Most AI compliance advice is written for companies with a general counsel. If you have thirty people, one person who understands the automations, and a website somebody built two years ago, it is close to useless.
So this is the small-company version. Six checks, each answerable in an afternoon, aimed at the obligation that is actually live right now: telling people when they are dealing with AI, and making AI-generated content identifiable. The background on why this is the live one, and what got deferred to 2027, is in The EU AI Act Deadline You Think You Missed.
1. Write down every place AI meets an outsider
One page. Two columns: where it is, and who it talks to.
The list is always longer than expected, because the obvious entry is the chatbot and the non-obvious ones are everything else. Email that drafts or sends replies. A form that scores or routes a submission. A phone line that answers before a human does. A booking flow that decides availability. Review responses. Product descriptions. Translated pages.
You cannot disclose what you have not enumerated, and the enumeration is the part people skip.
2. Make the chatbot introduce itself in its first message
Not in the privacy policy. Not in a tooltip. In the first thing it says.
One line is enough, and the tone can stay yours. Something like: you are chatting with our AI assistant, and it will pass you to a person whenever you ask. That is the whole fix, and it is usually a config field rather than a project.
While you are in there, check what happens when someone asks to speak to a human. If the answer is that nothing happens, fix that too, because an honest label on a system with no exit is worse than no label.
3. Check the outbound email
This is the one that is most often missed, because it does not feel like AI. A model drafts a reply, a human glances at it, and it goes out under a person's name.
The question to settle is simple: is a human genuinely reviewing each message before it leaves, or is review theatre? If a person actually reads and approves it, it is their message. If the volume makes that impossible, it is an AI message wearing a person's signature, and it needs to say so.
Pick one and make the system match the claim.
4. Decide your marking rule for generated content
The obligation is that AI-generated or manipulated content is identifiable. The practical decision is where your line sits, and then applying it consistently.
A workable default that most teams can live with: a model helping you write something a human wrote and edited needs no marking. Content published essentially as the model produced it should be marked. Synthetic images, video, and voice should always be marked, and photorealistic manipulation of real people or places is the case where you should be strictest.
Write the rule in three sentences and put it where the people publishing can see it. A rule nobody can find is not a rule.
5. Know what your vendors are telling you
You are almost certainly not building the models. You are buying them, and providers of general-purpose models have had their own obligations since August 2025, which mostly works in your favour as a buyer.
So collect, once, for each model or platform you depend on: what the provider documents about the model, what they say about training data and usage, and what their terms allow you to do with the output. Keep it in one folder.
When a customer or a procurement questionnaire asks, and in enterprise sales it will, this folder is the difference between answering in an hour and answering in a fortnight.
6. Give it one owner and one date
Name a person. Not a committee, and not "IT". Put a recurring reminder on their calendar, quarterly is fine, to walk the list from check one and confirm nothing new appeared.
This is the step that determines whether the other five survive. Automations get added casually, by whoever is closest to the problem, and six months later nobody remembers that the new lead form has a model behind it.
What this is not
It is not a compliance programme, and it will not satisfy a regulator examining a genuinely high-risk system. If your AI is involved in hiring, credit, or access to essential services, you are in a different conversation with a different deadline and you need a lawyer in it.
What it does cover is the situation most small companies are actually in: a handful of sensible automations, a customer-facing assistant, some generated copy, and no idea whether any of it is disclosed properly. Six checks, one afternoon, one owner. That is a reasonable place to be.
The same instinct applies to automation generally, which is that the durable version is the boring one. We wrote about why that matters in The AI Automation Projects That Fail After the Demo.
