The EU AI Act (Regulation (EU) 2024/1689) has been in force since 1 August 2024 and is becoming applicable in stages. For small and medium-sized businesses, this is hard to keep track of: you hear there is “something about AI regulation” but mostly find texts written for corporations with their own compliance departments. On top of that, the EU already amended the law in summer 2026 with the so-called Digital Omnibus.
This article answers the question a trade business or a restaurant actually has: Do I have to do anything if I use AI for images, videos, texts or a chatbot?
The short answer: probably less than you fear — but not nothing. And as always: this is a practical assessment, not legal advice.
The timeline: what applies from when
| Since / from | What applies | Relevant for small businesses? |
|---|---|---|
| 2 February 2025 | Prohibited AI practices (Art. 5) and AI literacy (Art. 4) | AI literacy: yes |
| 2 August 2025 | Obligations for providers of general-purpose AI models, such as the models behind ChatGPT, Gemini or Claude | hardly — this concerns the model providers |
| 2 August 2026 | Transparency obligations (Art. 50): chatbots, deepfakes, certain AI-generated texts | yes |
| 2 December 2026 | End of a short transition period for the machine-readable marking of AI-generated content | indirectly — this is up to the tool providers |
| 2 December 2027 | Obligations for high-risk systems under Annex III, such as AI in recruitment (originally from August 2026) | only if you use such applications |
The postponement of the high-risk deadlines and the change to AI literacy come from the Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force on 27 July 2026. The transparency obligations, by contrast, have applied as planned since 2 August 2026 — with one exception: providers whose AI systems were already on the market before that date have until 2 December 2026 for the machine-readable marking of generated content (Art. 50(2)). In addition, the European Commission published guidelines on these obligations in July 2026 — not legally binding, but a good point of reference.
The basic principle: it’s about risk, not technology
The AI Act doesn’t regulate “AI” across the board; it classifies applications by their risk. For small businesses, that is the decisive relief.
Prohibited practices include social scoring or manipulative systems that exploit people’s weaknesses. An ordinary business has nothing to do with any of that.
High-risk applications are those in areas such as recruitment, lending, critical infrastructure or medicine. Note: if you use AI in your hiring process to filter applications or assess candidates, you fall into this category — this also affects smaller businesses and is often overlooked. Under the Digital Omnibus, the obligations for this apply from 2 December 2027.
Limited risk essentially means transparency obligations. This covers chatbots and certain AI-generated content — exactly the things that matter in marketing.
Minimal risk is everything else: spell checkers, spam filters, image optimization. No special obligations apart from general AI literacy.
What applies to your marketing
A chatbot on your website
If someone is chatting with an AI system, they must be able to recognize that — unless it is obvious anyway. Formally, this obligation has applied since 2 August 2026 to the provider of the chatbot, meaning whoever develops the system or puts it into service under their own name. If you have a bot built for you and run it under your name, that can be you. In practice, this means the bot says at the start that it is an AI assistant. No made-up name without a disclosure, no simulated employee “Lisa from customer service” who doesn’t exist.
That is one line of text and better practice anyway: users quickly notice they are talking to a machine and feel deceived if this was concealed. Whether a chatbot is worth it for your business at all is covered in this article (in German).
AI-generated images and videos
Here it pays to make a distinction that often gets blurred in public discussion.
The labeling obligation for users — called “deployers” in the regulation — targets deepfakes: AI-generated or manipulated images, videos or audio recordings that resemble real people, objects, places or events and would falsely appear to be authentic. If you generate a video in which a real person says things they never said, you have had to disclose this since 2 August 2026 — clearly and at the latest when someone first encounters the content. For obviously artistic, satirical or fictional works, a notice that doesn’t interfere with the presentation of the work is enough.
An AI ad video with abstract images, stylized characters or a recognizably artificial look is generally not a deepfake. With photorealistic scenes that look real, the line is blurrier — and that is exactly where a notice makes sense. So my clear recommendation: label AI content voluntarily. A discreet “mit KI erstellt” (made with AI) costs nothing, heads off discussions and comes across as confident rather than caught out.
What you are not allowed to do — and this has applied for a long time, regardless of the AI Act: pass off AI images as real reference photos. If you show a generated image of a kitchen you never built as your own project, you risk an Abmahnung (a formal cease-and-desist letter, usually with costs) for misleading advertising under § 5 UWG (German Unfair Competition Act).
AI-written texts
There is no general labeling obligation for ordinary marketing copy, blog posts or product descriptions. Here, the AI Act targets AI-generated texts that are published to inform the public on matters of public interest. And even then, the obligation does not apply if a human has reviewed the text and someone holds editorial responsibility.
Something else matters more in practice: unchecked AI texts contain errors, and you are liable for the content of your website — no matter who or what wrote it. An invented technical value in a product description won’t lead to AI Act proceedings, but it may well lead to a warranty claim or an Abmahnung.
The obligation that really affects everyone
Article 4 has applied since February 2025: AI literacy. Anyone who provides AI systems or uses them professionally must take care of the AI literacy of the people working with them. The Digital Omnibus weakened this obligation in summer 2026: instead of ensuring, to their best extent, a sufficient level of AI literacy, providers and deployers now have to take measures that promote the development of this literacy. They don’t have to guarantee a particular level.
That sounds like a certification requirement, but it isn’t one. For a small business, it means that anyone who uses AI tools should know what the tool can do, where it typically makes mistakes and that its results have to be checked. A short internal briefing and a written note about it are an appropriate way to comply.
Your three-point list
For a typical business that uses AI in its marketing, surprisingly little is left in the end:
First: Make your chatbot recognizable as AI. One line.
Second: Always label deepfakes, label other AI images and videos voluntarily — and never pass off AI material as a real reference.
Third: Everyone who uses AI gets a short briefing. Make a note that it took place.
That is the realistic effort. Everything else mainly concerns the providers of AI systems, not their users — unless you use AI in a high-risk area such as recruitment.
Why this is no reason to avoid AI
The costs have shifted significantly: a professional ad video produced the traditional way can easily cost several thousand euros. An AI ad video from us costs €99 and is ready in 24 hours. For a business that has simply had no budget for video production so far, that is the difference between “not at all” and “regularly.”
The AI Act prohibits none of this. Essentially, it asks you to be honest — and that was the better strategy anyway. Where the lines between AI and real footage sensibly run is something we’ve described in more detail in Real Footage vs. AI (in German).
Note: This article is a practical assessment as of October 2026 and not legal advice. If in doubt, a law firm can clarify whether your specific use case triggers obligations.
