In July, I sat across from a woman who runs a twelve-room guesthouse outside Sintra. She had added a chat widget to her booking page the year before, mostly because her web developer suggested it and the price felt reasonable. Guests typed in a question about parking or breakfast times, and a bot answered within seconds. She liked it. Her guests seemed to like it too. I asked her one question. Does the chatbot tell people it's a chatbot? She didn't know. She opened the widget on her own site, typed "are you a real person," and the bot answered with a friendly, generic reply that dodged the question completely. It didn't say yes. It didn't say no. It just kept talking. That gap, one missing sentence, is exactly what the EU AI Act now asks her to close. The rules that landed this August are not about which AI tool you use. They are about what your AI is allowed to leave unsaid.
1 / What actually changed on August 2On August 2, 2026, the AI Act's transparency rules became enforceable across the EU. If you run a chatbot, a voice assistant, or any tool a customer might mistake for a human, it now has to say what it is, unless that's obvious from context. If you generate marketing images, video, or voice with AI, that content needs a machine-readable marker showing it was made or edited by AI. If you use emotion recognition or biometric categorization anywhere in your business, and some HR and retail tools do this quietly without you noticing, you have to disclose it. Worth knowing the difference here: using emotion recognition on your own staff or students isn't a disclosure question at all, it's been banned outright since February 2025. The disclosure duty covers other uses, and it's due now, not later. This is not a future date to plan around. It is already live. 2 / What you can put down for nowThe heavier rules, the ones covering AI used in hiring, credit decisions, and other so-called high-risk categories, were originally due this same month. The EU pushed that deadline back to December 2, 2027, as part of a wider simplification package agreed this year. If your business runs one of those systems, you now have real time to build it properly instead of rushing a bad version of it before a deadline. Most businesses in hospitality, real estate, dental care, and transport don't run high-risk systems at all. Check before you assume either way, because the definition catches a few tools people don't expect. A recruitment platform that scores or ranks CVs automatically counts. So does software that sets prices or terms for individual customers based on a risk profile it builds itself. A booking chatbot or a marketing image generator does not. The distinction that decides which rules apply to you is whether you're a provider or a deployer. A provider builds or substantially modifies an AI system and sells or offers it. A deployer buys a tool off the shelf and uses it as intended. Almost every SMB owner reading this is a deployer. The obligations are lighter, the timeline is longer, and December 2027 is the date to note in a calendar rather than panic about today. 3 / What shifts again in DecemberTwo more things change on December 2, 2026. First, a grace period ends. AI tools placed on the market before August 2026 got four extra months before their output needed watermarking under the new rules. That window closes on this date. Second, the ban on AI-generated non-consensual intimate imagery moves from a provisional rule to permanent law. Neither of these will likely touch a typical SMB owner directly. If you use an AI image or video tool for marketing, this is the date your provider's watermarking has to catch up, not something you need to build yourself. 4 / The three things worth doing this weekWrite down every AI tool touching a customer, a job candidate, or an employee. Most owners find more than they expected once they actually list it out, a chatbot here, a writing assistant there, an image generator for social posts, maybe a voice tool answering the phone after hours. For each one, ask whether a person could mistake it for a human, or whether its output could pass as unedited reality. If the answer is yes to either question, add one sentence of disclosure or one small label. Check your vendor contracts too. Some tools already add the required disclosure by default, some don't, and the fine lands on you, not on the vendor, if a customer never gets told. For most businesses your size, that's the whole job this month.
I keep coming back to that one missing sentence in the guesthouse chatbot. It wasn't a technology problem. It was a five-minute conversation nobody had gotten around to having. Most of what the AI Act asks of a business your size is exactly that, a conversation that should have happened already, now with a deadline attached to it. Talk soon, Mikkel P.S. If you want a second pair of eyes on what's touching your business right now, chatbots, image tools, anything with "AI" in the name, that's a forty-minute conversation, not a project. Bring your list, or bring nothing and we'll build it together on the call. Or just hit reply and name the one AI tool you are unsure about, I read every reply myself.
The AI Solopreneur • AI Strategy for European SMBs |
