EU AI Act: What Portuguese SMBs Need to Know Before August 2026

The European Union approved the world's first comprehensive set of rules on artificial intelligence in 2024. The goal is straightforward: ensure that AI tools used in Europe are safe, transparent, and respect people's rights.

Contrary to what many believe, these rules don't apply only to large technology companies. If your SMB uses, purchases, or sells any AI tool — from a website chatbot to a program that screens job applications — you may be covered.

The regulation divides AI tools into four categories based on the risk they represent:

• Unacceptable risk: completely banned (e.g., mass surveillance systems)
• High risk: strict obligations (e.g., AI used in hiring or credit decisions)
• Limited risk: transparency only (e.g., chatbots must identify themselves as AI)
• Minimal risk: few or no obligations (e.g., inventory tools, automated invoicing)

The good news: the vast majority of tools that SMBs use today fall into the minimal or limited risk categories.

For most Portuguese SMBs, the answer is reassuring. The most common AI tools — writing assistants, automated invoicing tools, customer support chatbots — fall into the minimal or limited risk categories.

This means, in practice, your obligations are straightforward:

• ✅ Minimal risk (most SMBs): No special action needed. Continue using tools normally. Tools like ChatGPT for email drafts, Copilot in Word, or automated invoicing tools fall here.

• ✅ Limited risk (e.g., website chatbot): You must inform customers they're talking to an AI assistant. A simple message at the start of the conversation is sufficient.

• ❌ High risk (less common for SMBs): If you use AI to make decisions about hiring staff, granting credit, or performance evaluations, stricter obligations apply — documentation, human oversight, and decision records.

The vast majority of SMBs using productivity and customer support tools won't need to worry about major changes.

The key date is August 2, 2026. From that point, obligations for high-risk AI tools and transparency rules for limited-risk tools come into force.

What this means in practice for SMBs:

1. If you use a chatbot on your website or WhatsApp You must ensure the assistant clearly identifies itself as AI. A simple message like "Hello, I'm the virtual assistant of [Company]" already meets this requirement.

2. If you use AI in human resources Tools that screen applications or evaluate performance will require documentation obligations and ensuring human oversight in final decisions. In practice: a human must always review and approve the final decision.

3. If you use general productivity tools ChatGPT, Copilot, Gemini, Grammarly, and similar tools likely require nothing from you — these providers already comply with requirements on your behalf.

Fines for non-compliance can reach 7% of global annual turnover, but European authorities have indicated that initial enforcement will focus on large companies and serious cases — not SMBs making an honest effort to comply.

You don't need to hire a lawyer or create a compliance department. For most SMBs, three simple steps are sufficient:

Step 1: Inventory the AI tools you use List all the AI tools your business uses. Include writing assistants, invoicing tools, chatbots, data analysis programs, and any software that makes automatic decisions. Identify what each one is used for.

Step 2: Check if any tool affects decisions about people Tools that influence hiring, credit, or health decisions are the most critical. If you use any of these, speak with a specialist to understand what you need to do. The rest likely require no action.

Step 3: Add an AI notice to chatbots and virtual assistants If you have a chatbot on your website or WhatsApp, make sure customers know they are interacting with AI. A simple sentence at the start of the conversation is enough.

The European Commission will make simplified forms and SMB-specific support materials available. Regulatory sandboxes — where businesses can test AI tools without risk of fines — will be free and priority access for SMBs.

The EU AI Act may seem intimidating, but for most Portuguese SMBs the reality is reassuring: the AI tools you already use probably won't require major changes.

Think of this like GDPR in 2018: at the time, it seemed like a huge bureaucratic burden, but most SMBs resolved it with simple adjustments — an updated privacy policy, a cookie banner, and some care with the data they store. AI is no different.

What we recommend starting today:

• Know which AI tools your business uses
• Identify if any make decisions about people
• If you have a chatbot, let customers know it's AI
• Stay informed about the Portuguese Government's guidance on the topic

If you want to understand exactly how the regulation applies to your business, Line Consulting AI can help you do that analysis quickly and without complexity — before August 2026.