Artificial intelligence entered small businesses without an organized legal and technical assessment. A shop uses ChatGPT for product descriptions. An e-shop tests Claude or another AI assistant for customer questions, with a human checking the answers. An accounting office tests a tool that summarizes documents. A service company writes offers, emails and posts with AI. An employer considers using software that “sorts” CVs.

The first reaction is often practical: if it saves time, why not use it? The second is fearful: is it now prohibited? The right answer lies in the middle. The AI Act, meaning Regulation (EU) 2024/1689 on artificial intelligence, does not generally prohibit the use of tools such as ChatGPT, Claude or other AI assistants. It does, however, set rules according to the risk, the role of the business and the output produced by the system.

Start from the use, not from the tool

The same AI tool can be a simple aid when it writes a draft email, but much more sensitive when it is involved in recruitment, credit, insurance, education or access to essential services.

For a small Greek business, the key question is not “should I stop AI?”. It is simpler and more serious: where do I use it, what data do I put into it, who checks the output, whether the customer must be informed and whether my use touches sensitive decisions such as recruitment, assessment, credit, insurance, education or access to services.

This article is a practical guide. It is not a technical manual and it does not replace legal advice. Its aim is to help a professional distinguish everyday low-risk use from use that needs internal rules, and from use that should not happen without a specific review.

In practice, the legal issue is not to demonize AI. It is to have a simple usage policy: what may be entered into the tool, who checks the output, when the customer is informed and when legal or technical assessment is needed before the system becomes part of daily operations.

What the AI Act is in simple terms

The AI Act is the first unified European regulation for artificial intelligence systems. The European Commission presents it as a framework based on risk assessment: the greater the risk to safety, health, fundamental rights or important decisions about people, the heavier the obligations.

Not all AI tools are treated the same. A tool that suggests social media titles does not carry the same weight as a system that evaluates job candidates or gives personalized instructions without human oversight.

The logic of the regulation is tiered. Some practices are prohibited. Some systems are high-risk and require strict compliance. Some mainly have transparency obligations. Most everyday low-risk tools will not need a heavy file, but that does not mean they can be used without order.

For small businesses this means something very specific: do not start from the name of the tool; start from the use. The same AI tool may be a simple aid when it writes a draft email, but much more sensitive when it is used to exclude a customer, employee or candidate from something important.

The dates that matter in 2026

The AI Act entered into force on 1 August 2024 and applies in stages. Its general provisions and original prohibitions have applied since 2 February 2025. AI literacy remains an obligation, but Regulation (EU) 2026/1744, which entered into force on 27 July 2026, changed Article 4: it requires measures supporting the development of AI literacy, without guaranteeing a specific level for each individual.

From 2 August 2025, rules apply for providers of general-purpose models, such as large AI models. This concerns more directly companies that create or make such models available, but it also matters to small businesses because it affects their suppliers.

Article 50 transparency duties have applied since 2 August 2026, subject to the limited transition explained in the table. The AI Omnibus changes have now been enacted through Regulation (EU) 2026/1744, published on 24 July 2026 and in force from 27 July. They are no longer merely a political agreement. Each business should check its role, the system's intended use and the relevant application date.

DateWhat it means in practiceWhat a small business should do
1 August 2024The AI Act entered into forceStart mapping AI uses
2 February 2025 / 27 July 2026General provisions and original prohibitions from 2025; revised Article 4 from 27 July 2026Measures supporting AI literacy, adapted to the team and its use of the tools
2 August 2025Obligations apply for providers of general-purpose AI modelsCheck AI suppliers and their terms
2 August / 2 December 2026Article 50 applies from 2 August. Only providers of systems placed on the market before that date have until 2 December for paragraph 2 marking and detectability dutiesThe Article 111(4) grace period does not cover disclosure of deepfakes or public-interest text under Article 50(4)
2 December 2027 / 2 August 2028Chapter III, Sections 1–3, except Article 6(5), apply on these respective dates to Article 6(2) systems (Annex III) and Article 6(1) systems (Annex I)Check the category and transitional rules before use in recruitment, credit or regulated products

Are you a provider, deployer or simple user?

The AI Act uses roles. For small businesses, the most common role is deployer: the business uses an AI system in its professional context. It did not build the system itself, but it puts it into its daily operations. A repair shop that adds a chatbot to its website, an e-shop that uses AI for product recommendations or an office that uses ChatGPT to draft texts is usually a deployer.

A provider is the person or company that develops or places the AI system on the market under its own name. A small business can become a provider if it builds its own chatbot and sells it to others, or if it incorporates AI into a product or service that it offers as its own solution.

Many businesses do not build AI from scratch, but heavily configure a ready-made system: they upload a knowledge base, give instructions and put it in front of customers. Even then, the business has responsibility for the use, the data and the promises made to the user.

ChatGPT for everyday work: what to watch

Using ChatGPT or a similar tool for ideas, draft texts, translations, summaries or internal organization is usually low-risk, provided that sensitive or confidential data is not entered and that there is human review. The problem is not that you wrote an email with AI. The problem is copying customer data, contracts or business secrets without knowing where they go and how they are stored.

A practical policy for a small business can be short, but it must be clear. It should say which tools are allowed, for which uses, what may not be entered, who approves use in customer communication and when review by a responsible person or legal adviser is required.

ChatGPT useUsual riskRule for a small business
Ideas for social media or a blogLow, if no personal data is enteredAllowed with accuracy and style review
Summary of a public textLow to moderateCheck fidelity and keep the source
Translation of a customer contractModerate to highNot without permission, anonymization and confidentiality review
Reply to a customer about rights/obligationsModerate to highUse only as a draft, never as automatic final advice
Assessment of job candidatesHighDo not do it without specific legal/HR review
Automatic decision on credit, discount or customer rejectionHighRequire specific assessment and human oversight

The basic principle is simple: the closer AI is to a decision that affects a person, the more careful the business must be. The more assistive and internal the use is, the more simply it can be organized, without ignoring confidentiality.

Chatbot on a website or e-shop

For systems interacting directly with people, Article 50(1) requires the provider to ensure that people are informed they are interacting with AI, unless that is obvious to a reasonably well-informed, circumspect and observant person in the relevant context. A business installing a chatbot should check this notice with its provider. The provision has applied since 2 August 2026. The Commission published final guidelines on 20 July 2026; they provide interpretative guidance and do not replace the regulation.

For a small business, the safest solution is to inform the user clearly from the start: “You are talking to an automated assistant. For contract, payment, complaint or legal claim matters, a human will respond.” Excessive wording is not needed. What is needed is not to create the impression that a human checks every answer when that is not the case.

The second point is personal data. A chatbot in an e-shop may collect a name, email, order number, address or description of a problem. That brings in the GDPR. The privacy policy must explain what data is collected, for what purpose, who the provider is, whether there is any transfer outside the EU and how long conversations are kept.

The third point is the limit of the answers. A chatbot can provide opening hours, return policy, order status or basic instructions. It should not promise things that bind the business if it has no such authorization. For example, the phrase “you are definitely entitled to compensation” is risky. A better answer is: “I will forward your request to the competent department for review.”

AI literacy: the obligation many ignore

Current Article 4 requires providers and deployers to take measures supporting the development of AI literacy among staff and other people operating or using AI systems on their behalf. It expressly states that they need not guarantee a specific level of literacy for any individual. The duty to provide support remains.

Measures must take account of technical knowledge, experience, education and training, the context in which the systems are used, and the people or groups affected. For a small business, useful training topics include the tool's limits, data protection, accuracy checks and referring uncertain results to a responsible person. The current wording comes from Article 1, point 5, of Regulation (EU) 2026/1744.

Focused internal training, short usage instructions and a record of measures taken can help organise this work. A two-hour seminar does not automatically demonstrate compliance. Training content and follow-up should reflect the tools, their uses and the team's needs.

The mistakes a small business should avoid

The first mistake is using an employee’s personal account for company work. If the employee leaves or customer data has been entered, the business loses control. Corporate use needs company accounts, access permissions and basic rules.

The second mistake is uncritical data copying. Many people upload invoices, customer lists, CVs, emails or contracts to AI because they “want a summary”. If the provider, the contract, the privacy policy and the storage settings have not been checked, this can create GDPR, trade secret and confidentiality problems.

The third mistake is publishing AI text without review. AI can make mistakes, invent sources, confuse laws or write in a misleading way. In articles, advertisements, legal information, prices, terms of sale and customer replies, human review is not decorative. It is necessary.

The fourth mistake is using AI in HR without serious review. Automatic CV scoring or candidate ranking can touch high-risk areas. It is not the same as a simple draft job advertisement.

The fifth mistake is confusing the AI Act with the GDPR. One does not replace the other. An AI use may be low-risk under the AI Act but problematic under the GDPR if you feed personal data without a legal basis or notice. A DPIA may also be needed where processing with new technologies is likely to create a high risk to rights and freedoms.

A practical 10-step framework

You do not need a heavy compliance department. You need a minimum framework that can withstand a review, complaint or mistake.

StepWhat I doEvidence I keep
1Write down which AI tools are usedTool list, provider, use
2Separate uses into internal, customer-facing and decision-makingShort risk register
3Prohibit specific data in public AI toolsInternal usage policy
4Train staff who use AIDate, material, participants
5Check provider terms and privacy settingsTerms link/file, notes
6Update the privacy policy where there is a chatbot or AI processingUpdated privacy policy
7Add a clear notice that the user is talking to a chatbotNotice text on the website
8Define when a human intervenesEscalation procedure
9Avoid AI in HR/credit/sensitive decisions without specific reviewManagement decision or legal opinion
10Periodically check whether the use or provider has changedReview date

The most important thing is consistency. If the policy says “we do not upload personal data”, but employees do it every day, it is not worth much. If the chatbot promises returns or compensation without a human, the practice cancels the rule.

Examples by type of business

BusinessUseful AI useRed line
E-shopProduct descriptions, FAQ, ticket classificationFull customer data in an unchecked tool, binding answers about returns without a human
Accounting officeDraft updates, summaries of public circularsTax returns, payrolls, tax numbers or customer details in a public AI tool
Consulting or law officeOutline, language improvement, structure ideasCourt documents, sensitive details or final legal conclusion without human review
Customer supportChatbot for opening hours, orders and trackingComplaints, compensation, reports or legal claims without escalation to a human
HR/recruitmentDraft job advertisementAutomatic scoring, rejection or ranking of candidates without specific review

The logic is common: the closer AI is to confidential data or a decision that affects a person, the stricter the framework must be.

What to put in the business AI usage policy

A small AI usage policy does not need to be 30 pages. It can be 2-4 pages, as long as it answers the basics clearly.

First, which tools are allowed. Second, which uses are allowed: draft texts, ideas, translations of public material, internal organization. Third, which uses are prohibited without approval: customer personal data, financial details, CVs, medical data, contracts, confidential documents, automated decisions.

Fourth, who checks the output. Every AI text that is published, sent to a customer or affects a right must pass through a human. Fifth, what happens if there is an incident, such as mistakenly entering a customer list into an AI tool. The policy should require immediate internal reporting, not concealment.

When a lawyer or DPO is needed

Not every simple AI use needs to go through a lawyer. Specific review is needed, however, when AI processes personal data at scale, when it makes or influences decisions about people, when it is used in recruitment, or when it concerns children, health, financial assessment or access to essential services.

The DPO, if there is one, should be involved early in uses that touch personal data. If there is no DPO, there should at least be a person responsible within the business who can work with a technical adviser, legal adviser or IT provider. Artificial intelligence is not only a legal issue, but also an organizational one.

Short checklist before buying an AI tool or chatbot

Before paying for an AI tool, ask for answers to the basics:

  1. Where is the data hosted?
  2. Is our data used to train the model?
  3. Is there an option to disable training/use of prompts?
  4. Is a data processing agreement signed where needed?
  5. Can I delete conversation histories?
  6. Are there logs and access rights per user?
  7. Can I add human approval before critical answers?
  8. How is the end user informed that they are talking to AI?
  9. What support does the provider give for AI Act/GDPR compliance?
  10. What happens if the tool makes a mistake or leaks information?

If the provider cannot answer the basics, the low price is not enough of an argument. The most dangerous tool is the one that goes into production without anyone knowing what it does.

FAQ

Can I use ChatGPT in my business?

Yes, but with rules. For ideas, drafts and assistive use, there is usually no problem if you do not enter personal or confidential data and if you check the output.

Must I tell the customer that I used AI?

If the customer interacts with an AI system, such as a chatbot, they must be clearly informed when this is not obvious. For public-interest content and synthetic content, particular attention is needed to transparency obligations.

If I use a ready-made chatbot from a third-party company, is only the provider responsible?

No. The provider has its own obligations, but the business is responsible for how it installs it, what data it collects, what it says to the customer, what limits it sets and whether it complies with GDPR and consumer rules.

Do I need to do a DPIA?

Not always. Assessment is needed when processing, especially with new technologies, is likely to create a high risk to rights and freedoms. A chatbot with simple FAQ may not need a DPIA, while AI for HR, customer profiling or sensitive data may need one.

Can I put customer details into ChatGPT?

Only if there is a clear legal basis, notice, a suitable provider, contractual safeguards and technical measures. In practice, for small businesses the safest rule is not to enter personal data into public AI tools without specific approval and anonymization.

Is it illegal to use AI for recruitment?

It is not generally illegal, but it is a high-risk area. Automated classification, scoring or rejection of candidates can create serious obligations and discrimination risks. It should not be done without specific legal and technical review.

Conclusion

The AI Act did not arrive to cut the productivity of small businesses. It came to set limits where artificial intelligence affects people, data and rights. Write down which tools you use. Train your people. Do not upload personal data without review. Inform users clearly when the customer talks to a chatbot. And do not let AI make decisions about people without specific assessment.

Artificial intelligence can help a small business work faster. But customer trust is not automated. It is built with transparency, control and responsibility.

Sources and research notes

Updated on 9 September 2026 with artificial intelligence assistance and official-source checks for the revised passages. This article provides general legal information.