Understanding the EU AI Act: A Practical Guide for SMEs

Introduction

AI is already part of everyday work in most organisations. Staff use ChatGPT or Microsoft Copilot to draft emails, summarise documents and prepare proposals, and many business tools now include AI features by default.

The EU AI Act is the first comprehensive law governing artificial intelligence. Much of the attention has focused on large technology companies, but SMEs and independent organisations should not assume it is irrelevant to them. Most smaller organisations are not building AI. They are using it, and the Act has something to say about that too.

How the Act is structured

The Act takes a risk-based approach. The obligations depend on what an AI system is used for, not simply on which tool it is.

• Prohibited practices. A small number of uses are banned outright, such as social scoring or systems designed to manipulate people in harmful ways.
• High-risk uses. AI used in areas such as recruitment, education or access to essential services carries significant obligations, particularly for the organisations that provide those systems.
• Transparency. People should be told when they are interacting with an AI system, and certain AI-generated content should be identifiable as such.
• Everyday, lower-risk use. Most day-to-day use by SMEs, such as drafting, summarising or brainstorming, falls here and carries lighter obligations.

AI literacy: the obligation most SMEs will notice

The Act expects organisations that use AI systems to take measures to ensure, to the best of their ability, a sufficient level of AI literacy among staff who use AI on their behalf. In practice, this means your people should understand what the tools they use can and cannot do, and how to use them sensibly for their role.

The Act does not prescribe a specific course or certificate. What matters is that the organisation has taken reasonable, proportionate steps.

What this means for your organisation

The Act sets legal requirements. Around them sits good organisational practice, which helps an organisation show it is aware of, and in control of, how AI is used. For most SMEs, that practice comes down to a few foundations:

• Visibility. Knowing which AI tools are in use and what they are used for. Informal use often runs ahead of what leadership is aware of.
• Clear guidance. Agreed expectations on acceptable use, what information should never be entered into AI tools, and when a person must check the output.
• Ownership. Someone who takes responsibility for how AI is adopted and reviewed.
• Staff understanding. Practical awareness that supports the AI literacy expectation.
• A record. Keeping decisions, reviews and issues together, so the organisation can show what it has considered.

How AI Right helps

These foundations are easier to describe than to put in place and keep current. AI Right starts with a free assessment of where your organisation stands today. Your answers then help prepare your Workspace, including a draft AI Policy for you to review, an AI Register listing the tools you use as Under review, and the option to nominate an AI Champion.

When you are ready, the Staff Hub gives employees clear, practical guidance on using AI safely, which supports your organisation's approach to AI literacy. As an ongoing part of the service, AI Right also keeps you informed about relevant AI, regulatory and sector developments.

In short, AI Right helps you put practical foundations in place, with one structured Workspace for your AI Policy, AI Register, AI Champion, Staff Hub and records, alongside ongoing AI, regulatory and sector updates, so you can adopt AI with clarity and confidence.

Conclusion

The AI Act should not be seen as a barrier to innovation. For most SMEs, it is a prompt to adopt AI with clarity, and to build confidence in its use among staff, customers and partners.

Responsible AI adoption is not about doing less with AI. It is about doing it with clarity, accountability and trust.