The AI Regulation does not apply to an entire sector or only to large companies. It applies to those who fulfil a specific role in relation to an AI system: whether you build it, place it on the market, or use it within your own organisation. An installation company with ten employees can be subject to it just as much as a multinational, as soon as an AI system is deployed that falls within the scope of the Regulation.
For most SMEs, the question does not arise because they develop AI themselves, but because they use software in which an AI function is embedded: a CV screening tool, a chatbot on the website, a scheduling system that automatically proposes rosters. In this situation, you are usually not the provider of the AI system, but the so-called user. This is a lighter role than that of the party that developed the system, but not without obligation: the Regulation distinguishes different risk categories in this respect, and which category applies determines which obligations apply to that role.
Role determines the obligation, not the sector
The Regulation uses a risk-based classification. Some applications are considered unacceptable risk and are prohibited, others are classified as high risk with associated obligations, and many applications fall outside those heavier categories. A chatbot that answers customer questions often falls in a different category in practice than a system that has a say in who is hired or dismissed. This latter category, personnel selection and assessment, is cited in the Regulation as an example of an application that requires extra attention, precisely because the outcome has direct consequences for individual people.
This means that two companies in the same sector can be affected differently. An office organisation that only uses a scheduling tool is in a different position than an organisation that uses AI in the recruitment and selection of staff. The question is therefore not "do I use AI", but "what type of AI system do I use, and in what role".
Examples from the practice of an SME
An HR manager who purchases a job application tool with AI functionality thereby becomes the user of that system. The tool's supplier is usually the provider and bears a different part of the obligations, but this does not automatically exempt the user from all responsibility. An office manager who uses a text generator to write job advertisements is generally in a lighter category than if that generator also has a say in who is invited for an interview.
A director of an installation company who uses AI-driven scheduling software to assign technicians is in a different situation than if that same software is also used to support performance appraisals. The technology may be identical; the application and the effect on people determine the classification. That is precisely why a general statement such as "this does not apply to small companies" is incorrect: the size of the company plays no role in the Regulation itself in determining the risk category.
What if you only use an off-the-shelf tool
Many companies buy in software and do not adapt it in any way. Even then, the Regulation may apply, albeit usually with a lighter set of obligations than for the party that developed the system. The practical question that goes with this is not only a legal one: what information does your supplier provide about the nature of the system, and is that information sufficient to be able to assess yourself which category you fall into. review the concepts and categories carefully provides a starting point for you without immediately requiring a lawyer.
This also affects the conversation you have as a purchasing party with a software supplier: not only about price and functionality, but also about what the system does exactly with the data of your employees or customers, and whether the supplier itself has already worked with the classification. If you have that conversation only after the system is already in use, you miss the moment when it is easiest to arrange.
Where you can check this for your own situation
Because the classification depends on the specific system and the specific application within your organization, a general answer is always a starting point, not an endpoint. For your own situation, it is advisable to consult the official text or contact the competent supervisory authority; a platform like ours can help you quickly see which questions are relevant. With a few questions that directly provide an indication you get a first picture of where your situation might stand, without obligation.
Are you curious how we obtain our information and why we deliberately do not make definitive statements about individual cases? We explain that on the page about how our information is created. And if you come across a question that is not answered here, check the collection of frequently asked questions or do the free quick-scan to see which topics are relevant for your company.