Does the EU AI Act apply to my US-based small business?

Generally not directly, unless you are a provider of AI systems or you are deploying high-risk AI systems affecting EU residents. If you are using standard AI tools for ordinary business tasks, the EU AI Act's requirements are aimed at the tool providers, not at you as a user. That said, the tools you use may have updated their terms and features in response to it.

Do I need to tell customers when AI is involved in my communications?

It depends on your state, your industry, and how AI is involved. Some states are beginning to require disclosure for certain automated communications. Beyond legal requirements, disclosing AI involvement is good practice, especially for anything that affects a customer's decision or relationship with your business. When in doubt, disclose.

Is there a federal AI law in the United States?

As of 2026, there is no comprehensive federal AI law in the US. The regulatory picture is made up of executive orders, sector-specific guidance from agencies like the FTC, and state laws. This is expected to change, but the timeline is uncertain. The most relevant current obligations for most small businesses are existing data privacy and consumer protection laws applied to AI use.

What is the biggest AI compliance mistake small businesses make?

The most common mistake is not having a written policy before employees start using AI tools on their own. Without a policy, every employee makes their own judgment about what is okay to put into AI tools, what tools to use, and how to handle the output. That inconsistency creates real legal and reputational risk that a simple internal policy largely eliminates.

Do I need a lawyer to comply with AI regulations?

For most small businesses using AI tools in standard business contexts, you do not need a lawyer for day-to-day AI compliance. You do need legal advice if you are in a regulated industry, if you are making automated decisions about people, if you are handling significant amounts of personal data from EU residents, or if you are considering using AI in a customer-facing way that could raise disclosure questions.

← AI Answers

What do small businesses need to know about AI regulations and compliance?

Short answer

AI compliance for a small business mostly comes down to three things: how you handle the data you put into AI tools, what policies your team follows when using AI at work, and how you stay honest with customers about when AI is involved. Specific regulations are still developing, but the practices that protect you now are straightforward.

Updated September 3, 2026

AI regulation is a topic that generates more anxiety than it probably warrants for most small businesses right now, but it is not something to ignore. The regulatory landscape is moving, and the businesses that build good habits now will have far less to adjust later.

Here is a plain-English look at what is actually in play, what applies to you as a small business using AI tools, and what practical steps actually reduce your risk today.

The EU AI Act: what it does and does not cover

The EU AI Act is the most significant AI regulation passed so far. It creates a risk-based framework that classifies AI systems from minimal risk to unacceptable. High-risk AI systems, those used in hiring, credit scoring, healthcare, law enforcement, and similar sensitive contexts, face the most stringent requirements including technical documentation, human oversight, and registration in a central database.

For a US-based small business using AI tools for marketing, drafting, customer communication, or scheduling, the EU AI Act's direct requirements are generally not your concern. The Act applies primarily to providers and deployers of high-risk AI systems, and general-purpose AI tools used for ordinary business tasks fall outside those categories.

The indirect effect is more relevant: if you are selling to EU customers or using AI in ways that affect EU residents, the businesses you work with or the tools you use may have compliance obligations that change what features are available or how data is handled.

US AI regulation in 2026

As of 2026, there is no comprehensive federal AI law in the United States. Regulation is happening through a patchwork of executive orders, sector-specific guidance, and state laws. California, Colorado, and several other states have passed or are considering AI-specific laws that affect how businesses use AI in consumer-facing contexts.

The areas most relevant to small businesses are:

Automated decision-making: if you use AI to make decisions about people (hiring, credit, service eligibility), you may have disclosure and review obligations in some states.
AI-generated content disclosure: some states require disclosure when AI is used to generate certain types of content, particularly in political advertising and in consumer-facing communications that could mislead.
Data privacy: existing data privacy laws (like California's CCPA) apply to data you collect and process, including data you put into AI tools. This is the most immediate compliance consideration for most businesses.

Data privacy and AI tools

When you put customer data, employee data, or any personal information into an AI tool, you are processing that data. Existing privacy laws, depending on your state and industry, may require that you handle that data in specific ways, have a data processing agreement with the tool provider, and be able to respond to requests about how that data is used.

For most small businesses, the practical implication is: check what your AI tools do with the data you give them, make sure the tool's terms are consistent with your obligations, and do not put sensitive data into tools that are not designed for business-grade data protection.

Our answer on whether ChatGPT is safe for client data covers the specific data handling settings and business plan options in practical terms.

What a basic AI use policy for your business should include

A written AI use policy is the most directly protective thing most small businesses are not yet doing. It does not need to be a formal legal document. It needs to answer three questions clearly enough that an employee knows what to do:

Which AI tools are approved for use at work, and for what types of tasks?
What categories of information should never be entered into any AI tool (client financial data, health information, employee records, NDAs)?
How should employees handle uncertainty: who to ask, and what the default is when a situation is not covered?

Once documented and communicated, this reduces your legal exposure, your data risk, and the likelihood that a well-intentioned employee makes a costly mistake.

Transparency with customers

Beyond legal requirements, transparency about AI involvement in customer communications is increasingly an expectation. If you are using AI to respond to customer inquiries, generate personalized messages, or make decisions that affect customers, telling them is good practice and in some cases legally required.

The specifics depend on context. A business using AI to draft emails that a person then reviews and sends is in a different position from one sending fully automated AI messages without any human review. The clearer you are with customers, the less risk you carry as standards develop.

For guidance on how to train your team to use AI responsibly, our answer on how to train your team to use AI covers how to build both the skills and the habits that good AI governance depends on.

Regulated industries and higher-stakes uses

If your business operates in a regulated industry, the standard small business AI picture changes. Healthcare businesses are subject to HIPAA when AI handles patient data. Financial businesses face SEC, FINRA, or state financial regulations. Legal professionals have bar rules about client confidentiality that apply to any tool they use with client information.

For businesses in these categories, the starting point is consulting with a lawyer or compliance specialist who understands both your industry's regulations and how AI tools interact with them. General guidance about AI compliance does not substitute for sector-specific advice.

Our AI consulting service covers how we work with businesses to introduce AI tools in a way that fits their existing operations, including businesses with specific compliance considerations.

Watching the regulatory landscape

AI regulation is changing faster than most other areas of business law. What is current guidance today may be a binding rule in eighteen months. The businesses that will handle this most easily are those building good habits now: clear policies, responsible data handling, and honest communication about AI use.

For the safety question more broadly, including cybersecurity and general AI risk considerations, our answer on whether it is safe to use AI in your business covers the full picture of AI safety considerations for a small business.

Back to all resources