The EU AI Act for US Small Businesses: What Applies Now, What the Digital Omnibus Delayed, and What to Do

Consider a twelve-person e-commerce company in Austin that sells handmade leather goods. About a fifth of its orders ship to Germany, France, and the Netherlands. Its website runs a support chatbot built on a large language model through a vendor's API, under the company's own brand. The marketing team uses an image generator for product lifestyle shots, and the owner uses an AI tool to screen job applicants for a remote customer-service role open to EU residents.

Is this company subject to the EU AI Act? In part, yes. And the parts that apply are not the ones most US coverage focuses on.

The headlines have been about delay. In July 2026 the EU adopted the Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on July 24 and in force since July 27, 2026. It pushed back the heaviest “high-risk” obligations. It did not delay the transparency rules that a small company with a chatbot is most likely to trip over, and some of those already apply.

Three questions decide whether the Act reaches you

The AI Act (Regulation (EU) 2024/1689) is extraterritorial, but not without limit. Article 2 covers three groups that matter here:

• Providers that place an AI system on the market or put it into service in the EU, “irrespective of whether those providers are established or located within the Union or in a third country.”
• Deployers that are established or located in the EU.
• Providers and deployers located outside the EU “where the output produced by the AI system is used in the Union.”

So the three questions are:

1. Are you a provider or a deployer? Under Article 3, a provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free. A deployer is anyone using an AI system under its authority in a professional capacity. Buying a subscription to an AI writing tool and using it at work makes you a deployer. Wiring a vendor's model into a customer-facing chatbot that you put into service under your own name can make you the provider of that chatbot system, even though you didn't build the underlying model. The definition turns on whose name the system goes out under, so a branded integration is the case to think hardest about.

2. Does the system or its output reach the EU? Offering a chatbot to EU visitors, or sending AI-generated content to EU customers, puts you inside Article 2's reach. A US company using AI purely for internal US operations, with no output used in the EU, generally is not.

3. What kind of AI use is it? The Act's obligations depend on the category: prohibited practices, high-risk systems, systems with transparency duties, and general-purpose AI models. Most small-business uses fall into the transparency category or into none.

What is already in force

Since February 2, 2025: prohibitions and AI literacy

The banned practices in Article 5 (manipulative techniques, social scoring, certain biometric uses, emotion recognition in workplaces and schools, and others) have applied since February 2, 2025. A normal small business is unlikely to be doing any of them. The one to watch is emotion recognition in the workplace, which some HR and call-center analytics products claim to offer.

The AI literacy duty in Article 4 applied from the same date, and the Omnibus rewrote it. As amended, providers and deployers must “take measures to support the development of AI literacy of their staff,” and the amended text says this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” That is softer than the original “ensure a sufficient level” wording. It is still a duty, and a short written training and acceptable-use policy for staff who use AI tools is the simplest way to show you took it seriously.

Since August 2, 2025: general-purpose AI models

Obligations for providers of general-purpose AI models, along with most of the Act's penalty provisions, have applied since August 2, 2025. These bind the companies that build foundation models, not businesses that use them. What you should do is read your AI vendor's terms and documentation and confirm they say they comply. Our AI vendor contract checklist covers what to ask for.

Since August 2, 2026: transparency under Article 50

This is the part that reaches ordinary businesses. Article 50 applies from August 2, 2026:

• Chatbots (Art. 50(1), provider duty): AI systems intended to interact directly with people must be designed so users are told they're dealing with AI, unless that is obvious to a reasonably well-informed person. Under Art. 50(5), the information must come at the latest at the first interaction.
• Marking synthetic content (Art. 50(2), provider duty): Providers of systems that generate synthetic audio, image, video, or text must mark outputs in a machine-readable format so they can be detected as AI-generated, with exceptions for systems that only assist standard editing or don't substantially alter the input.
• Deepfakes and public-interest text (Art. 50(4), deployer duty): Deployers that publish deepfake image, audio, or video content must disclose that it is artificially generated or manipulated. Clearly artistic, satirical, or fictional works get a lighter disclosure duty. AI-generated text published to inform the public on matters of public interest must be disclosed unless it has gone through human review and someone holds editorial responsibility.

The Commission published guidelines on the Article 50 transparency obligations on July 20, 2026. Article 50(5) itself requires the information to be given “in a clear and distinguishable manner” no later than the first interaction or exposure, so a disclosure buried in terms and conditions is a poor bet. Having the bot answer honestly when a user asks whether it is an AI is a sensible practice on top of that.

What the Digital Omnibus changed

The Omnibus amended the AI Act's application dates in Article 113 and made several substantive changes:

• High-risk systems under Annex III (the stand-alone list, including AI used in employment decisions, credit scoring, education, and access to essential services): obligations now apply from December 2, 2027, instead of August 2, 2026.
• High-risk systems under Annex I (AI that is a safety component of products already regulated by EU product-safety law): obligations now apply from August 2, 2028.
• Content marking grace period: Providers of generative systems placed on the market before August 2, 2026 have until December 2, 2026 to comply with Article 50(2). Systems placed on the market after August 2, 2026 had to comply from that date. The chatbot disclosure in Article 50(1) and the deepfake disclosure in Article 50(4) were not deferred.
• Two new prohibitions from December 2, 2026: AI systems that generate or manipulate realistic intimate images, video, or audio of an identifiable person without consent, and AI systems that generate child sexual abuse material.
• AI literacy: Article 4 was rewritten as described above.
• SMEs and small mid-caps: The Omnibus adds a defined category of “small mid-cap enterprises” and extends to them some of the simplifications SMEs already had, such as streamlined documentation. SMEs already get fines capped at the lower of the fixed amount or the percentage of turnover. Small mid-caps now get the same lower-of cap for most fines, though not for fines for prohibited practices.

The deferral affects only the high-risk chapter. Nothing in the Omnibus pushed back Article 50(1) or 50(4).

Back to the Austin company

Here is how the Act maps onto the leather-goods seller:

• The support chatbot. If the company integrated the model into its own branded chatbot, it is likely the provider of that system for Article 50(1) purposes. The bot needs a clear “you're chatting with an AI assistant” disclosure at the start of the conversation, and it should answer honestly when asked. That has applied since August 2, 2026. Many US states have their own versions of this rule, collected in our chatbot disclosure law guide.
• AI product images. The company is a deployer of the image generator. The marking duty in Article 50(2) falls on the image tool's provider. The company's own exposure is under Article 50(4), and only if an image is a deepfake, meaning content that resembles real people, objects, places, or events and would falsely appear authentic. Styled lifestyle shots of a bag usually aren't. A fabricated “customer” photo of a real-looking person would be riskier.
• The hiring screener. AI used to evaluate job candidates is listed in Annex III. Because the company is outside the EU, the question is whether the tool's output is “used in the Union.” Screening EU-resident applicants for a role they would perform from the EU is a fair candidate for that. The deployer duties for high-risk systems don't apply until December 2, 2027, which leaves time to press the vendor on documentation and human oversight.
• AI literacy. Staff who use these tools should get basic training now.

A practical checklist for a US small business with EU customers

1. Inventory your AI uses. List every tool, who uses it, and whether its output reaches EU users or customers.
2. Label each one provider or deployer. If you put a model behind your own brand, assume you may be the provider of that system.
3. Fix chatbot disclosures now. First-interaction disclosure, and an honest answer to “am I talking to a bot?”
4. Confirm content marking with vendors. Ask your generative AI vendors how they mark outputs under Article 50(2) and whether legacy products will be compliant by December 2, 2026.
5. Write a short AI literacy and acceptable-use policy. Train the staff who actually use the tools.
6. Flag anything that touches hiring, credit, education, or access to services. Those uses may be Annex III high-risk. Use the time before December 2, 2027 to get vendor documentation.
7. Remember the GDPR. Personal data processed through AI tools is still governed by the GDPR, and our overview of privacy laws covers the US side.

Frequently Asked Questions

For ongoing tracking

The Commission is still issuing guidance and codes of practice under the AI Act, and the Omnibus dates may generate further guidance before December 2026. We track developments at silvertonpublishing.com/ai-current.

This article reflects the EU AI Act, as amended by Regulation (EU) 2026/1744, as of October 2026. EU implementation guidance is still arriving, and national enforcement practice has barely begun. Confirm the current consolidated text and Commission guidance before relying on it. Nothing in this article is legal advice for your specific situation.

This article is for educational purposes only and does not constitute legal, tax, or financial advice. Consult a qualified professional for guidance specific to your situation.