EU AI Act for small businesses: what applies when you use AI for enquiries and quotes

BOTrento Team6 October 2026 · Updated 11 October 20269 min read

Your role under the AI Act: provider or deployer?

The AI Act has several roles. Two of them matter for a small company that runs on sales:

• Provider: builds an AI system and sells it under its own name. Providers have the most obligations, such as documentation, testing and conformity assessment for high-risk systems.
• Deployer (user): uses an AI system as part of its business. A typical example is a company that uses AI to sort enquiries or draft replies.

If you do not build an AI tool and sell it under your own brand, you are almost certainly a deployer. This can change if you make major changes to a system or start offering it to other companies. In that case, get legal advice.

Your choice of supplier matters too. Ask who the model provider is, where the data is stored and who approves what. Our overview of what an AI assistant can and cannot do in sales can help.

Which risk category does AI in sales fall into?

The AI Act sorts uses of AI into tiers by risk. Here is a simplified overview:

The category always depends on how you use AI, not on which tool you use. The same language model can be an internal helper in one company and part of a high-risk decision in another.

What to watch as an AI deployer

AI literacy of your people

The AI Act expects people who work with AI to understand it well enough. For a small company, this does not mean certification. Short training is enough: what the tool can do, where it makes mistakes (made-up details, wrong prices, the wrong tone) and what must never be entered into it. Write it down and go through it again with every new colleague.

Transparency towards customers

If a customer deals directly with AI and no person is involved, they should know it is AI. Examples are a website chatbot or an automatic reply written by a model. It is different when AI prepares a draft and a person checks it, edits it and sends it under their own name. That person is then responsible for the content. Even so, it is worth mentioning AI use in general terms in your privacy notice. Check where the line falls in your case with a lawyer.

Human oversight

This is the most practical safeguard you can have. A person decides on price, date, discount, turning down a job and sending. AI sorts, summarises and suggests. Human oversight also protects your business, because a quote with the wrong price is a problem whatever the regulation says.

Records and traceability

Keep a record of what AI suggested, who approved it and what was sent. This helps with complaints, disputes and internal quality checks.

GDPR applies alongside the AI Act

The AI Act does not replace GDPR. Enquiries contain personal data, so you still need a legal basis, the right processors and only the data you need. Our GDPR and AI checklist for enquiries, quotes and sales emails covers this in more detail.

Checklist: the AI Act in a small company, step by step

1. Write down where you use AI. List every tool, who uses it, what for and with which data. Include employees' personal accounts in self-service chat tools.
2. Work out the role and risk for each use. Are you a deployer? Does the use involve employees, credit or another sensitive area? If so, be careful and get advice.
3. Decide what a person decides. Price, date, discount, turning down a job, sending. Write it down as a rule.
4. Set up transparency. Where a customer deals with AI directly, tell them. Mention AI use in your privacy notice.
5. Train your team. Run a short internal session and give everyone a one-page rule. Note who attended and when.
6. Check your suppliers and data. Find out where data is stored, who the model provider is, whether they use data for training and how you can end the contract.
7. Keep records. Draft, approval, sending. If possible, record this automatically rather than by hand.
8. Review the rules regularly. Look for new tools, new uses and new interpretations of the regulation.

Once you know who decides what, follow-up is the next place where a clear rule pays off. Our guide to quote follow-up: when to chase, what to write and when to stop shows how to keep it consistent.

Template: internal policy for using AI in sales

Adapt the text below and share it with your whole sales team. It is not a legal document. It is a clear rule for everyday work.

Policy for using AI in sales communication

1. We use AI to sort enquiries, summarise requirements and prepare draft replies and quotes.
2. No email or quote is sent until the responsible salesperson has checked and approved it.
3. A person always decides on price, date, discount and turning down a job.
4. We do not enter data into AI that the task does not need (ID numbers, bank account numbers, health data, internal passwords).
5. We use only tools the company has approved, never personal accounts.
6. If a customer deals directly with an automated system, we tell them.
7. Report any error in an AI draft to [name of responsible person].

Responsible person: [name] · Valid from: [date] · Last reviewed: [date]

How BOTrento approaches it

BOTrento Chief of Staff is a managed process for enquiries, quotes and follow-up. It has the safeguards that good AI Act practice expects from the start:

• Human approval. Nothing is sent without approval. AI prepares a draft email or quote, and the salesperson decides and sends it.
• Your own API keys. You choose the model and enter your own key (Anthropic Claude, OpenAI, Google Gemini, Groq, ElevenLabs), so you know exactly who processes your texts. Keys are encrypted, only the last 4 characters are visible and you can remove them at any time. The help page on setting up API keys explains the steps.
• Data and processing. We store data on servers in Germany (EU). The language model processes only the text a task needs, through the API of the provider you choose. Commercial API providers do not use this data for training. To be clear: a server in the EU that calls an external AI API is not a closed system.
• A free trial on your own data. You start with a 14-day free trial, which begins with the first successful upload of your data (an import or a connected mailbox). The setup is clear, so it is easy to describe in your internal policy.
• No lock-in when you leave. You get an export of your data and outputs, a description of the processes and an agreed date for removing access and copies.

The process demo shows how approval works in practice. Trial and plan terms are on the pricing page.