Who Does the EU AI Act Apply To? Does It Affect Your Business?

The EU AI Act applies to virtually every business that uses artificial intelligence in its operations - including the smallest Lithuanian micro-enterprises. If your employees use ChatGPT, Copilot, AI translation, text or image generation tools, Regulation (EU) 2024/1689 already concerns you. The widespread belief that "the AI Act only targets big tech giants or AI developers" is incorrect: AI literacy duties also apply to deployers - i.e., ordinary businesses that use AI tools, not those that create them.

The question of applicability should be resolved not by company size, but by role: whether you use an AI system in your operations, create it, or supply it to others.

What Is the EU AI Act and Why Does It Apply Broadly?

The EU AI Act is a 2024 regulation adopted by the European Union that establishes uniform rules for the use of artificial intelligence across the EU. Since it is a regulation (not a directive), it applies directly in all member states, including Lithuania - no additional national legislation is required for it to bind you.

The regulation was intentionally designed for broad application: its goal is to ensure safe and transparent AI use across the entire economy. For a simpler explanation, see the article The EU AI Act Explained - What It Is and What It Means for Business.

The most important thing to understand is that the scope of the AI Act is determined not by company size, but by your role in the AI value chain and the risk level posed by the AI you use.

What Roles Are Defined in the AI Act?

The AI Act categorises entities based on their relationship with the AI system. For small Lithuanian businesses, the two most relevant roles are:

Most Lithuanian micro-enterprises fall under the deployer category. This is the most common and often unexpected case: it is enough for a couple of employees to regularly use any AI tool for work purposes, and the company becomes a deployer with corresponding obligations.

For more precise definitions, see the article EU AI Act Terminology, and for a wide range of examples, check the list of all articles.

It is worth emphasising one common misconception: many managers believe that if an AI tool is free or used only "occasionally", the regulation does not apply. This is untrue. From the perspective of the AI Act, what matters is not whether you pay for the tool or how often you use it, but whether the AI system is used in professional activities. A single employee who asks ChatGPT once a week to draft a proposal for a client already brings the company under deployer status.

Does the AI Act Apply to Small Businesses?

Yes. The AI Act applies to small businesses just as it does to large ones - the regulation does not provide a general exemption based on the number of employees or turnover. Micro-enterprises (1 - 30 employees) are granted only a few simplifications, such as streamlined documentation for high-risk cases, but core obligations apply to everyone.

In practice, this means that if you use AI, you are subject to at least the following requirements:

• Supporting AI literacy (Article 4). Since 2 February 2025, you must take measures to support the development of AI literacy for your staff and relevant persons, considering their knowledge, experience, training, context, and the people affected by the AI. This does not require guaranteeing a specific or sufficient individual level - only implementing measures such as training or documentation. This obligation is already in force.
• Avoiding prohibited AI practices. Certain AI activities (e.g., manipulative systems, social scoring) are completely banned from 2 February 2025.
• Transparency requirements, if you use generative AI or interact with clients via chatbots.

For more details on the specific obligations under Article 4, see Requirements of Article 4 of the AI Act.

What Determines How Many Obligations Your Business Has?

The extent of your obligations depends on which risk category your AI system falls into. The Act divides AI systems into four levels:

1. Unacceptable risk - prohibited (e.g., manipulative or mass surveillance AI).
2. High risk - strictly regulated (e.g., AI for employee recruitment, credit scoring).
   • High-risk AI embedded in regulated Annex I products (e.g., medical devices) must comply by 2 August 2028.
   • Other high-risk AI (Annex III) must comply by 2 December 2027.
3. Limited risk - transparency requirements apply (e.g., chatbots, generative content).
4. Minimal risk - free use (most everyday tools).

Most everyday tools used by small Lithuanian businesses - text generation, translation, drafting - fall under minimal or limited risk. However, even for minimal risk, the AI literacy obligation (Article 4) still applies. For more details on categories, see AI Act Risk Categories.

A separate note for IT and software development companies: they often act not only as deployers but also as providers, so their obligations are broader. This situation is discussed in the article The AI Act for IT Companies.

When Does the AI Act Not Apply?

There are a few areas where the regulation does not apply - it is worth knowing them to avoid confusion:

• Purely personal, non-professional AI use. If an employee uses AI at home for private purposes, this does not create obligations for the company.
• AI systems used solely for military, defence, or national security purposes - these are outside the scope of the regulation.
• AI developed exclusively for scientific research and development until it is placed on the market.

In all other cases - i.e., most business scenarios - the regulation applies. For the few service, trade, or manufacturing businesses that do not use any AI tools at all, the obligations are not yet relevant. However, such companies are rapidly decreasing, as AI features are already embedded in everyday tools - office software, browsers, accounting and marketing platforms - often without users even noticing.

When Do the AI Act Obligations Take Effect?

The AI Act comes into force gradually. For small businesses, the most important milestones are:

This means that the AI literacy requirement is already in effect - it is not a future obligation but a current one that many Lithuanian micro-enterprises have not yet implemented. Supervision and enforcement by authorities began on 2 August 2026.

What Should a Small Business Do Specifically?

If your business uses any AI tool, a minimal compliance package looks like this:

• Inventory your AI tools - create a register of which AI solutions you use and for what purposes.
• Develop an AI usage policy - internal rules on how employees may and may not use AI.
• Ensure AI literacy - train employees and document that the training took place. The AI Act does not require specific certificates, fixed training hours, external auditors, or a dedicated AI officer - internal measures such as training, guides, or knowledge checks are sufficient. Our documents and quizzes are recommended practical tools, but not a mandatory legal minimum or a guarantee of compliance.
• Maintain a compliance record - proof that you have fulfilled the Article 4 obligation.

Practical example: A five-person marketing agency whose employees use ChatGPT for text and AI image generation tools for proposals. This is a deployer using limited and minimal risk AI. Its minimal compliance package includes an AI policy (what is allowed, what data is prohibited from being entered into AI), a tool registry, short AI literacy training for the team, and a compliance record. All of this can be realistically implemented quickly and does not require a lawyer or AI specialist.

Failure to comply with these obligations can be costly - read more about possible fines and real risks in AI Act Fines and Risks.

All of this can be prepared in-house, but it requires time and legal understanding. That is why nebedirbam.lt automatically prepares a practical documentation package - AI usage policy, AI tool registry, compliance record, and employee AI guide - for a fixed €149 + VAT (€299), along with AI literacy training, knowledge checks, and certificates. For those who first want to try the training themselves, we also offer free AI literacy training. The free path is for one signed-in participant; team training is included in the paid documentation package.

Note: The information in this article is based on official EU AI Act sources. The requirements of Article 4 were amended on 27 July 2026, and supervisory authority activities began on 2 August 2026. More information: AI Act Service Desk - Article 4 and European Commission Digital Strategy.

Quick Summary: Does the AI Act Apply to Your Business?

The answer is almost always "yes" if your business uses AI in any way in its operations. The scope of the AI Act is determined not by company size, but by role (most often deployer) and the risk level of the AI used. For the few businesses that do not use any AI tools at all, the obligations are not yet relevant. However, as soon as you start using even one AI tool, the Article 4 AI literacy requirement, which has been in effect since 2 February 2025, begins to apply.

Practical advice: the general application date of 2 August 2026 has already passed - the AI literacy obligation is already in effect now, and it is simple to implement. Start with an inventory of tools and employee training, and then organise your documentation in one step.

The official text of the regulation can be found on the EUR-Lex portal (Regulation (EU) 2024/1689), and practical guidance is available on the European Commission’s Digital Strategy page (digital-strategy.ec.europa.eu).