Many SME entrepreneurs think that the new European AI Act is only relevant for tech companies that develop AI themselves or build it into their software. That is a misconception that can prove costly. As soon as your organisation works with a CV screening tool, a chatbot on the website, Microsoft Copilot or simply ChatGPT at work, you already fall under the AI Act. It is important to know that the clock is already ticking: some of the obligations already apply, and the rest will come into effect in phases up to and including 2028.
Why this affects you too
Imagine: you simply sell shoes, advise on insurance or carry out installation work, and you have never written a single line of AI code. Yet your HR department uses a package to screen CVs, your customer service has a chatbot answer the first questions, and your administration occasionally types a draft email into ChatGPT. Legally speaking, you are then not a developer of AI, but you are a “deployer” of AI systems. And that status comes with its own obligations.
This means you cannot wait for a supplier to tell you that everything is in order. The AI Act applies as soon as an AI tool reaches the EU market, regardless of whether the provider is based in Europe or in the United States. In other words: even if you are only a user of a third-party tool, you must assess for yourself which risk category that tool falls into under the AI Act and which obligations apply.
Step 1: qualify before you do anything else
The core message is simple: before you can start on compliance, you first need to establish whether and how the Act applies to you. This takes three steps: identify, classify and control.
Identifying means: which systems within your organisation actually contain AI? That is harder than it sounds, because almost everything now contains some form of AI, from the spam filter to the planning tool. Not every application automatically falls under the AI Act.
This is followed by classifying: which risk category does the tool fall into, and which obligations apply? Only then comes controlling: actually becoming compliant.
The AI Act works with four risk categories, plus a separate category for large language models. Unacceptable risk is simply prohibited, think of social scoring and biometric emotion recognition in the workplace; this ban has applied since February 2025.
Limited risk revolves around transparency: with a chatbot, deepfake or imitated voice, it must be immediately clear to the user that they are dealing with AI, with a deadline of August 2026.
And then there is the category of minimal or no risk, such as music recommendations (e.g. Genius in Apple Music), for which no AI Act obligations apply.
High risk is the category with the most obligations, such as CV selection, HR decisions, education, the administration of justice and immigration.
Through the Omnibus Regulation, it has been proposed to postpone the deadline for the applications in Annex III to 2 December 2027, and the deadline for products under Annex I to 2 August 2028. NB. Bear in mind that these dates are still part of an ongoing legislative process and may still change; make sure you are kept up to date on this in good time.
It is not only the high-risk systems that count
This is exactly where it becomes complicated and risky for you as an entrepreneur: even if your organisation does not use high-risk AI, obligations already apply now. Do you use a high-risk system, for example for CV screening or staff appraisals? Then, under Article 26 of the AI Act, a whole series of obligations applies to you as a deployer:
- use in accordance with the supplier’s instructions,
- organising human oversight,
- ensuring relevant and representative input data,
- monitoring how the system works and reporting risks or incidents,
- keeping logs for, in principle, at least six months, and
- informing employees in advance.
For certain Annex III applications, a Fundamental Rights Impact Assessment (FRIA) must also be carried out.
Since February 2025, you must also ensure that your employees are “AI literate”. Through the Omnibus Regulation, it has been proposed to ease this requirement to merely “facilitating” AI literacy, but this process has not yet been completed. So do not yet assume that the eased standard already applies, and take into account the current, stricter reading of the obligation until the legislator provides definitive clarity. In practice, this means that you must use internal or external training to let your employees know what AI does within your organisation, what the opportunities are and what the risks are.
HR in particular calls for care. AI systems for recruitment and selection, and systems that make decisions about terms of employment, promotion, termination or task allocation, are classified as high risk. And some applications are simply prohibited: AI used to infer employees’ emotions is in principle not allowed, and if a supplier offers you AI to measure “engagement”, “stress” or “culture fit” based on voice, face or behaviour, you must halt that implementation immediately.
The separate category: large language models from the United States
And then there are the large language models themselves, such as ChatGPT, Copilot, Claude and Gemini. These fall into a category of their own: General Purpose AI, also referred to as systemic risk, intended for models with enormous computing power and corresponding impact. Here, Europe is the first in the world to introduce a broad, binding legal framework for AI to protect its citizens. Other countries are now also experimenting with AI legislation, but often on a sector-by-sector basis or with a less binding character. No other jurisdiction has so far put in place a framework as binding and comprehensive as the AI Act. The large American technology companies that build these models and offer them worldwide must therefore simply comply with European rules as soon as their tool enters the European market.
These providers do get somewhat more time to adapt than originally planned. For new GPAI models, strict requirements have applied since August 2025, but an extended transition period applies to older models, with deadlines extending up to August 2027. That is a nuance, not a free pass: these providers too will have to comply with requirements on risk assessment, incident reporting, testing and cybersecurity.
The AI Act and the GDPR: two different laws that go hand in hand
This risk is often overlooked: complying with the AI Act does not mean that you also comply with the GDPR. These are two separate laws, each with its own scope, which constantly overlap as soon as personal data is involved. As soon as you upload data into an AI tool, that is processing under the GDPR, and you must once again assess the purpose and legal basis. For business services, that legal basis is often: necessary for the performance of a contract, but stricter requirements apply to special categories of personal data under Article 9 GDPR.
This is exactly where it becomes complicated and risky for you as an entrepreneur, as soon as American providers come into play. American servers are, in principle, not GDPR-compliant because of the US CLOUD Act. Under that law, American security services can demand data from American companies, even if that data is stored on servers in Europe, without the data subject having any say in the matter.
In the Latombe case of 3 September 2025, the Court of Justice of the EU ruled that the Data Privacy Framework offered an adequate level of protection at the time of the adequacy decision in July 2023. Please note: this is a judgment on the situation at that time, not a permanent guarantee. Given the ongoing concerns about American intelligence services, the sustainability of the DPF may be called into question again in the future.
In practice, this means that all free and even the regular paid consumer versions of ChatGPT, Copilot, Perplexity and Claude are not GDPR-compliant. Only an Enterprise licence from a DPF-certified American provider, usually of the most expensive kind, provides the starting point for an adequate level of protection, but this is not an automatic guarantee: the precise contractual terms and the actual configuration remain decisive. Partly for this reason, large organisations such as ABN AMRO are turning to European alternatives such as Mistral. For an SME that does not simply purchase the most expensive enterprise licence, that leaves one simple rule: anonymise all information you upload into a consumer tool, or use a smaller, European, GDPR-compliant tool.
This applies equally to widely used office software. SharePoint, Teams, Outlook and Copilot all process personal data, and whether this is done in a GDPR-compliant way depends entirely on the configuration and settings. Make sure your IT administrator reviews the current privacy and security settings of your Microsoft 365 environment and configures them to the most secure options, including settings that determine whether and how data is processed outside your own environment, and that access, retention periods, sharing and logging are properly set up. Have these settings checked periodically, because Microsoft’s configuration options change regularly.
Enforcement: who will monitor compliance?
What does this mean for you as an entrepreneur in practice? Enforcement of the AI Act in the Netherlands is expected to be shared among several market surveillance authorities, presumably including the Dutch Data Protection Authority and the Dutch Authority for Digital Infrastructure (RDI); the exact division of powers follows from Dutch implementing legislation, which at the time of writing has not yet been finalised in all respects. At EU level, the European Commission in particular plays a supervisory role with regard to the large language models (GPAI). Make sure you are informed separately about the precise division of supervisory tasks before you base any policy on it.
A realistic caveat: the supervisory authorities are still being set up and are expected to have limited capacity in the initial phase, so an immediate wave of fines is not to be expected. Attention is expected to focus first on larger companies. However, this situation may change quickly once the supervisory authorities are fully established, and anyone who has still not arranged anything by then still runs the risk of enforcement with retroactive effect to the moment the obligation already applied.
Action points for your organisation
- Map out which AI systems are used within your organisation, including third-party systems that you only purchase.
- Classify, for each system, which risk category it falls into and which obligations apply.
- Ensure your employees are AI literate through internal or external training.
- Update your privacy documentation: include AI use in your record of processing activities, describe the purposes, record which systems are permitted and update your privacy statement. It is not sufficient to merely state in your general terms and conditions that you use AI.
- For every AI tool your employees use, check whether the licence is actually GDPR-compliant, and in case of doubt, opt for anonymisation or a European alternative.
The core message is simple: even if you do not develop AI yourself, you are almost certainly already using it in your business processes, and that makes you responsible under the AI Act. Combine that with the GDPR obligations, which continue to apply in full, and you have a compliance task that will not wait until the supervisory authorities have sufficient capacity. Given the speed at which this area of law is developing, particularly due to the ongoing Omnibus legislative process, we recommend having this topic updated periodically. So make sure you get advice in good time.
Do you need help mapping out your AI obligations or making your use of AI GDPR-compliant? We, the corporate lawyers of The Legal Company, are happy to support you with this. Feel free to contact us at info@thelegalcompany.nl or 020-3450152.
Blog by our corporate lawyer Hella Vercammen LL.M.
