Does Article 4 of the EU AI Act apply to small businesses?
Yes. Article 4 has no size threshold, so a five-person firm whose staff use an AI tool for work is a deployer with the same duty as a multinational. The measure scales with the firm, and the rewritten article commits the Commission and Member States to support SMEs in particular. The myth that the AI Act is a large-company law comes from the high-risk chapters, which are heavy. Article 4 is not in those chapters.
Myth: the AI Act only applies to companies that build AI
The Act defines a deployer as any natural or legal person, public authority, agency or other body using an AI system under its authority, except in a personal, non-professional activity. There is no headcount or turnover in that definition. The Commission's Q&A on AI literacy confirms that a company whose employees use ChatGPT for writing or translating is in scope and should inform staff about specific risks such as hallucination. A solicitor's practice, a dental clinic, a haulage firm and a design studio are all deployers the moment someone uses an AI tool for work.
Myth: SMEs are exempt
The AI Act does give SMEs specific treatment in places. Article 99(6) caps fines for SMEs and start-ups at the lower of the two amounts in each tier. The Omnibus rewrite of Article 4 added a second paragraph committing the Commission and Member States to support and facilitate operators' efforts, in particular those of SMEs, and requiring the Commission to publish practical examples of how to comply. The Commission's Q&A points to the European Digital Innovation Hubs and the AI Skills Academy as sources of support. None of that is an exemption from the duty. It is help with meeting it.
Myth: we are too small to be noticed
Ireland's Central Statistics Office reported in February 2026 that 20.2 percent of enterprises used AI in 2025, including 17.2 percent of small enterprises, 28.6 percent of medium ones and 57.7 percent of large ones. Small firms are the ones most likely to have adopted a tool informally, without anyone deciding to. Enforcement is proportionate and case by case, but the more likely question for a small firm comes from a customer, an insurer or a tender, not a regulator.
What proportionate looks like for a small firm
The duty is to take measures that support AI literacy, calibrated to your people and your context. For a twelve-person firm that uses a general-purpose chatbot and an accounts package with an AI assistant, that is:
- a one-page inventory of the two tools and who uses them
- a half-day session for everyone that covers what the tools do, where they fail and what must never go into them
- a short written record of the session, who attended and why that depth was right
That is a measure you can show. It is also the shape of our half-day workshop.
Sources
- Regulation (EU) 2024/1689, the AI Act, Article 3(4), Article 4 and Article 99(6).
- Regulation (EU) 2026/1744, the Digital Omnibus on AI, for the new Article 4(2) on support for SMEs.
- European Commission, AI literacy: questions and answers, for the ChatGPT passage and the SME supports.
- Central Statistics Office, Information Society Statistics: Enterprises 2025, Artificial Intelligence, published 6 February 2026.
This is general information about the EU AI Act, not legal advice. Enforcement is proportionate and case by case, and your sectoral regulator may issue guidance that applies to you.
