Last week, a headline went by: "Europe's New AI Rules Come Into Force." You did the sensible thing and kept scrolling. Regulatory headlines are where attention goes to die. Fair enough. Except buried in that story is one paragraph that is actually about you, and it became law eight days ago whether you read it or not.
So let's do what nobody in Brussels bothered to: explain what actually changed on August 2nd, whether it touches your business, and what to do about it. The reading will take longer than the fix.
What actually changed on August 2nd
The EU's AI Act has been arriving in pieces since 2024. The piece that landed this month is Article 50: the transparency rules. In plain terms: if an AI system talks directly to one of your customers (a chatbot on your website, a WhatsApp assistant confirming bookings, a voice line that picks up when nobody's at the desk), it now has to make clear it's AI, unless that's already obvious. Some AI-generated content needs a label too.
That's it. That's the whole thing that changed this month.
Here's the part that gets lost in the panic headlines: the genuinely heavy rules in this law (the ones covering things like automated hiring screens, credit scoring, biometric surveillance) don't arrive until 2027. If your business isn't doing anything like that (and almost none of ours are), August 2nd doesn't touch you there. So both the "the robots are coming for my bakery" crowd and the "this is for Big Tech, not me" crowd got it a little wrong. It's smaller than the first group fears, and closer than the second group assumes.
It's your duty, not your software's
Here's the detail that actually matters for a small business: this obligation belongs to whoever runs the AI for a customer, not whoever built it. Lawyers call this the difference between a "provider" and a "deployer." If a small clinic uses a WhatsApp assistant to confirm appointments, the company that built that assistant has its own compliance to worry about, but the clinic, because it's the one putting the tool in front of patients, carries the disclosure duty itself. You can't hand that off to the vendor, however good their terms of service sound.
A useful test: if the tool is quietly checking your spelling in the back office, this rule almost certainly doesn't reach it. If it's making a decision or taking an action toward a customer on your behalf, such as confirming a booking, answering a question, or replying to a review, it probably does.
Someone is actually checking
This isn't a rule that exists only on paper. In Spain, the body that enforces it is AESIA, the AI supervision authority based in A Coruña. It can inspect, ask for documentation, and fine. There's no blanket exemption for being small, but there is proportionality: simplified paperwork for SMEs, and penalties scaled to what a small business can actually pay, not calculated as if you were a multinational.
What to actually do, today
1. List every AI tool that talks to a customer directly: chatbot, WhatsApp assistant, phone line, automated booking confirmations.
2. For each one, ask honestly: would a customer clearly know they're talking to a machine? If not, add one line at the very first message: "You're chatting with an AI assistant. Ask any time for a person." Done.
3. Write one page, not a policy binder, listing which tools you use, for what, and who checks them occasionally. At this size, that page is your compliance file.
Most of our clients could do all three before lunch.
What this doesn't cover
This is the smallest, least invasive layer of the law: plain transparency, nothing more. It isn't legal advice, and if you're using AI for something that decides something about a person rather than just talking to them (hiring, credit, insurance), that's a different and more serious conversation, worth an actual lawyer's time before 2027 gets closer. This piece also skips deepfake labelling for images and video, and rules for AI-generated content on matters of public interest (narrower cases, but worth knowing they exist).
Do this one thing today
Open your website and your WhatsApp Business account. Read the first message a customer would get from anything automated. If it doesn't already say, plainly, that they might be talking to an AI, that's the one line to add. It'll take you five minutes, and then you'll actually be compliant with the only part of this law that reaches you right now.
Clara F.