What the EU AI Act means for your business: a plain-English guide
If you run a small business in Mallorca, or anywhere else in the EU, and you're using or considering AI tools, the EU AI Act applies to you. Most of what's written about it online is aimed at lawyers and compliance officers. Here's the version written for the business owner who just wants to know what it actually means for the AI they're using or about to use.
The one-sentence version
The EU AI Act sorts AI systems into risk categories, and for the vast majority of what a small business uses (chatbots, follow-up automation, receptionist agents), the requirements are light. The law gets strict for a small number of specific high-risk uses that most small businesses never touch.
Why this law exists
The EU AI Act is the world's first comprehensive AI regulation, passed to make sure AI systems used across Europe are safe, transparent, and don't discriminate unfairly. It doesn't ban AI. It sorts AI systems by how much harm they could realistically cause and applies proportionate rules to each tier.
This matters for a Mallorca business owner for a simple reason: the risk tiers determine how much paperwork and process you need, and for almost everything a small service business does with AI, that's very little.
The four risk tiers, in plain terms
| Tier | What it covers | What's required |
|---|---|---|
| Unacceptable risk | Social scoring, manipulative AI, real-time biometric surveillance in public spaces | Banned outright. No small business uses these. |
| High risk | Automated hiring decisions, credit scoring, biometric identification, systems affecting access to essential services | Strict requirements: risk assessments, human oversight, documentation, audit trails. Most small businesses don't build these. |
| Limited risk | Chatbots, AI-generated content, most customer-facing automation | Transparency: users should be able to tell they're interacting with AI. This is where most small business AI use sits. |
| Minimal risk | Spam filters, AI-enabled video games, most internal automation | No specific obligations under the Act. |
Where your AI systems probably sit
If your business uses AI for any of the following, you're in the limited-risk or minimal-risk tiers, where the requirements are light:
- Automated first response to website or WhatsApp enquiries
- Follow-up sequences across email, SMS, or WhatsApp
- A chatbot answering common questions on your website
- Internal workflow automation (moving data between tools, generating reports)
- AI-assisted content drafting reviewed by a human before publishing
You'd only move into the high-risk tier if you were using AI to make automated hiring decisions, assess creditworthiness, or process biometric data (facial recognition, fingerprints) without a human in the loop. Almost no small service business does any of this.
What "limited risk" actually requires
For the tier most small businesses sit in, the EU AI Act's main requirement is transparency. In practice, this means:
- If a customer is talking to an AI chatbot, they should be able to tell (a small disclosure, not a legal disclaimer wall)
- AI-generated content that could be mistaken for a real recording or document should be labelled
- You should be able to explain, in general terms, what your AI systems do
There's no requirement for a formal risk assessment, a compliance officer, or a lengthy audit process at this tier. It's closer to "be honest about what the AI is doing" than "fill out a regulatory filing."
How this interacts with GDPR
The EU AI Act and GDPR are separate laws that both apply if you're processing customer data through an AI system. GDPR governs where the data lives and how it's used; the AI Act governs the AI system's risk category and transparency requirements. A well-built system satisfies both: European data hosting (GDPR) plus honest disclosure that AI is involved (AI Act).
What we do, practically
For every system we build, our approach is straightforward. We identify which risk tier the system falls into before we build it. We don't build anything in the high-risk or prohibited categories, and we'd tell a client directly if what they asked for fell into either. Every customer-facing AI interaction includes a way for the customer to tell they're talking to an automated system. And every system logs what it does, so an audit trail exists if one is ever needed.
The EU AI Act isn't a reason to avoid AI. It's a reason to build AI thoughtfully, which is what a business should be doing regardless of the law.
What to actually do about this
If you're a small business owner in Mallorca using or considering AI tools: check which risk tier your use case sits in (almost certainly limited or minimal risk), make sure customers can tell when they're talking to AI, and keep basic records of what your systems do. That's the practical floor for most small businesses. Beyond that, the requirements scale with actual risk, not with how advanced the technology sounds.
This isn't legal advice. For a formal compliance opinion, talk to a lawyer. But for the practical starting point most small-business owners need, this is it.