If the words “AI Act” make you want to close the tab, I understand. For the past two years the regulation felt like something written for banks and big tech, not for a ten-person company using ChatGPT to write product descriptions. Recently something actually changed, and for once it looks like good news for PMI.
The EU approved a package of changes, informally called the “Digital Omnibus”, that simplifies parts of the AI Act. It landed around the same time some of the AI Act’s core obligations started applying across Europe, which is probably why so many small business owners are hearing about this regulation for the first time right now.
What the Digital Omnibus actually changes
A few things get easier if you run a PMI, or even a “small mid-cap” (a new category the regulation introduces for companies a bit bigger than a PMI but still far from a corporation). Technical documentation can now be filled in a simplified form, instead of the same heavy paperwork designed for large companies. Quality management requirements are meant to be proportionate to company size, rather than one checklist for everyone. Access to regulatory sandboxes, the controlled environments where you can test an AI system under supervision, is being made more accessible for smaller companies.
The timelines for the more demanding rules, the ones that apply to what the regulation calls “high risk” AI systems, have also been pushed further into the future, giving companies more room to prepare. If part of your product is a physical device, like machinery, you get an even longer runway.
What did not change: transparency
This is the part I see PMI owners overlook most often. The simplification did not touch the transparency obligations. If you use a chatbot on your website, people need to be able to tell they are talking to a machine, unless it is already obvious. If you generate images, audio, video or text with AI, that content is generally expected to carry some indication that it is artificial. If you publish AI generated content, especially a deepfake or a text on a topic of public interest, you are expected to disclose it, with some exceptions for art and for content that went through human editorial review.
These are not symbolic rules. The regulation allows for real financial penalties, calculated as a share of a company’s turnover. A small business is unlikely to be the first target of an enforcement action, but that is not a reason to assume the rule does not apply.
What this means if you run a small business
You do not need a legal department to deal with this, but it is worth ten minutes and a shared document. Write down which AI tools you actually use: the chatbot on your website, the tool that writes your product descriptions, the one that generates your social media images. For each one, ask two simple questions. Does it talk to customers or generate content, and if so, is that clearly labeled as AI. Is it anywhere close to what the AI Act calls “high risk”, which mostly means systems used in areas like hiring, credit scoring, education or safety, not a marketing assistant.
For most PMI, transparency will be the part that actually applies today, and it is usually a small fix: a line in your chatbot’s welcome message, a note under an AI generated image, a disclosure when you publish AI assisted content on a sensitive topic. If you want to go deeper, especially on exact deadlines, thresholds and the documentation templates, the official EU sources are the place to check, since those details keep being refined.
The AI Act is not getting weaker. It is getting more realistic about who has to do what. For once, that realism seems to be on the side of the small business.
Leave a Reply