Using AI in your business: the EU AI Act and UK rules in plain English

AI has moved from novelty to everyday tool: chat assistants on websites, voice agents on phones, AI-written captions and AI-edited images. With it come rules. The good news for small businesses is that most everyday uses are low-risk, and the obligations are sensible. This guide explains what applies, when, and what to do. It’s general information, not legal advice.

The EU AI Act in one minute

The AI Act regulates AI by risk level:

• Unacceptable risk — banned. For example manipulative techniques that cause harm, social scoring, and untargeted scraping of facial images to build recognition databases.
• High risk — strict requirements. AI used in areas such as recruitment, credit scoring, education and access to essential services.
• Limited risk — transparency duties. Chatbots, voice agents, emotion recognition, deepfakes and some AI-generated content.
• Minimal risk — no new obligations. Most other uses, such as spam filters or AI help with spreadsheets.

It applies to businesses that *provide* AI systems and to those that *deploy* (use) them in the EU — including businesses outside the EU whose AI is used in the EU.

The key dates

• 1 August 2024 — the Act enters into force.
• 2 February 2025 — banned practices apply; AI literacy duty begins.
• 2 August 2025 — rules for general-purpose AI model providers apply.
• 2 August 2026 — transparency duties under Article 50 apply, along with most other provisions.
• December 2027 onwards — following the 2026 “Digital Omnibus” amendments, the main obligations for stand-alone high-risk systems were postponed to 2 December 2027, with some later dates for AI built into regulated products.

What it means for a typical small business

1. Tell people when they’re talking to AI

If you use a chatbot on your website or an AI voice agent on your phone, people must be informed they’re interacting with an AI system unless that’s obvious. A clear first line — “I’m the virtual assistant for…” — is the simplest way.

2. Label deepfakes and certain AI content

If you publish AI-generated or manipulated images, audio or video that look like real people, places or events (“deepfakes”), you must disclose that they’re artificially generated. There are lighter rules for obviously creative or satirical work. AI-generated text published to inform the public on matters of public interest also needs disclosure unless it has been human-reviewed and someone takes editorial responsibility. Providers of AI tools must also mark AI output in a machine-readable way.

For social media: if an image or video could be mistaken for real, label it. Most platforms now offer an “AI-generated” label — use it.

3. Build AI literacy

Businesses using AI should take steps so that staff who use it understand it well enough: what it’s good at, where it goes wrong, how to check output and how to handle data. For a small team that can be a short internal guide and a conversation.

4. Avoid high-risk uses without proper advice

Using AI to screen job applicants, decide on credit, or determine access to essential services can bring high-risk obligations. Get advice before doing this.

Fines

The AI Act allows fines of up to €35 million or 7% of worldwide turnover for banned practices and up to €15 million or 3% for most other breaches, with lower caps for SMEs and start-ups (the lower of the two amounts applies to them).

The UK approach

The UK has chosen not to pass a single AI law so far. Instead, existing regulators apply existing rules to AI in their areas:

• UK GDPR and the Data Protection Act 2018 — enforced by the Information Commissioner’s Office (ICO), which publishes guidance on AI and data protection.
• Consumer protection law — misleading practices are unlawful whether a person or an AI is responsible; the Digital Markets, Competition and Consumers Act 2024 strengthened enforcement.
• Advertising rules — the ASA’s CAP Code applies to ads made with AI, just like any other ad.
• Sector regulators — for example in financial services and healthcare.

If you serve EU customers from the UK, the EU AI Act may apply to you too.

GDPR and AI: the essentials

• Lawful basis and transparency: explain in your privacy notice when you use AI with personal data, and why.
• Data minimisation: don’t paste more customer data into AI tools than you need.
• Providers: check where data is processed, whether it’s used for training and what data processing terms are in place.
• Automated decisions: people have rights around decisions made solely by automated means that have legal or similarly significant effects. Keep a human involved in important decisions.
• Accuracy: AI can be wrong. Check facts before they reach customers.

Copyright and AI content

Using AI to create images, music or text doesn’t remove copyright concerns. Avoid prompts that copy a living artist’s or brand’s style closely, don’t use other people’s logos or characters, and check the terms of the AI tool for commercial use.

A simple AI checklist for small businesses

1. List the AI tools you use and what for.
2. Tell people when they’re talking to an AI.
3. Label AI images and videos that could be mistaken for real.
4. Keep personal data to a minimum and check your providers.
5. Update your privacy notice.
6. Keep a person in charge of important decisions.
7. Check AI output before it reaches customers.
8. Give your team a short guide to using AI well.

Frequently asked questions

Does the EU AI Act apply to small businesses?

Yes, but for most small businesses the obligations are light: transparency when people interact with AI, labelling deepfakes, AI literacy for staff and avoiding banned or high-risk uses without proper safeguards.

When do the AI Act transparency rules apply?

The Article 50 transparency duties, such as telling people they are interacting with an AI system and labelling deepfakes, have applied since 2 August 2026.

Do I need to label AI-generated images on social media?

If an image or video could be mistaken for real people, places or events, yes — disclose that it’s AI-generated. Using the platform’s AI label is a simple way to do this.

Is there an AI law in the UK?

There is no single AI act in the UK. Existing laws such as UK GDPR, consumer protection and advertising rules apply to AI, enforced by existing regulators such as the ICO, CMA and ASA.

Can I use ChatGPT with customer data?

Only with care: use the minimum data needed, check the provider’s data protection terms and settings, tell customers in your privacy notice and avoid sensitive data unless you have proper safeguards.

The bottom line

The rules reward what good businesses already do: be honest with customers, look after their data, check your work and keep people responsible. Do those things and AI becomes a safe, powerful tool rather than a risk.

Every AI project Viraluna Studio builds — from chat assistants to voice agents — includes clear AI disclosure and privacy-first data handling. Explore AI applications.