"Are you a real person?" The reply came back in under a second. Friendly, three sentences, keen to help with the booking. It never said yes. It never said no. It kept talking. The owner of a twelve-room guesthouse outside Sintra typed that question into her own website in July, sitting beside me in her office. She had never tested the widget before. It went live a year earlier because her web developer suggested it and the price seemed fair. Guests asked about parking and breakfast times, got answers in seconds, and nobody complained. She read the reply twice, then asked me whether that counted as a problem. Since August 2, it does. The rules that landed this August are not about which AI tool you use. They are about what your AI is allowed to leave unsaid.
1 / What actually changed on August 2On August 2, 2026, the AI Act's transparency rules became enforceable across the EU. If you run a chatbot, a voice assistant, or any tool a customer might mistake for a human, it now has to say what it is, unless that's obvious from context. If you generate marketing images, video, or voice with AI, that content needs a machine-readable marker showing it was made or edited by AI. If you use emotion recognition or biometric categorization anywhere in your business, and some HR and retail tools do this quietly without you noticing, you have to disclose it. Worth knowing the difference here: using emotion recognition on your own staff or students isn't a disclosure question at all, it's been banned outright since February 2025. The disclosure duty covers other uses, and it's due now, not later. This is not a future date to plan around. It is already live. 2 / What you can put down for nowThe heavier rules, the ones covering AI used in hiring, credit decisions, and other so-called high-risk categories, were originally due this same month. The EU pushed that deadline back to December 2, 2027, as part of a wider simplification package agreed this year. If your business runs one of those systems, you now have real time to build it properly instead of rushing a bad version of it before a deadline. Most businesses in hospitality, real estate, dental care, and transport don't run high-risk systems at all. Check before you assume either way, because the definition catches a few tools people don't expect. A recruitment platform that scores or ranks CVs automatically counts. So does software that sets prices or terms for individual customers based on a risk profile it builds itself. A booking chatbot or a marketing image generator does not. The distinction that decides which rules apply to you is whether you're a provider or a deployer. A provider builds or substantially modifies an AI system and sells or offers it. A deployer buys a tool off the shelf and uses it as intended. Almost every SMB owner reading this is a deployer. The obligations are lighter, the timeline is longer, and December 2027 is the date to note in a calendar rather than panic about today. 3 / What shifts again in DecemberTwo more things change on December 2, 2026. First, a grace period ends. AI tools placed on the market before August 2026 got four extra months before their output needed watermarking under the new rules. That window closes on this date. Second, the ban on AI-generated non-consensual intimate imagery moves from a provisional rule to permanent law. Neither of these will likely touch a typical SMB owner directly. If you use an AI image or video tool for marketing, this is the date your provider's watermarking has to catch up, not something you need to build yourself. 4 / The three things worth doing this weekWrite down every AI tool touching a customer, a job candidate, or an employee. Most owners find more than they expected once they actually list it out, a chatbot here, a writing assistant there, an image generator for social posts, maybe a voice tool answering the phone after hours. For each one, ask whether a person could mistake it for a human, or whether its output could pass as unedited reality. If the answer is yes to either question, add one sentence of disclosure or one small label. Check your vendor contracts too. Some tools already add the required disclosure by default, some don't, and the fine lands on you, not on the vendor, if a customer never gets told. For most businesses your size, that's the whole job this month.
I keep coming back to that one missing sentence in the guesthouse chatbot. It wasn't a technology problem. It was a five-minute conversation nobody had gotten around to having. Most of what the AI Act asks of a business your size is exactly that, a conversation that should have happened already, now with a deadline attached to it. Talk soon, Mikkel P.S. If you want a second pair of eyes on what's touching your business right now, chatbots, image tools, anything with "AI" in the name, that's a forty-minute conversation, not a project. Bring your list, or bring nothing and we'll build it together on the call. Or just hit reply and name the one AI tool you are unsure about, I read every reply myself.
The AI Solopreneur • AI Strategy for European SMBs |
