grading, placement.
- Biometrics — categorization, emotion recognition, remote identification.
- Law enforcement / migration / justice — profiling, risk assessment, triage.
The trigger is the intended purpose, not the model. A general LLM wrapped as a recruiting screener is high-risk by how you deploy it, even if the model itself is "general-purpose." A general LLM wrapped as a code explainer is not.
The determining question is always: what is this tool for? If the answer maps to a row above, start the high-risk analysis. If not, you're almost certainly minimal or limited.
What high-risk actually requires — and when
If you do land in high-risk, the obligations (for a provider — someone placing the system on the market) include a risk-management system, data governance, technical documentation, logging, human oversight, accuracy/robustness requirements, a conformity assessment, CE marking, and registration in the EU database. A deployer — someone who merely uses a high-risk system they didn't build — owes a lighter set: follow the instructions, run a fundamental-rights assessment, apply human oversight, monitor, and register their use.
Here's the timeline that matters, as of mid-2026:
- Prohibited practices (Art. 5) — already applied from 2 February 2025.
- Transparency duties (Art. 50) and GPAI model obligations (Title IV) — applied from 2 August 2025.
- High-risk obligations for Annex III systems — the Digital Omnibus package moved these from 2 August 2026 to 2 December 2027.
Planning caveat: the 2 December 2027 date assumes the Digital Omnibus amending regulation is published in the Official Journal. Until then the original 2 August 2026 date remains "on the books." Treat 2 Dec 2027 as the operative planning date per the Commission's stated timeline, and re-confirm against the published text before relying on it for a binding decision.
The point: classification is not delayed. You should figure out your tier now, even though the heavy obligations are years out. The work you do in 2026 — a classification file, retained documentation, basic oversight — is what makes 2027 a formality instead of a fire drill.
A pragmatic checklist for a small tool
- Classify. Write down what the tool is for and which tier that implies. If it's minimal, stop.
- If it talks to users or generates media, add the Art. 50 disclosures. Cheap, and already required.
- If it touches an Annex III use, open the high-risk analysis now: document intended purpose, retain the provider's technical docs, plan human oversight and monitoring. You don't need conformity assessment yet, but the evidence file should exist.
- Know if you're a provider or deployer. Building and selling it = provider. Using someone else's = deployer. The duties differ.
- Re-check the dates against the published Omnibus text before any binding deadline.
Where this gets tedious — and what I built
The annoying part isn't the law, it's the bookkeeping: which tier, which articles, which dates, and keeping it all straight as the amendments shift. I turned that into AIActRadar. You answer questions about what your tool does, and it classifies the risk tier, maps the obligations and deadlines that attach to that tier, and hands you a dated checklist. The classification and obligation mapping are deterministic — same answers, same output — because "the compliance tool hallucinated my deadlines" is a failure mode I didn't want to ship. There's a model-assisted layer for the prose, but it can't change your tier.
If your spreadsheet still says "August 2026" anywhere, that row predates the Omnibus amendments. Knowing it's stale is the first half of the job.
FAQ
Q: Does the EU AI Act apply to a tiny one-person AI tool?
A: Yes, it applies to any AI system placed on the EU market or used there — but it's risk-based, not size-based. A small utility that is minimal-risk owes nothing; a small tool that screens job applicants is high-risk regardless of team size. The obligations follow the risk tier, not the headcount.
Q: What is the actual deadline I need to worry about?
A: For most small tools, the near-term deadline is already here: transparency duties (Art. 50) applied from 2 August 2025. The big one — high-risk obligations for Annex III systems — was delayed by the Digital Omnibus to 2 December 2027. Prohibited practices have applied since 2 February 2025.
Q: My tool uses an LLM API. Am I the "provider" or the "deployer"?
A: If you build and offer the system to others, you're generally the provider and owe the build-side obligations. If you only use a system someone else placed on the market, you're the deployer and owe the lighter use-side duties (follow instructions, human oversight, monitoring, register your use). Many small teams are deployers of a GPAI model but providers of the application built on top.
Q: Do I need to register my minimal-risk AI tool anywhere?
A: No. Minimal-risk systems carry no registration or filing obligation under the AI Act. Only high-risk systems are registered in the EU database (Art. 49 / Art. 71), and that requirement attaches to the high-risk obligations' timeline.
Q: What does "transparency risk" mean for a chatbot I built?
A: If a user could reasonably believe they're interacting with a human, Article 50 requires you to disclose that they're talking to AI. If your tool generates or alters image, audio, or video, you should label it as synthetic. These duties apply to limited-risk systems and have been in force since 2 August 2025.
References
- Regulation (EU) 2024/1689 (the AI Act) — EUR-Lex — the full text: tiers, obligations, and deadlines.
- European Commission — AI Act and Digital Omnibus — the amendment that moved the high-risk timeline.
- European AI Office — guidance and coherent application across Member States.
- AIActRadar — the classifier/checklist tool referenced above.
Top comments (0)