EU AI Act for a Small Shop: A Chatbot Walk-Through

The EU's chatbot and AI-content rules have been live since August 2026, and the deadline that did move does not apply to most small businesses. Here is how it plays out for a realistic small shop.

The Scenario: A Small Online Shop With EU Customers

Imagine a four-person online business selling homewares. It is based outside the EU, ships to customers in France, Germany and Ireland, and uses three AI tools. A chatbot on the website answers order-status and returns questions. A writing assistant drafts product descriptions and newsletters. An image generator produces lifestyle pictures for adverts. Nobody in the team has read the EU AI Act, and a customer in Dublin has just asked whether the chat window is a person.

This is the kind of business the EU edition of AI Compliance for Small Business is written for. The general principle is that if an AI tool's output reaches people in the EU, the Act may apply to you even without an EU office. Whether it does in a particular case depends on your role and facts, so treat the walk-through below as a map, not a verdict.

Step 1: List Every AI Tool Before Reading Any Rules

The shop's owner starts with an inventory, not the legislation. For each tool she writes down what it does, who sees the output, and whether the shop built it or simply uses a supplier's product. This matters because the Act separates providers (who develop or place AI systems on the market) from deployers (who use them in their own work). A shop using an off-the-shelf chatbot is normally a deployer, though customising or rebranding a tool can change that picture.

Chatbot: talks directly to customers, so the AI-interaction transparency rule is the obvious one to check.
Writing assistant: output is published, so the rules on AI-generated text may be relevant in some circumstances.
Image generator: output could count as synthetic content, so the labelling rules deserve a look.

Step 2: Understand What Changed in 2026 and What Did Not

The big change is the Digital Omnibus on AI. As reported by law firms and compliance publishers, it pushed the obligations for stand-alone high-risk systems (the Annex III categories, such as AI used in employment decisions) from 2 August 2026 to 2 December 2027, and for AI built into regulated products to 2 August 2028. Parliament approved it in June 2026, the Council adopted it on 29 June, and it was reported to have entered into force on 27 July 2026.

The transparency duties in Article 50 were not delayed in the same way. They started to apply on 2 August 2026. The only postponement within Article 50 is narrow: providers of generative systems already on the market before that date were reported to have until 2 December 2026 to add machine-readable marking to AI-generated output. That grace period concerns providers, and it does not extend to the other transparency duties.

That is the point many small businesses miss. The delay everyone read about concerns high-risk systems. The rules most likely to touch a shop with a chatbot are the transparency ones, and they are already here.

Step 3: Apply the Chatbot Rule

Article 50 requires that people are told when they are interacting with an AI system, unless that is already obvious to a reasonably well-informed person. The obligation sits mainly with the provider of the system, but a deployer who puts a chatbot on its own website still needs to be sure the customer-facing experience makes this clear, and should check what the supplier has built in.

For our shop, the practical steps are modest:

Rename the chat window so it says plainly that it is an AI assistant.
Change the opening message to state that the customer is talking to an AI, and how to reach a person.
Ask the chatbot supplier in writing how they handle disclosure, and keep the reply.
Test the chat as a customer in the EU would see it, on mobile as well as desktop.

Step 4: Check Generated Images and Text

The Act also addresses deepfakes and AI-generated content. Broadly, deployers who publish synthetic image, audio or video content that resembles real people, objects or events must disclose that it was artificially generated, with softer rules for evidently artistic or fictional work. Separately, AI-generated text published to inform the public on matters of public interest has its own disclosure rule, with an exception where a human has editorial responsibility.

A homewares shop publishing lifestyle images is unlikely to be producing deepfakes in the usual sense. Even so, the owner should ask a simple question: could a customer reasonably believe this picture shows a real room, a real customer or a real event? If so, a clear label is cheap insurance. Product descriptions edited and approved by a person are a lower-risk area, but the position can differ by use, so the shop notes it and moves on.

Step 5: Write It Down

None of this requires a legal department. It does require a record. A one-page register covering each tool, its purpose, who supplies it, what disclosure is in place and when it was last checked puts the shop in a far better position if a customer, regulator or business partner asks questions. The register also catches the quiet problem of new tools being added without anyone reviewing them.

The Act also asks organisations to support AI literacy among staff. The Omnibus was reported to soften this from guaranteeing a particular level of literacy to supporting its development. For a four-person team, a short internal briefing on what each tool does and does not do is a reasonable response.

What the Timeline Looks Like From Here

Already applying: the Article 50 transparency duties that apply to deployers and providers.
2 December 2026: reported end of the grace period for marking output from generative systems already on the market before 2 August 2026.
2 December 2027: reported new date for stand-alone high-risk systems.
2 August 2028: reported new date for AI embedded in regulated products.

These dates are as of October 2026. Implementation guidance and codes of practice may continue to develop, so check the European Commission's AI Act pages and the Official Journal before relying on any date.

Common Questions

Does the EU AI Act apply if my business is not in the EU?
It can, where the output of an AI system is used in the EU. Whether it applies to you depends on your role and your facts, so check the Act's scope provisions or take advice.

Was everything delayed to December 2027?
No. The delay covers the high-risk obligations. The transparency duties in Article 50 were not postponed, apart from the narrow marking grace period.

Is a small chatbot really covered?
If it interacts directly with people and it is not obvious that it is AI, the disclosure rule is relevant. A plain statement at the start of the chat is a low-cost way to address it.

Do I need a lawyer?
Not necessarily for the first pass. An inventory and a disclosure review are things you can do yourself. A lawyer becomes worthwhile if you build your own AI system, use AI in hiring or credit decisions, or are unsure whether you are a provider or deployer.

Where to Go From Here

AI Compliance for Small Business (EU Edition) is aimed at owners who sell to EU customers and want a plain-English route through the Act. Its description focuses on the 2026 Digital Omnibus changes, the shifted high-risk deadline and the chatbot-disclosure rules that small businesses are most likely to meet first.

It is a practical guide rather than a substitute for professional advice, and it is best used alongside the official text and your own tool inventory.

Get AI Compliance for Small Business (EU Edition) →

This article is general information only and is not legal, tax, financial or medical advice. The EU AI Act and its implementation are changing, so check current official guidance and take qualified advice for your situation. The product mentioned is an independent guide and is not affiliated with or endorsed by the European Union or any regulator.