AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
The EU AI Act sorts AI uses into four levels: banned practices, high-risk uses with strict duties, uses with transparency duties such as chatbots, and minimal-risk uses with no new rules. Most small-business AI agents fall into the transparency or minimal levels, but AI literacy duties already apply, and high-risk rules for areas such as credit scoring and recruitment apply from 2 December 2027.
Why the risk level matters
The EU AI Act (Regulation (EU) 2024/1689) does not regulate "AI" as one thing. It regulates uses of AI according to how much harm they could cause. A small business's first job is therefore not to read the whole Act, but to work out which level each of its AI uses falls into. That decides whether the Act asks almost nothing of you, a few clear things, or a great deal.
The Act can apply to businesses outside the EU when their AI systems are used in the EU or their outputs are used there. This article is general information, not legal advice.
The four levels
| Level | What it covers | What it means |
|---|---|---|
| Unacceptable risk | Practices such as harmful manipulation, social scoring, emotion recognition in workplaces and schools, and untargeted scraping to build facial recognition databases | Banned |
| High risk | Uses in areas such as employment and worker management, access to essential private services such as credit scoring, education, critical infrastructure and biometrics | Strict duties for providers and deployers: risk management, data quality, logging, documentation, human oversight |
| Transparency risk | Systems that interact with people, such as chatbots, and generated content such as deepfakes | Disclosure duties: people should know they are dealing with AI |
| Minimal or no risk | Most AI in use, such as spam filters | No new rules under the Act |
The European Commission notes that the vast majority of AI systems currently used in the EU fall into the minimal-risk category.
Key dates after the AI Omnibus
The Act entered into force on 1 August 2024 and applies in stages. A simplification package known as the AI Omnibus, proposed in November 2025, reached political agreement in May 2026 and entered into force on 27 July 2026, changing some dates.
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (the first eight) and AI literacy duties |
| 2 August 2025 | Rules for general-purpose AI models and governance |
| 2 August 2026 | General application, including transparency rules and enforcement by the AI Office and national authorities |
| December 2026 | A ninth prohibition, added by the Omnibus, on AI that generates non-consensual intimate content or child sexual abuse material |
| 2 December 2027 | High-risk rules for uses in sensitive areas listed in Annex III, such as employment, credit scoring and education |
| 2 August 2028 | High-risk rules for AI built into regulated products listed in Annex I |
What a typical small business must do now
AI literacy
Article 4 requires providers and deployers of AI systems to take measures to support the AI literacy of their staff and others who operate AI on their behalf, taking account of their knowledge, experience and the context of use. It does not require any specific level of literacy for each person. For a small business, this usually means a short briefing for anyone who works with the agents: what they do, where they stop, what to check, and how to escalate.
Transparency
Article 50 requires AI systems intended to interact directly with people to be designed so that people are told they are interacting with an AI system, unless that is obvious from the context. If your support agent talks to customers in the EU, say so clearly at the start.
Check for high-risk uses
List every AI use and ask whether it falls into an Annex III area. Common small-business examples that could: screening job applicants, evaluating staff performance, and assessing individuals' creditworthiness. If so, you would be a deployer of a high-risk system from 2 December 2027, with duties under Article 26 including using it according to the provider's instructions, assigning trained human oversight, monitoring it, and keeping its logs for at least six months.
Worked example (illustrative)
A Dublin-based e-commerce brand with twelve staff uses an AI support agent, an agent that chases invoices and a tool that drafts product descriptions. Its review finds:
- Support agent: transparency duty. The chat now opens by saying it is an AI assistant and how to reach a person.
- Invoice chasing: minimal risk under the Act, though data protection law still applies.
- Product descriptions: minimal risk.
- Planned use of AI to rank job applicants: high risk from December 2027. The brand decides to keep shortlisting with people for now.
- All staff using the tools get a one-hour briefing, recorded as its AI literacy measure.
For more on finance-specific uses, see the EU AI Act: what finance teams need to know. For the human oversight the Act expects, see human in the loop or on the loop.
The Act is not the only rule
Even where the AI Act asks nothing, data protection law applies to personal data your agents process, and consumer protection law applies to what they tell customers. A minimal-risk label does not mean no rules; see automated decisions about customers.
Where Pryme fits
Pryme Business agents are built to make oversight practical whatever the risk level: each works inside a mandate with a ceiling, every action is recorded with its source, and above the ceiling a person decides. The Compliance agent keeps an obligations register, which can hold AI Act review dates beside your other filings. Classifying your own uses remains your decision.
Questions people ask
Does the EU AI Act apply to small businesses?
Yes, it applies by use rather than by size, though the Act includes support and some simplified requirements for SMEs. Most small-business uses fall into the transparency or minimal-risk levels.
Is an AI customer support agent high-risk?
Usually not. It typically has a transparency duty: people should be told they are interacting with AI unless it is obvious. It could become high-risk if used to decide access to essential services, such as credit.
When do the high-risk rules start?
After the AI Omnibus, rules for high-risk uses in Annex III areas such as employment, credit scoring and education apply from 2 December 2027, and for AI in regulated products from 2 August 2028.
What is the AI literacy duty?
Under Article 4, providers and deployers must take measures to support the AI literacy of staff who operate AI on their behalf, suited to their role and context. It has applied since 2 February 2025.
Sources
- European Commission: AI Act - risk levels and application timeline · accessed Oct 2026
- AI Act Service Desk: Article 4, AI literacy · accessed Oct 2026
- AI Act Service Desk: Article 50, Transparency obligations · accessed Oct 2026
- AI Act Service Desk: Article 26, Obligations of deployers · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.