AI policy and the EU AI Act
Most SMEs use AI rather than build it. That keeps the requirements manageable. But there are requirements, and they already apply.
What applies to you as a user of AI
- AI literacy: Businesses that use AI must take measures that support AI literacy among the staff who use it. The requirement has applied since February 2025 and was changed in July 2026 to an obligation of effort. You must be able to show what you have done
- Transparency: From August 2026, people must be able to tell when they are dealing with AI, such as a chatbot or AI-generated content. A customer-facing agent must make this clear
- Prohibited uses: Certain uses of AI have been banned since February 2025. They rarely affect ordinary SMEs, but you should know where the line is
- High risk: The heavy requirements for high-risk AI, for example in recruitment and credit scoring, have been postponed until December 2027 and August 2028. If you use AI to assess applicants or employees, follow when the requirements take effect
What a useful AI policy contains
- Which AI tools are approved and which accounts must be used
- Which data must not be shared, such as personal data, customer data and trade secrets
- That a person approves anything sent to customers or used in decisions
- Who to ask when in doubt, and how to report mistakes
- How you document what you have done for staff AI literacy
The best policy is one or two pages long and actually used. A long document nobody reads documents very little.
How we help
We write the AI policy with you, based on the tools you actually use, and produce the documentation that shows your effort. It is part of our secure AI setup and can also be part of an SMV:Digital programme, where analysis of security and data ethics in AI is eligible for the grant.
Secure AI setup incl. AI policy
excl. VAT, one-off
The price applies to businesses.
Questions
Are we covered by the AI Act if we only use ChatGPT or Copilot?
Yes, as a user of AI. For most SMEs it comes down to AI literacy and transparency. The heavy requirements for high-risk AI rarely apply.
Who supervises?
According to the European Commission, national authorities start enforcing the AI literacy requirement from August 2026. In Denmark, it had not yet been decided in October 2026 which authority will supervise it. The Danish Agency for Digital Government is the central contact point for the AI Act.
Is this legal advice?
No. We help with the practical side: policy, guidelines and documentation. If you need a legal assessment, talk to a lawyer.
Next step
Book a free 30-minute call. You get an honest view of whether it makes sense for you.
- You tell uswhere your time goes today and what you have already tried.
- We find the taskstwo or three places where AI or automation can save time.
- You get an honest viewon price, time and whether it makes sense at all. No commitment.