AI Deployment Checklist for Small Businesses

The AI deployment checklist for small businesses consists of ten sequential steps: inventory all AI tools in use, determine risk categories, assign a responsible person, draft a usage policy, train employees, implement data protection rules, document compliance, review provider contracts, plan regular updates, and verify alignment with the EU AI Act. This article provides the full checklist with concrete actions tailored to Lithuanian micro-enterprises (1 - 30 employees) that already use tools like ChatGPT or Copilot but lack formal documentation.

Many small businesses start using AI spontaneously: one employee opens ChatGPT, another uses Copilot, and an accountant tries AI-based invoice recognition. After six months, no one knows who uses which tools or what data they process. This checklist helps bring everything into order in a matter of days, not months.

Why Does a Small Business Need an AI Deployment Plan?

Without a plan, AI usage becomes "shadow AI" - unregistered, uncontrolled, and risky. Key reasons why even a 5-person company should have a structured checklist:

• Legal obligation. The EU AI Act (Regulation (EU) 2024/1689), Article 4, applicable since 2 February 2025, requires that providers and deployers take measures to support the development of AI literacy among staff and relevant persons, considering their knowledge, experience, training, context, and the persons affected. This obligation applies to all entities using AI systems in a professional context - regardless of company size. There is no requirement to guarantee a specific or sufficient individual level of literacy.
• Data protection. Without clear rules, employees may input client personal data or trade secrets into AI tools.
• Quality control. Without a policy, no one verifies AI outputs, risking errors in documents, calculations, or communications.
• Team clarity. Employees may either fear using AI or use it recklessly without understanding the boundaries.

For more on how unregistered usage becomes a problem, see the full list of articles, including topics on shadow AI and personal data.

What Does the Full AI Deployment Checklist Look Like?

Below is a table outlining the ten-step checklist, responsibilities, and key outcomes. You can print it and use it as a working document.

The following sections detail the specific actions for each step.

1. How to Inventory AI Tools in Use?

Start with a simple question to your team: "Which AI tools do you use at work?" List everything - from ChatGPT and Microsoft Copilot to AI features embedded in accounting software, CRM systems, or email clients. Many AI tools are used without realization: translation tools, text correction, or automated responses.

For each tool, record: name, who uses it, purpose, what data is processed, and whether it is a free or paid version. This structured list is called a registry. For guidance on how to create it correctly and which fields to include, see the article on AI tool registry.

2. How to Determine the Risk Level for Each Tool?

The EU AI Act categorizes AI systems by risk. For most micro-enterprises, three key points matter:

1. Is it a prohibited practice? For example, emotion recognition in the workplace has been prohibited since 2 February 2025.
2. Is it a high-risk system? Typical office tools (e.g., ChatGPT for text generation, Copilot for coding) usually do not fall into the high-risk category.
3. Is transparency required? If AI interacts with clients (e.g., chatbots) or generates content, users must be informed.

In practice, most small business tools fall under "minimal" or "limited" risk, so the primary obligations remain AI literacy and transparency, rather than complex compliance assessments.

3. Who Should Be Responsible for AI in the Company?

Even in a small company, one person should "own" AI governance. This could be a manager, office administrator, or IT lead. Their tasks include: maintaining the registry, updating the policy, organizing training for new employees, and responding when new tools emerge. Without a clear appointment, documents become outdated, and responsibility gets lost among the team.

4. How to Draft an AI Usage Policy?

The policy is a concise document explaining to employees what is allowed and prohibited with AI. A good policy for a small business includes: permitted tools, prohibited data types (personal IDs, health data, client contracts), the requirement to verify AI outputs before use, and transparency rules for clients.

The policy does not need to be a ten-page legal treatise - 2 - 3 clear pages suffice for a micro-enterprise. For details on structuring this document and essential points to include, see the article on AI usage policy in business.

5. How to Train Employees Under Article 4?

Article 4 of the EU AI Act (effective since 2 February 2025) requires that providers and deployers take measures to support AI literacy among staff and relevant persons, considering their knowledge, experience, training, context, and affected individuals. This does not mean every employee must become an engineer, nor does it mandate specific certificates, a fixed set of documents, a set number of training hours, an external trainer, or a dedicated AI officer. Practical training, optional knowledge checks and completion records can be useful measures, chosen according to the context - for example, using our prepared documents and quiz.

Training should cover: AI fundamentals, common errors (hallucinations), data protection, and company policy rules. For guidance on planning such training, see the article on AI literacy training for employees. Free AI literacy training with knowledge checks and certificates can be requested via the free training survey. The free path is for one signed-in participant; team training is included in the paid documentation package.

6. How to Protect Personal Data When Using AI?

The golden rule for small businesses: never enter personal data, health information, client contracts, or trade secrets into public or unapproved AI tools unless the provider’s terms and safeguards explicitly allow it and a valid legal basis exists. Practical solutions:

• Use business (not free) AI versions that do not use your data for model training;
• Anonymize data before entering it into AI;
• Document these rules in your policy so employees clearly understand the limits.

GDPR and the AI Act operate in tandem - AI compliance does not exempt you from data protection obligations. Many companies ban the use of public, unapproved AI tools, but this does not mean a blanket ban on AI; each case requires assessment of the legal basis, data minimization, tool reliability, and safeguards.

7. How to Document AI Compliance?

A compliance record is a document describing the company’s chosen actions, such as keeping a tools list, preparing guidance and conducting training. If a supervisory authority or client asks how you ensure compliance with the AI Act, the compliance record is your answer. It logs what was done, when, and by whom. This is the best "snapshot in time" to present during an audit.

Our prepared documents (policy, registry, compliance record) and training quiz are practical tools, but they are not mandatory legal minimums or a guarantee of compliance with the EU AI Act.

8. What to Check in AI Provider Terms?

When reviewing AI tool providers, focus on: whether they use your data for model training, where data is stored (EU or not), whether a data processing agreement exists, and whether the provider itself complies with the AI Act. For small businesses, it is critical to choose providers that clearly state business plan data is not used for model training.

9. How to Plan Regular Updates for AI Documents?

The AI landscape evolves rapidly - new tools emerge, provider terms change, and new AI Act obligations take effect. For example, AI literacy measures (Article 4) have applied since 2 February 2025, general-purpose AI model rules began applying on 2 August 2025 subject to transitional provisions, and transparency obligations (Article 50) have applied since 2 August 2026. High-risk AI systems (e.g., Annex III) must comply by 2 December 2027, and high-risk AI embedded in regulated Annex I products by 2 August 2028. Therefore, the registry and policy must not remain static. Set a regular review schedule - e.g., every six months or whenever a new tool is introduced. For systematic guidance, see the article on updating AI documents.

10. How to Verify Compliance with the EU AI Act?

The final step is to review the entire checklist and confirm that each item has been completed. Use this quick self-assessment:

• ✅ Do we have a registry of all AI tools?
• ✅ Has a risk level been assigned to each tool?
• ✅ Is there a responsible person?
• ✅ Has a usage policy been drafted?
• ✅ Have employees been trained and do they have certificates?
• ✅ Have data protection rules been established?
• ✅ Has a compliance record been prepared?
• ✅ Have providers been reviewed?
• ✅ Has an update plan been scheduled?

If you answer "yes" to all questions, you have a functional AI governance framework. The official regulation text is available on the EUR-Lex portal (eur-lex.europa.eu), while practical information about the AI Act is published on the European Commission’s Digital Strategy portal.

How Much Time and Resources Does This Checklist Require?

The main challenge is not inventorying tools but preparing documents correctly. A micro-enterprise can do this independently using templates or automatically. For example, nebedirbam.lt offers a fixed-price €149 + VAT (€299) package that automatically generates everything needed: an AI usage policy, AI tool registry, compliance record, employee AI guide, plus AI literacy training with knowledge checks and certificates. The service is provided by UAB Silotech (company code 306971572) and is 100% automated, with document preparation handled automatically after your answers are submitted. The documents are generated from templates reviewed by a compliance specialist.

Quick Summary: AI Checklist at a Glance

AI deployment in a small business is not rocket science - it is ten sequential steps, from tool inventory to regular updates. Start simple: list the AI tools you already use and assign a responsible person. Then proceed with the policy, training, data protection, and documentation. The most important thing is to start, as Article 4’s AI literacy obligation has applied since 2 February 2025, and formal processes protect your business from both legal and practical risks.

This article’s legal information is based on the official requirements of Article 4 of the EU AI Act (Regulation (EU) 2024/1689), effective since 2 February 2025, and the explanations provided by the EU AI Act Service Desk and the European Commission’s Digital Strategy portal. For the latest updates, refer to these sources.