The European regulation on artificial intelligence, known as the "AI Act" (Regulation (EU) 2024/1689), is the world's first major law on AI. It applies in stages, and it concerns not only those who build AI systems, but also the companies that use them.
For a Belgian SME, the question is not "am I an AI giant?", but "which AI tools do we use, for what, and what have we put in place?" This article gives the essential points of reference.
Important: the timetable for some obligations is being adjusted at European level. This article presents the principles; check the up-to-date dates with the official sources before making any decision.
risk levels in the regulation: unacceptable, high, limited, minimal
date the AI literacy obligation (Article 4) began to apply
Provider or user: what is your role?
The regulation distinguishes several roles. Two matter here:
- The provider — The party that develops an AI system or places it on the market under its own name. The heaviest obligations fall on it.
- The deployer (the professional user) — The company that uses an AI system in its business. This is the case for most SMEs: a writing tool, a chatbot on the website, software for sorting job applications, a scoring tool.
An SME can also become a provider if it builds AI into a product it sells under its own name, or if it substantially modifies an existing tool.
The risk levels
- Unacceptable risk (prohibited) — Practices considered contrary to fundamental rights: harmful subliminal manipulation, social scoring of citizens, certain forms of emotion recognition at work or at school, and so on. These prohibitions have applied since February 2025.
- High risk — Systems used in sensitive areas: recruitment and staff management, access to education, access to essential services, creditworthiness assessment, and so on. They are subject to strict requirements for documentation, human oversight and data quality.
- Limited risk (transparency obligations) — For example chatbots, which must disclose that people are talking to a machine, and generated or manipulated content (deepfakes), which must be identified as such.
- Minimal risk — The vast majority of everyday uses (spam filters, spellcheckers, writing aids): no specific obligation beyond the general rules.
The obligation that already applies to every company: AI literacy
Article 4 of the regulation requires providers and deployers of AI systems to take measures to ensure that their staff, and other people using AI systems on their behalf, have a sufficient level of AI literacy, taking into account their knowledge, experience and the context of use. This obligation has applied since 2 February 2025.
In practice, there is no diploma to obtain and no form to fill in: what matters is being able to demonstrate a reasonable and proportionate approach:
- an inventory of the AI tools used in the company;
- training adapted to roles (managers, users, technical teams);
- a usage charter known to everyone;
- a written record of these actions: date, content, participants.
This is precisely the aim of our "recognising AI" training: a foundation of literacy, with materials you can attach to your records.
Transparency: chatbots and generated content
The regulation imposes information obligations when a person interacts with an AI system (for example a customer service chatbot) and when content is generated or manipulated by AI to the point of passing for authentic. For an SME, this mainly means: stating clearly that a virtual assistant is a machine, and not publishing synthetic images, voices or videos of people as if they were real. The precise deadlines for some of these obligations are being adjusted: check the timetable currently in force.
Your five-step action plan
- 1. Take inventory — Which AI tools are used, by whom, for which tasks, with which data?
- 2. Classify — Identify sensitive uses (recruitment, evaluation, decisions about people) that call for extra precautions.
- 3. Set a framework — Write a usage charter and appoint a point person.
- 4. Train — Organise suitable training and keep a record of it.
- 5. Question your suppliers — Ask for guarantees of compliance and transparency; see our eight questions.
This article is general information and does not replace legal advice. For a sensitive use or any doubt about your role, consult a specialist lawyer.
Your questions about the AI Act
Does the AI Act apply to small businesses?
Yes, as soon as they use AI systems in their professional activity. Some obligations, such as AI literacy among staff, apply to all companies, whatever their size.
What does Article 4 of the AI Act say?
It requires companies that provide or use AI systems to take measures to ensure their staff have a sufficient level of AI literacy. It has applied since 2 February 2025.
Is a certification needed to train your teams in AI?
The regulation does not require any particular certification. It requires an approach adapted to the context, which the company must be able to demonstrate: training, charter, inventory.
Does using ChatGPT at work count?
Yes: a company that uses it is a deployer. Everyday use (drafting, summarising) falls under minimal or limited risk, but the literacy obligation and GDPR compliance apply.
Be ready before you're asked.
We train your teams and give you the materials to document your approach.