The EU AI Act: What MSPs Have To Do

The EU AI Act has generated many alarming headlines, many aimed at large AI providers building high-risk systems. For most small and medium-sized businesses and the MSPs who support them, the reality is far less dramatic. Most SMBs are not building AI. They are using tools such as Microsoft Copilot, customer service chatbots, and marketing platforms that already have built-in AI features.

This article explains what the EU AI Act actually requires of most SMBs, where the real obligations lie, and how MSPs can help clients meet them without overreacting to coverage written for a different audience. This is general information, not legal advice, and businesses with specific compliance questions should speak with qualified legal counsel.

What the EU AI Act Is, in Plain English

The EU AI Act is a regulation that classifies AI systems by risk level and sets obligations based on that classification, rather than treating all AI the same way. It applies a tiered approach: unacceptable risk (banned outright), high risk (subject to strict requirements), limited risk (mainly transparency duties), and minimal risk (largely unregulated). The headlines often focus on the high-risk category because it is where the strictest obligations apply, such as detailed logging, conformity assessments, and human oversight requirements.

Most AI tools used by SMBs, including chatbots, writing assistants, and productivity applications, fall into the EU AI Act's 'limited-risk' category. For these tools, compliance requirements are relatively light and are being introduced in phases rather than all at once.

For MSPs, this creates an opportunity to help customers stay on track by:

• Understanding which AI tools clients are using.
• Monitoring when new obligations come into effect.
• Incorporating AI governance and compliance into regular customer reviews.
• Providing practical guidance as requirements evolve.
   

Are Your SMB Clients "Providers," "Deployers," or Neither?

The single most useful distinction for SMBs is whether they are a provider or a deployer of an AI system. A provider builds and places an AI system on the market. A deployer uses an AI system that someone else built, under their own authority, for their own business purposes. The overwhelming majority of SMBs are deployers, not providers. Using Microsoft Copilot, a chatbot built by a software vendor, or an AI-assisted marketing tool does not make a business an AI provider. It makes them a deployer of someone else's product, which carries a lighter set of obligations.

This distinction matters because much of the most demanding compliance language in the Act, conformity assessments, technical documentation, and risk management systems, falls on providers of high-risk systems. Very few SMBs fall into that category. Getting this classification right early prevents a lot of unnecessary compliance work.

AI Act Obligations for SMBs

For most SMB deployers, the practical obligations center on AI literacy under Article 4, acceptable-use governance, and transparency where AI interacts directly with people, such as a chatbot that should disclose it is not human. AI literacy is an obligation that catches many businesses off guard because it sounds abstract yet has concrete meaning. It requires that staff using AI tools have a sufficient understanding of how those tools work, including their limitations, to use them appropriately.

In practice, this means documented training and clear internal guidance on approved AI use, not a one-off policy document nobody reads. Acceptable-use governance means having a written policy that defines which AI tools are approved, what data can and cannot be entered into them, and who is responsible for reviewing new tools before adoption. DNS-layer controls become relevant here, since policy without enforcement is difficult to demonstrate to an auditor.

Where the AI Act Meets GDPR

The EU AI Act does not replace GDPR. The two regulations overlap, particularly where an AI tool processes personal data, which is the case for most chatbots, marketing tools, and productivity assistants used by SMBs. Where personal data is involved, existing GDPR obligations, lawful basis, data minimization, and data subject rights still apply in full alongside any AI Act requirements. A business that is already GDPR-compliant has done much of the groundwork for AI Act readiness, since both regulations require clear governance over how data is collected, used, and protected.

This overlap is a useful talking point for MSPs. Clients who have already invested in GDPR compliance are not starting from zero. The work is about extending existing data governance practices to specifically cover AI tools, rather than building an entirely new compliance program.

AI Readiness Checklist

A practical way for MSPs to help customers prepare is to work through a simple AI readiness checklist. For most SMBs, this should include:

• Confirm whether the business is an 'AI deployer' or 'AI provider' (most SMBs will be deployers).
• Create an inventory of all AI tools in use, including those adopted informally by employees.
• Develop and document an acceptable use policy for AI.
• Deliver basic AI literacy training to employees using AI tools.
• Verify that AI tools processing personal data have an appropriate legal basis under the GDPR.
• Review the EU AI Act implementation timeline and identify which obligations already apply and which are coming into effect.

For MSPs, helping customers prepare for the EU AI Act builds naturally on the services they already provide. Identifying unsanctioned AI tools aligns with DNS-layer visibility and web security. Educating users on safe and responsible AI use extends existing security awareness training, while developing AI governance policies fits into the wider compliance and risk conversations MSPs already have with regulated customers.

Rather than becoming another one-off AI compliance project, EU AI Act readiness can evolve into an ongoing governance service that helps customers reduce risk, meet regulatory obligations, and use AI with greater confidence. In turn, MSPs strengthen customer relationships, create new recurring revenue opportunities, and further differentiate their managed services.

Request a demo to see how CyberSentriq helps MSPs build compliant, resilient AI governance services that deliver long-term value for their customers.