The risk categorisation that determines your obligations
Prohibited AI (prohibited from 2 February 2025): subliminal manipulation, real-time biometric identification in public spaces, social scoring. Most SMEs are nowhere near this. High-risk AI (Annex III): AI in hiring, credit scoring, education, critical infrastructure — if your AI falls here, you need conformity assessments, technical documentation, human oversight, and EU AI database registration. Limited-risk: transparency obligations only — chatbots must disclose they are AI, AI-generated content must be labelled. From August 2026. Minimal-risk: no mandatory requirements.
SME-specific support
Article 62 provides SMEs with: reduced conformity assessment fees; simplified technical documentation; priority access to regulatory sandboxes in each member state; and dedicated guidance from the European AI Office. For most EU SMEs using AI for marketing or operations (not Annex III use cases): from August 2026, ensure chatbots disclose they are AI and AI-generated images are labelled. That is the realistic compliance burden for low-risk AI use.
