A short, plain-English brief you can read in under three minutes, or forward to a client who's asked "does this affect me?"
The EU AI Act is EU law, but it reaches further than EU borders. If your business sells into the EU, has EU customers, or uses an AI tool that processes data belonging to people in the EU, the Act can apply to you even as a UK company. Most small businesses using everyday AI tools, chat software, an AI-assisted CRM, a scheduling assistant, aren't building the AI themselves. You're what the Act calls a deployer, someone using AI built by someone else, and deployers have a lighter set of duties than the companies building the AI.
That's when the Act's main obligations came into force, including the requirement that staff have a basic understanding of the AI tools they're using, known as AI literacy. It isn't a training course in the formal sense. It's making sure the people using AI at work understand roughly what it does, what it gets wrong, and when to double check it.
Almost everything the Act covers falls into one of four bands: unacceptable, banned outright, things like social scoring, which won't apply to an ordinary business, high-risk, extra obligations, mainly around hiring, credit, and similar decisions about people, limited risk, a transparency duty, mainly telling people when they're talking to AI, and minimal risk, no real obligations at all. Most tools a small business uses day to day sit in the last two bands.
List what AI tools the business uses and what they're used for. Check whether any of them make decisions about real people, hiring, credit, pricing, eligibility, rather than just supporting a decision a person makes. Put a short, plain policy in place covering how staff should and shouldn't use AI tools. Make sure the team has had a basic AI literacy briefing. None of this needs to be complicated, and for most small businesses it's an afternoon's work, not a project.
This is general information, not legal advice, and every business's situation is a little different. Auley is a self-serve tool built for UK and EU small businesses that answers the questions above for your specific business in about two minutes, and generates the policy document mentioned here if you need one. Free to check, no sign up needed.
Want the two-minute version for your own business?
Run the free checker to see exactly where you stand and get your policy generated straight away.
Check your risk levelGeneral information, not legal advice. Rules and figures current as of 25 September 2026.