AI Features for Small Businesses: What's Useful and What the Rules Say

The AI features that pay off for small businesses are narrow ones with a person in the loop: draft replies someone checks before sending, incoming requests sorted automatically, a search that answers only from your own content, forms that pre-fill details from an uploaded document. The risky option is an open chatbot expected to give binding answers about prices, deadlines or services around the clock.

Before you commission anything, check whether the software you already use offers the feature. Whether you buy or build, two rules apply in Germany: if personal data is involved, you will usually need a processing agreement with the AI provider under the GDPR, and under the EU AI Act people must be able to tell when they are interacting with an AI system.

What AI can realistically do in a website or web app

"AI" here usually means large language models: systems that read and generate text, accessed through a provider's API (application programming interface, the way one piece of software talks to another). They are good at summarising, rephrasing, translating and classifying text. They can also produce answers that sound right and are wrong.

That gives a simple rule. The more likely a person checks the output before it has consequences, and the more tightly the feature is limited to your own content, the better it suits a first step. Germany's data protection authorities make the same point in their guidance: AI output involving personal data must be checked for accuracy before it is used further.

Use cases compared

The last row is there on purpose. Small businesses should not start there without legal advice. Depending on the use, for example in employment, such systems can also fall under the AI Act's high-risk rules, which carry much heavier obligations.

Checklist for any AI use case

Run through this list for each idea before you buy a tool or commission a feature.

• What exact task should the feature handle, and how is it done today?
• What happens if the output is wrong? Who notices, and when?
• Does a person check the output before it goes out or decides anything?
• What data goes to the AI provider? Is there personal data it doesn't need?
• Is there a data processing agreement with the provider under Art. 28(3) GDPR?
• Does the provider use your inputs and outputs to train its models, and can that be switched off?
• Is data transferred outside the EU, and on what basis?
• Does the feature make decisions about people with legal or similarly significant effects? If so, a person decides, not the system.
• Will users know they are interacting with AI, at the latest at first contact?
• Is the feature described in your privacy policy (Datenschutzerklärung)?
• Is there an existing service that already does this well?
• What does each use cost in API fees, and who keeps an eye on it?

Existing tool or custom AI feature?

Many tools you probably already use, for email, office work, customer support or e-commerce, now include AI features. For drafts, summaries and translations, that is often the simplest route. Check the same points there: processing agreement, training on your data, where data is stored.

A custom feature is more likely to make sense when the AI needs access to your own data and has to sit inside a specific workflow, for example sorting enquiries from your website form and assigning them to the right person in your web app. A custom AI feature is almost always one component of an application, not the whole product. If your requests or jobs still live in a spreadsheet, read Replacing a Spreadsheet with a Web App: When It's Worth It first.

To keep the first version of a feature like this small, see Web App MVP: Which Features Belong in Version One?.

Data protection: what German regulators recommend

The Datenschutzkonferenz (DSK), the body of Germany's data protection authorities, published guidance on AI and data protection in May 2024. Four points matter most for small businesses:

• Processing agreement: if you use an external provider's AI application, for example as a cloud service, for your own purposes, the DSK says there is often a processor relationship, which requires an agreement under Art. 28(3) GDPR.
• Training: from a data protection point of view, the DSK says applications that do not use inputs and outputs for training are preferable.
• No fully automated final decisions: under Art. 22 GDPR, decisions with legal effect may in principle only be made by people. If AI prepares suggestions, the person deciding must have real discretion.
• Check accuracy: results involving personal data must be checked before they are processed further.

The usual principles apply too: a legal basis for processing (Art. 6 GDPR), and no more data than necessary. Leave names, health details or contract specifics out of prompts if the task works without them.

The AI Act: transparency duties and timing

The AI Act distinguishes two roles. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its authority in a professional context. If you use an off-the-shelf tool, you are usually a deployer. If you have a custom chatbot built and offer it under your own name, you may count as a provider. If in doubt, get legal advice on your role.

The Article 50 transparency duties most relevant to small businesses:

• Interacting with AI (para. 1): providers must design systems that interact directly with people so that those people are informed they are dealing with AI, unless that is obvious to a reasonably well-informed, observant person. In practice: label a chatbot clearly as AI, even if you are only the deployer.
• Deepfakes and public-interest text (para. 4): deployers must disclose that deepfake image, audio or video content is artificially generated or manipulated. AI-generated text published to inform the public on matters of public interest must also be disclosed, unless it has been reviewed by a person and someone holds editorial responsibility.
• Timing (para. 5): the information must be given clearly and distinguishably, at the latest at the first interaction or exposure.

On timing: according to the European Commission, the transparency rules took effect in August 2026, while the AI literacy obligations and the first prohibitions have applied since 2 February 2025. The Commission states that the so-called AI Omnibus, which amends the AI Act, entered into force on 27 July 2026. For providers' marking obligations for AI-generated content under Art. 50(2), a round-up by the law firm McCann FitzGerald reports a postponement to 2 December 2026. We have not verified that date in the Official Journal ourselves, so rely on the official text or legal advice for your planning.

What an AI feature costs

AI features add running costs on top of the one-time development: the AI provider usually charges per use, plus hosting and maintenance. Those costs depend heavily on how often the feature is used and how much text it processes. The general cost drivers of a web app are explained in How Much Does a Custom Web App Cost in Germany?.

For context: Ichii also develops and runs its own products with AI features, such as Raumy: users upload a photo of a room and receive AI-generated redesigns they can adjust by style, colours, materials and furniture. For client work, small and clearly defined web apps start at €1,999 net (plus VAT), one-time, with a fixed quote based on the agreed features. That entry price does not cover AI products in general. Running costs for AI usage, hosting and technical maintenance (from €29 a month) are separate, and model training or complex platforms are outside that scope.

Your next step

Pick the one use case from the table that would save you the most time and run it through the checklist. Then check whether your existing software already covers it. If it doesn't, and the feature belongs inside your own workflow, describe it with the web app brief template and send us an enquiry about a web app.