EU AI Act: Your First Step is Knowing What AI You Use

Many Irish SMEs use modern software for daily operations, from managing sales and documents to customer chats. While efficient, what many might not realise is that these familiar tools often have powerful AI features working behind the scenes. With the upcoming EU AI Act, understanding where AI operates in your business is no longer optional.

Why this matters for SMEs

Ignoring the AI in your existing systems means you could inadvertently fall foul of new regulations, risking fines and reputational damage. This directly affects owners, operations leads, and IT managers who are responsible for compliance and operational continuity.

What it looks like in practice

Consider Mary, the Operations Manager at 'Green Growth Gardens', a landscaping supply company in Cork with 60 staff. Green Growth uses a popular CRM for sales, an HR system for recruitment, and a project management tool. Mary receives an email about the impending EU AI Act and realises she doesn't know which of their existing tools use AI.

Before: Mary and her team use the CRM's lead scoring, unaware it's AI-driven and potentially biased if not properly configured. Their HR system's CV screening tool, also AI-powered, might unconsciously favour certain demographics due to its training data. They're using these systems effectively, but without understanding the underlying AI, they cannot assess potential risks or ensure fairness, leaving them exposed to compliance issues under the new Act.

After: Mary dedicates a few hours over a week to investigate. She asks her CRM and HR system providers if their tools use AI and for which functions. She learns the CRM's lead scoring uses AI to prioritise prospects, and the HR system uses AI for initial CV filtering. She adds these findings to a simple spreadsheet: 'System Name: CRM', 'Owner/Dept: Sales', 'Purpose: Lead Prioritisation', 'Internal/Third-Party: Third-Party', 'Data Type: Customer data', 'Vendor: [CRM Vendor Name]', 'High-Risk Candidate? (Y/N): Potentially (if personal data dictates decisions)'. She repeats this for the HR system. This simple inventory immediately clarifies where AI is in use and highlights areas for further investigation regarding potential high-risk applications as defined by the EU AI Act.

What could go wrong

• Overlooking 'hidden' AI: Assuming your business doesn't use AI because you haven't built it yourself, missing the AI embedded in third-party software.
• Ignoring data implications: Failing to understand what types of data your AI systems process, which determines their risk level under the Act.
• Lack of internal ownership: No one person or team being accountable for understanding and monitoring AI use across departments.
• Reactive panic: Waiting until the last minute to assess AI usage, leading to rushed decisions and potential non-compliance.

What to try this week

1. Start a simple AI inventory: Create a spreadsheet with columns for 'System Name', 'Owner/Dept', 'Purpose', 'Internal/Third-Party', 'Data Type', 'Vendor', and 'High-Risk Candidate? (Y/N)'.
2. Audit your top 5-10 tools: List the primary software your business relies on (e.g., CRM, HR, marketing platform) and for each, visit the vendor's website or check their knowledge base for mentions of AI features. If unsure, contact their support.
3. Identify data processing: For each system, consider what kind of data it handles – is it personal customer data, employee information, or public statistics? This will be crucial for assessing risk later.

Understanding what AI your business already uses is the only way to effectively prepare for the regulations ahead.