The EU AI Act: What SMEs need to know

The EU AI Act aims to lay down boundaries for how businesses build, adopt and behave when it comes to the use of AI. It’s something the EU has been working on for some time, and we are likely to see similar legislation being introduced in other areas too.

The Act is one of the first rule books of its kind to be introduced globally and for any SMEs using artificial intelligence, it means there are steps that now need to be taken to stay compliant and avoid potential penalties.

On 2 August 2026, the Act’s transparency requirements officially coming into force, meaning any organisation using AI now has legal responsibilities.

If you’re thinking they won’t apply as your business is in the UK, then think again! They apply to any business with a website, digital services, or communication channels that can be accessed by users in the EU, regardless of where the company is based.

As such, the Act is likely to have implications for many businesses, with more than half of UK firms saying they are actively using the technology, according to the British Chambers of Commerce. We are also seeing increasing interest here at Dragon, where we are busy supporting SMEs with their AI readiness and AI training.

In this article, we explore in more detail what the EU AI Act means in practice and outline the steps SMEs should take to remain compliant, particularly around the new transparency obligations.

What is the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive legal framework for artificial intelligence. It is designed to ensure AI is used safely, ethically and transparently.

The Act categorises AI systems by risk level and introduces obligations for both developers and users, including specific support measures for SMEs.

The first part of the Act, which came into force on 2 August 2026, is the transparency requirement. It applies to any organisation using AI in a way that interacts with people, including customer-facing tools such as chatbots, and AI‑generated (or significantly AI supported) web site and social media content.

This is just the beginning, with other elements of the Act expected to be phased in over the next two years, including stricter obligations for businesses that use or deploy ‘higher‑risk’ AI systems.

Does the EU AI Act apply to UK SMEs in 2026?

Yes! One common misconception is that the EU AI Act only applies to businesses located or operating in the EU. In fact, the Act applies to any organisation whose AI systems or AI‑generated content might reach an EU user.

For example, if your website is accessible in the EU, your chatbot may be used by an EU visitor, or your AI‑generated social media content is visible to EU audiences.

The location of your office is irrelevant, what matters is where your digital presence can be accessed.

What EU AI Act transparency rules must SMEs follow?

The transparency obligations are simple in principle: people must not be misled about whether they are interacting with AI or consuming AI‑generated content. Whether that is using an AI chatbot on a company website, or viewing website copy, social media posts or other marketing materials that have been generated with AI support.

Where external audiences are interacting with AI, businesses must ensure that those interactions comply with the Act’s transparency rules, by making it very clear that AI is involved.

So, what does that mean in practice?

You must tell people when they are interacting with AI

If your company offers a chatbot, virtual assistant, or other automated support tools, you must inform users at the start of the interaction that they are speaking to AI. This is disclosure must be provided before the interaction or consumption takes place, and cannot be hidden away within a privacy policy, or buried in the small print.

For example, a chatbot should open with a message such as: You are now chatting with an AI assistant.

AI‑generated or AI‑assisted content must be labelled

If your business publishes content that has been created or significantly assisted by AI, you must make this clear to your audience. This includes blog posts, social media content, website copy, product descriptions, and AI‑generated images and videos.

The disclosure must be visible to humans and also, where technically feasible, embedded in the file metadata so machines can detect it too.

A simple line such as “This article was generated with the assistance of AI” is sufficient for human readers, but you should also ensure the file contains appropriate metadata or watermarking.

Make it clear it’s a deepfake

If you publish AI‑generated media that resembles real people, places, or events, it must be labelled as such. The information must be clear and prominent so viewers cannot miss it.

Inform people when emotion recognition or biometric analysis are used

If your business uses AI to analyse customer sentiment, facial expressions, voice tone, or other biometric signals, you must tell people before the analysis begins. This is particularly relevant for call centres and customer support teams, who may be using AI‑powered sentiment analysis.

How should SMEs make people aware of AI?

The Act is very clear: disclosures must be obvious, clear and unambiguous. In other words, no user should be left guessing whether AI was involved.

On a website, this could mean placing notices above or next to chat widgets, adding captions to AI‑generated images and clearly marking AI‑generated articles.
Within an app or customer portal, you might use pop‑ups or introductory messages.
For audio or video content, it might take the form of a spoken notices, on‑screen text, or a watermark.
While in marketing content, you could add captions or footnotes.

What do SMEs need to do now to comply with the EU AI Act?

Step 1: Conduct an AI audit and add disclosures

Start by conducting an audit of your AI usage. List every AI tool your business uses, from chatbots to content generators and CRM automations. Identify where customers might interact with AI‑generated content. You then need to add clear disclosures at each of those touchpoints.

Step 2: AI Literacy

Under the EU AI Act, AI literacy is required. This refers to ensuring that staff have a basic level of knowledge, understanding and practical skills, in order to be able to use AI safely, responsibly and effectively. It’s not about turning every employee into a technical expert, it’s about making sure anyone who uses AI in their job understands how to use it in line with company policy.

Step 3: Get an up‑to‑date AI policy in place

Create an AI policy, or ensure any existing policies are fully up to date. The policy doesn’t need to be long or complicated. It just needs to outline which AI tools are approved for use by the business, how they should be used, how disclosures must be applied, and how new tools should be tested and approved before adoption.

These steps will not only help you comply with the Act but will also support your business to maintain strong and secure systems and processes, build trust with your customers, and reduce the risk of accidental misuse.

Find out more on the Accelerating AI podcast

Our MD Lionel recently joined Andy from Fliwheel and Matt from Qoob on the Accelerating AI podcast to explore this topic in more details. From what the EU AI Act is, to what it means for SMEs, and how to stay compliant, you can watch it on YouTube by clicking here.

How Dragon supports SME AI readiness

At Dragon, we are proud to help SMEs to navigate the evolving area of AI and AI readiness. Whether you’re just beginning your AI journey, or already using tools across your business, talk to our team for advice.