Small business · 5 to 50 people

EU AI Act compliance without a compliance team.

The EU AI Act applies to a 12-person agency too. Get the engine larger organisations use, set up in an afternoon.

No card · EU-hosted · 5 minutes to a first classification
OverviewYour position under the EU AI Act
AI systems
4
High-risk
2
Obligations done
17of 42
40% of the work doneAnnex III high-risk duties apply from 02.12.2027
Next up
Art. 26(11)Inform affected persons of high-risk AI decisionsRecruitment assistant · Build & document
Art. 86Right to explanation of individual decision-makingRecruitment assistant · Build & document
Art. 13Instructions for use — supply to deployersCredit-scoring model · Build & document
What to do next, in the order it unlocks
Illustrative workspace · obligations and dates are the engine's and the Act's
The reality

What small teams tell us first.

What we hear

“We use eight AI tools and I don't know which ones the Act applies to.”

What the product does

A yes or no for each system in under ten minutes, with the article behind it.

What we hear

“Our lawyer's quote was twenty thousand euro just to map our obligations.”

What the product does

The engine maps them. Pay a lawyer only for real judgement calls.

What we hear

“An auditor showed up and we had no documentation, just folder names.”

What the product does

Evidence filed against each item, and documents assembled from it.

What you get

Built for small businesses with no compliance officer.

01

Set up in an afternoon

Add your systems, classify them and accept the obligations. No consultancy.

02

No legal background needed

Each obligation in plain English, beside its article.

03

Pay only for what you use

No twelve-month minimum and no implementation fee.

04

Vendor AI covered

Most SMEs are deployers, so the lighter deployer path is the default.

In practice

Three small companies, three different starting points.

Use case 01

A 25-person agency using generative tools on client work.

  • Each tool joins the register in under two minutes.
  • Most are limited risk: the smart form drafts the Art. 50 notice.
  • That is the whole job: no Annex IV, FRIA or other high-risk work.
ClassificationRecruitment assistant
Prohibited practicesNo — none of thoseArt. 5
Product lawNoArt. 6(1)
Annex III area4. EmploymentArt. 6(2)
Art. 6(3) exceptionIt profiles natural personsArt. 6(3)
Your roleWe use it as supplied — a finished tool somebody else providesArt. 3(3)–(8)
VerdictHighDeployerEvery step cites its article
Illustrative record · articles are real, the system is not
Use case 02

A 40-person e-commerce SME with an engine that ranks suppliers.

  • Supplier ranking is limited risk; customer scoring is flagged under Annex III for a closer look.
  • The engine generates the provider obligations for each phase.
  • Annex IV assembles from smart forms; the DoC is drafted in the editor.
Obligation registerDerived by the engine
13obligations applyDeployerHigh

13 obligations apply to a deployer of a high-risk system.

Classify1
Scope & literacy2
Build & document4
Conformity assessment0
Register1
Operate & monitor5
Art. 26(1)Use system per provider's instructions for use
Art. 26(2)Assign human oversight person(s)
Art. 26(5)Monitor operation; suspend & notify on serious risk
Art. 26(9)Use Art. 13 information for the GDPR Art. 35 DPIA
Computed by the engine for one system · switch the role to compare
Use case 03

A 12-person firm receiving a high-risk provider's IFU package.

  • Paste the provider's sharing token; the package imports in seconds.
  • Oversight plan, monitoring schedule and worker notification appear.
  • The hash chain links back to the provider's seal.
ProviderInstructions for Use
Provider identity and contact details
Intended purpose, characteristics and capabilities
Accuracy, robustness and cybersecurity levels
Known limitations and circumstances of foreseeable misuse
Pre-determined changes to the system and its performance
+ 4 more required elements
SealedOne-time sharing token issued
DeployerRecruitment assistant
One-time sharing token pasted
Imported · 9 elementsImported from the provider’s sealed packageArt. 13Art. 26(1)
Illustrative package · the elements are Article 13(3)’s
What you will lean on

The features small teams use most.

Straight answers

EU AI Act compliance for small business: your questions

Does the EU AI Act apply to a small company that only uses AI tools?

Usually yes, as a deployer: Article 4 AI literacy, Article 50 transparency for deepfakes, AI-written public-interest text or emotion recognition, and Article 26 for high-risk systems. Most SME systems are limited or minimal risk; the free check says which.

Do I need a lawyer to use Veritome?

No. The engine maps your obligations and every screen names its article, so lawyer time goes only on the judgement calls. Veritome is not legal advice.

Does GDPR come into it?

Yes, wherever personal data flows. Five data questions decide which GDPR duties join the same register, so your EU AI Act and data-protection work sits in one list.

What does it cost?

Classifying one system is free, with no card. Paid plans follow how many AI systems you register and how many are high-risk; every price is on the pricing page.

Where to next

Five minutes to your statutory dates.

The free check shows each duty and when it takes effect. No card, no calls.

Check my obligations for free See pricing