assurance · Level 2
AI compliance for a small business, in plain English
The EU AI Act's transparency duties turned into four things you can actually do on Monday morning: no legal department required.
Your next step
Start this course online
Register your start, then work through the lessons and exercises at your own pace. You can download the PDF separately. Where a scored exam is available, you will find it after the lessons.
Register or resume your course
Start with the essentials
The short answer
From 2 August 2026, the EU AI Act's transparency duties are live: tell people when they are talking to a bot, label AI-generated content, and disclose synthetic media such as deepfakes. For a small business, the practical response is four steps: list where you use AI, classify each use by risk, meet those disclosure duties, and keep simple evidence that a person reviewed the output.
What you will learn
- You will be able to build a simple, honest inventory of every place AI touches your business, from a website chatbot to AI-drafted marketing copy.
- You will be able to sort each AI use into a plain-English risk tier, without needing a legal background.
- You will be able to write the actual disclosure text your business needs: telling people they are talking to a bot, labelling AI-generated content, and flagging synthetic media.
- You will be able to set up a simple log that shows a person reviewed an AI-assisted output, not just that AI was used.
- You will know which EU AI Act transparency duties apply from 2 August 2026, and recognise when a use needs proper legal advice rather than this workbook.
Who it is for
Anyone running or managing a small business that uses AI tools such as a website chatbot, an AI writing or image tool, or an AI-assisted screening process, with no legal or compliance background needed. If you can use a spreadsheet, you can do every exercise in this workbook.
Before you start
- None beyond curiosity. If you have not worked through What is AI? Artificial intelligence explained yet, it is a useful five-minute primer, but this workbook stands on its own.
Learn in your browser · Chapter 01 of 06
Why this is on your desk now, not next year
This is live regulation, not a future proposal, and it reaches far more businesses than the ones building AI systems themselves.
From 2 August 2026, the transparency duties in the EU AI Act apply across the European Union, and the European Commission has published guidance aimed squarely at small businesses and startups, not just large AI developers. If your business uses a chatbot, publishes AI-written or AI-generated content, or relies on an AI tool to screen or score people, some of this already applies to you, whether or not anyone in your business has read the regulation.
Take a small online shop with ten staff. It runs a chatbot widget for customer questions, uses an AI writing tool to draft product descriptions and social posts, and uses an AI photo tool to tidy up product images before they go on the website. None of that makes the shop an AI company, and none of it needs a compliance officer. It does mean four things are worth doing this month: write down where AI is actually used, work out which uses are higher stakes than others, put simple, honest disclosure text where it is needed, and keep a record that a person is actually checking the output.
Try it yourself · Activity 01
10 minDoes any of this already apply to you?
Answer these five questions honestly, about your business as it actually runs today, not how you think it should run.
- Does any part of your website or customer service use a chatbot or an AI assistant that a customer might talk to?
- Do you publish blog posts, social captions, adverts or product copy that an AI tool drafted, wholly or in part?
- Do you publish images or video that an AI tool generated or significantly altered?
- Does any AI tool help you shortlist, score or rank real people, such as job applicants?
- If someone asked you today 'what does the AI in your business actually do', could you answer in under a minute?
If you answered yes to any of the first four, this workbook is directly for you. If you could not answer the fifth question quickly, Chapter 2 fixes that.
Worked answer
Example, a ten-person online shop: chatbot, yes, a support widget on the website. AI-drafted copy, yes, product descriptions and social posts. AI images, yes, a photo tool tidies product shots. AI screening people, no, hiring is done by a person reading CVs. Could answer in a minute, no, nobody had written it down until this exercise.
Learn in your browser · Chapter 02 of 06
Build a simple inventory of where AI is used
You cannot classify risk or meet a disclosure duty for something nobody has written down. This chapter builds the one-page list the rest of the workbook works from.
For this purpose, treat "AI" broadly: any tool that generates content, makes a prediction, or produces a recommendation or score based on your data. That covers a chatbot widget, an AI writing or image tool, an AI meeting note-taker, an AI-assisted CV screener, and a general AI assistant a staff member uses for admin or drafting, even if nobody formally "rolled it out".
Scroll sideways to see every column.
| Tool and where it's used | Customer-facing? | Who owns or manages it |
|---|---|---|
| Chatbot widget on the website | Yes | Customer service lead |
| AI writing tool for product copy and social posts | Yes, once published | Marketing |
| AI photo tool for product images | Yes, once published | Marketing |
| General AI assistant for internal drafting and admin | No | Whoever uses it |
Try it yourself · Activity 02
20 minBuild your own inventory
Open a blank document or spreadsheet with three columns: tool and where it's used, customer-facing or not, who owns it.
- Go department by department: customer service, marketing, hiring, operations, admin.
- Ask each team what AI tools they actually use, not what was officially approved.
- For each tool, note whether a customer, applicant or member of the public ever sees its output directly.
- Name a real person responsible for knowing what that tool does, even if it is just 'whoever uses it' for now.
Did anything turn up that surprised you, a tool someone picked on their own that nobody else in the business knew about?
Worked answer
Example continued: the inventory turns up a fifth item nobody had mentioned, an AI meeting note-taker one manager uses on client calls. It is not customer-facing in the sense of generating public content, but a client's own words are being recorded and summarised by a third-party tool, worth a note for Chapter 5's oversight log even though it does not need a public disclosure.
Learn in your browser · Chapter 03 of 06
Classify each use by risk
Not every AI use carries the same stakes. This chapter sorts your inventory into three plain-English tiers, so you know where to spend your attention first.
This is a working shortcut, not the Act's own legal risk categories. Use three tiers. Tier one: internal only, nobody outside the business sees the output directly, such as an AI tool that helps draft an internal memo a person then rewrites. Tier two: customer-facing or public content, where the transparency duties in Chapter 4 apply, such as a chatbot or AI-generated marketing content. Tier three: the AI meaningfully shapes a decision about a real person, such as shortlisting job applicants or scoring a credit application. Tier three uses can fall under the Act's stricter rules for higher-risk systems, and that is a genuine legal question for your specific tools, not something a general workbook can answer for you.
Scroll sideways to see every column.
| Inventory item | Tier | Why |
|---|---|---|
| General AI assistant for internal drafting | 1, internal only | Output is reworked by a person before anyone outside sees it |
| AI writing tool for product copy | 2, customer-facing content | Published text the public reads directly |
| Chatbot widget on the website | 2, customer-facing interaction | A customer is talking to it directly |
| AI-assisted CV shortlisting | 3, decision about a person | Meaningfully shapes who gets an interview |
Try it yourself · Activity 03
15 minClassify your own inventory
Take the inventory you built in Chapter 2 and add a fourth column: tier.
- For each item, ask: does anyone outside the business see this output directly?
- If yes, ask: does it meaningfully shape a decision about a specific real person, rather than just informing or entertaining them?
- Mark internal-only items tier one, customer-facing content and interactions tier two, and decisions-about-a-person items tier three.
- Circle every tier three item and note who you would ask for advice on it.
Did anything you assumed was low-stakes turn out to be tier two once you looked at who actually sees the output?
Worked answer
Example continued: the AI meeting note-taker from Chapter 2 stays tier one, since only internal staff use the summary. The chatbot and the AI-written product copy are tier two. Nothing in this business currently scores or ranks people, so there is no tier three item yet, worth checking again if AI-assisted CV screening is ever introduced.
Learn in your browser · Chapter 04 of 06
Meet the basic transparency duties
This is the chapter that answers 'what do I actually write, and where'. Three concrete duties cover most small-business tier-two uses.
The Act's transparency article sets out duties that map directly onto the tier-two uses most small businesses actually have. Tell people when they are interacting with an AI system, unless it is genuinely obvious from the context. Mark AI-generated audio, image, video or text so it is detectable as artificially generated. And where you publish a deepfake, or AI-generated text on a matter of public interest, disclose that it was artificially generated or manipulated.
Scroll sideways to see every column.
| Duty | What it looks like in practice | Where it goes |
|---|---|---|
| Tell people they're talking to a bot | A short line at the start of the conversation, such as 'You're chatting with our AI assistant' | Chatbot's opening message |
| Label AI-generated content | A small caption or footer note on an image, video or post | Next to the content itself |
| Disclose synthetic media | A clear statement that an image or video was AI-generated or altered | Caption or on-page note, before or at first view |
Try it yourself · Activity 04
20 minDraft your own disclosure text
Use your tier-two inventory items from Chapter 3.
- For your chatbot or AI assistant, write one plain sentence that tells a customer they are talking to an AI, in the tone your brand actually uses.
- For AI-generated or AI-edited images or video you publish, write a short caption line disclosing that.
- For AI-drafted written content, decide honestly whether a person genuinely reviews it before publishing, and note who that is.
- For each item, write down exactly where the disclosure text will physically appear, not just that it exists.
Would a customer actually notice your disclosure text, or is it technically present but easy to miss?
Worked answer
Example continued: chatbot opening line, 'Hi, I'm the shop's AI assistant, here to help with sizing, stock and returns. A person from the team can jump in any time.' Product photo caption, 'Background retouched with AI.' Product copy, a person on the marketing team reads and edits every AI-drafted description before it is published, so that item is treated as human-reviewed rather than needing the public-interest text label.
Learn in your browser · Chapter 05 of 06
Keep evidence of human oversight
Oversight only counts if you can show it. A regulator, or simply a worried customer, asking 'who checked this' needs an actual answer, not 'we trust the tool'.
A person genuinely looking at an AI output before it goes out is good practice, but on its own it leaves no trace. Six months later, nobody, including you, can say when it happened, who did it, or what they actually checked. A simple, written record turns a good habit into evidence you can actually point to.
- What was checked: the specific piece of content or output, not just 'the AI tool' in general.
- Who checked it: a named person, not a team or a role in the abstract.
- When it was checked: an exact date.
- What the check found: approved as is, edited before publishing, or rejected.
Try it yourself · Activity 05
15 minBuild a one-page oversight log
Open a blank document or spreadsheet.
- Create four columns: what was checked, who checked it, when, and the outcome.
- Fill in one real row from something published or used this week.
- Decide which of your tier-two and tier-three items get a log entry every time, versus a periodic spot check.
- Decide who reviews the log itself, and how often.
Could you have answered 'who checked last week's AI-written social post' before this exercise? If not, this closes that gap.
Worked answer
Example continued: row one, checked: product description for the new lamp range, checked by: the marketing lead, when: Tuesday, outcome: edited two lines before publishing to correct a size claim the tool had invented. That single row is now real evidence a person is reviewing AI-drafted copy, not just a claim.
Learn in your browser · Chapter 06 of 06
What you can do now
Four moves, all doable this month, none of them requiring a legal department.
You can now write down where AI is actually used in your business, sort each use into a plain-English risk tier, put honest disclosure text where a customer will actually see it, and keep a simple record that shows a person is checking the output. Nothing here required code, special software or a compliance qualification, and every exercise used a document or spreadsheet you already had.
This workbook is general education, not advice for your specific business. Get proper legal advice before relying on any of this for a tier three use, or for a decision with real consequences for a real person.
https://trust-agent.ai/exam/ai-compliance-small-businessThis is free educational content published by Mickai LTD, not professional, legal, financial or compliance advice, and Mickai accepts no liability for how you use it.
Being able to show, in writing, what an AI system does and that a person is genuinely checking it is the same principle behind Mickai's approach to trustworthy AI: a human stays in control, and that control is visible, not just assumed.
If your business needs this inventory and evidence trail built and kept up to date rather than assembled by hand, Mickai builds bespoke AI workflows and code enhancements for businesses, running on Mickai's own sovereign operating system with zero data egress: your compliance data never leaves your own environment. See what that looks like at mickai.co.uk/bespoke.
Keep learning
The complete workbook
This workbook turns the EU AI Act's live transparency duties into four things you can actually do on Monday morning: build a simple inventory of where AI touches your business, classify each use by risk, meet the basic disclosure duties, and keep evidence that a person reviewed the result. There is no statute-by-statute walkthrough, just the practical steps a small business owner or manager can run without a legal department. Every exercise uses a document or spreadsheet you already have, and the workbook is explicit throughout that it is general education, not advice for your specific situation.
- 01Why this is on your desk now, not next yearRead here · 1 exercise
This is live regulation, not a future proposal, and it reaches far more businesses than the ones building AI systems themselves.
- 02Build a simple inventory of where AI is usedRead here · 1 exercise
You cannot classify risk or meet a disclosure duty for something nobody has written down. This chapter builds the one-page list the rest of the workbook works from.
- 03Classify each use by riskRead here · 1 exercise
Not every AI use carries the same stakes. This chapter sorts your inventory into three plain-English tiers, so you know where to spend your attention first.
- 04Meet the basic transparency dutiesRead here · 1 exercise
This is the chapter that answers 'what do I actually write, and where'. Three concrete duties cover most small-business tier-two uses.
- 05Keep evidence of human oversightRead here · 1 exercise
Oversight only counts if you can show it. A regulator, or simply a worried customer, asking 'who checked this' needs an actual answer, not 'we trust the tool'.
- 06What you can do nowRead here · Reading
Four moves, all doable this month, none of them requiring a legal department.
Also inside: a 8-point checklist, a glossary of 10 terms and 10 questions and answers to test yourself. 5 hands-on exercises, each with a worked answer at the back where the workbook gives one.
The PDF is free. We ask for your name and email before downloading. Read the privacy notice at the download form. Free to download and use for personal learning, study groups and inside your own team. Please do not resell the workbooks or republish them as your own. Link people to trust-agent.ai instead.
Get your free PDF workbook
Enter your name and email, then download the complete workbook. This form also works without JavaScript.
Test yourself
Questions and answers
What actually changed on 2 August 2026?
The EU AI Act's transparency duties became directly enforceable across the European Union, including for small businesses that simply use someone else's AI tools rather than build them.
What's the practical difference between a provider and a deployer, and which one is most small businesses?
A provider builds an AI system and places it on the market. A deployer uses someone else's AI system under its own authority. Most small businesses that bought or subscribed to a chatbot, writing tool or image generator are deployers, and face the lighter deployer duties.
What's the fastest way to find AI use you did not know was happening in your business?
Ask each team directly what tools they actually use day to day, rather than relying on an official list, and check what has been subscribed to on a company card. Tools picked for convenience rarely make it onto a formal list on their own.
Why does 'customer-facing' matter when building the inventory?
It is the line that decides whether the interaction-disclosure and content-labelling duties in Chapter 4 apply. Internal-only tools carry lighter duties than anything a customer or member of the public sees directly.
What are the three practical risk tiers this workbook uses?
Tier one, internal only, nobody outside the business sees the output directly. Tier two, customer-facing content or interaction, where the transparency duties apply. Tier three, the AI meaningfully shapes a decision about a real person, such as shortlisting or scoring.
What should you do if an AI use lands in the decisions-about-a-real-person tier?
Treat it as a flag for proper legal advice on that specific tool and use case. Tier three uses can fall under the Act's stricter rules for higher-risk systems, which this general workbook cannot resolve for you.
What are the three transparency duties most relevant to a small business?
Tell people when they are interacting with an AI system, unless genuinely obvious from context. Mark AI-generated audio, image, video or text so it is detectable as artificial. Disclose synthetic media, such as a deepfake, or AI-generated text on a matter of public interest.
Does having a person review an AI draft before publishing change your disclosure duty?
For AI-generated text on a matter of public interest, genuine human review with real editorial responsibility is a recognised exemption from that specific duty. It does not remove the separate duties for a chatbot interaction or an AI-generated image or video.
Why doesn't 'a person looked at it' count as oversight evidence on its own?
Without a written record, nobody, including you in six months, can show when the check happened, who did it, or what they actually looked for. An unrecorded review cannot be pointed to later.
What four things should a simple AI oversight log record?
What was checked, who checked it, when it was checked, and what the check found, such as approved, edited or rejected.
Write as you go
My notes
Use this scratchpad for your own notes, working or answers as you read. Notes are saved in this browser on this device. Downloading makes a local copy; it does not send your notes to Mickai.
Consolidate your learning
Review your work
Work through the exercises and questions, then compare your reasoning with the worked answers. A scored exam and verifiable certificate are not yet available for this course.
Review the questionsLearn the language
Key terms
- AI system
- Software that, given the inputs it receives, generates content, predictions, recommendations or decisions that can influence a real or virtual environment, with some degree of autonomy.
- Provider
- The organisation that builds an AI system, or has one built, and places it on the market or puts it into service under its own name.
- Deployer
- The organisation that uses an AI system under its own authority, other than for purely personal use. Most small businesses using a third-party AI tool are deployers, not providers.
- Transparency obligation
- A duty to tell people, clearly, that they are interacting with or being shown output from an AI system rather than a person.
- AI-generated content
- Text, image, audio or video that an AI system produced or significantly altered, as opposed to something a person created unassisted.
- Synthetic media
- AI-generated or AI-manipulated audio, image or video that resembles a real person, object, place or event closely enough that it could be mistaken for genuine, sometimes called a deepfake.
6 of the workbook's 10 terms. The complete glossary is in the workbook.
Follow the evidence
Sources and checks
Facts last checked: .
These workbooks use AI assistance. See how the workbooks are made.
- Regulation (EU) 2024/1689 (the Artificial Intelligence Act)EUR-Lex, Publications Office of the European Union
- Transparency obligations under Article 50 of the AI ActEuropean Commission, Digital Strategy
- AI ActEuropean Commission, Digital Strategy
Created by Mickarle Wagstaff-Irons - Micky Irons with the Mickai team. Published by Mickai LTD. Last updated 29 September 2026.
NextKeep going
Where to go next
Recommended for you
AI governance: risk registers, evidence and human accountability
Govern an AI system without being an engineer: map hazards, score and evidence them, name owners and stop rights, make oversight real, and check the register with tested code.
Recommended for you
Deploy AI agents without losing control
Plan least-privilege access, prohibitions, approval thresholds and a checked log for AI agents. Exercises distinguish written plans from implemented controls.
Recommended for you
Privacy and data minimisation in AI applications
Keep personal data under control in an AI feature: UK GDPR principles, DPIAs, roles and transfers, and a redaction pipeline you run and test to see what it misses.