WhatsApp and the AI Act: what changed for small firms this autumn

Over the summer we warned that WhatsApp replies would stop being free on 1 October, and that the EU AI Act was about to be trimmed back. Both have now happened, and both arrived with small print that changes the takeaway. If you run a small business and use WhatsApp through a provider or an AI agent, or your staff work with AI tools, here's what actually landed and what's worth doing before the end of the year.

WhatsApp: the charge is here, with 1,000 replies of headroom

First, so nobody panics: this only applies to the WhatsApp Business Platform (the API) that providers, CRMs and automated agents plug into. If you answer by hand from the free WhatsApp Business app on your phone, nothing has changed.

Since 1 October 2026, Meta charges for each service message you send, meaning the ordinary replies inside the 24-hour window that opens when a customer messages you. It was announced months ahead in Meta's pricing documentation, and the per-message price matches each country's utility template rate.

The part almost nobody saw coming in the summer is the allowance: every business phone number gets 1,000 delivered service messages free each month. You start paying from message 1,001. The allowance resets monthly and doesn't roll over. That's what Meta's pricing page sets out, and it's how providers who've published a breakdown, such as SendPulse, are applying it.

Two more details worth pinning down:

• Utility templates sent inside the window (appointment confirmations, "your order has shipped") are also billed from October. Don't assume they come out of the 1,000 allowance; ask your provider how they're counting them.
• Messages within the 72 hours after someone taps a click-to-WhatsApp ad are still free, as before.

Run the numbers on your own volume

A thousand messages a month sounds like plenty until you spread it out: roughly 45 per working day. Take a physio clinic with one number. About 15 people message each day, and each conversation takes three replies on average. That's 45 messages a day, around 990 a month. Right on the line, and that month it pays nothing.

Now an online shop with 40 enquiries a day and four replies each: 160 messages a day, about 3,500 a month. It pays for roughly 2,500 of them. Depending on the local rate that might be small, but it's now a line on the bill.

The calculation is the one you already know, with one extra step:

1. Ask your provider how many service messages you sent in September, per number.
2. Subtract 1,000 from each number.
3. Multiply whatever's left by the rate Meta publishes for your country.

If you end up below zero, good news: for you, replying is still free. If the figure stings, the lever isn't switching tools, it's resolving in fewer messages: one complete answer instead of three half-answers, with the link or detail the customer was going to ask for next.

An honest warning: because the allowance is per number, someone will suggest opening a second number to double your free messages. Don't, at least not for that reason. Splitting your customer service across two numbers confuses customers, duplicates conversations, and saves you, at best, a few pounds or euros a month. Two numbers make sense if you genuinely run two businesses or two locations, not as an accounting trick.

The AI Act "omnibus" is now in force

The other half of the autumn is European. The simplification package for the AI Act, which Brussels calls the digital omnibus, was adopted as Regulation (EU) 2026/1744, published in the Official Journal on 24 July and in force since 27 July 2026.

The headline was the delay to the high-risk obligations, now 2 December 2027 (and August 2028 for AI built into regulated products). As we said before, unless you screen CVs, score credit or do something similar, that isn't about you. What does touch almost any small business using AI are two quieter changes.

Training your staff: from "ensure" to "support"

Since February 2025, the Act has asked businesses that use AI to take measures to ensure, to the best of their ability, that their staff have a sufficient level of AI literacy. It was a vague line that caused a lot of worry: how do you prove your receptionist "knows enough" about AI?

The omnibus rewrites it. The duty is now to take measures to support that literacy, and the text makes clear it doesn't require guaranteeing any specific level for each person. The Commission and member states are also tasked with helping small businesses, including with practical examples.

Careful: that doesn't mean the obligation has gone. It means you meet it with reasonable, documented steps rather than a certificate. For a team of five or ten, that can be as simple as:

• A one-page usage policy: which tools are allowed, which customer data never gets pasted into them, and who checks anything that goes out.
• An hour of training a year, using examples from your own business, with the date written down.
• A named person to ask when someone's unsure.

If all of that exists and is written down, you have something to show if anyone asks. If everyone on your team uses AI their own way and nobody knows what data is leaving the business, the problem isn't the regulation. It's that you have no shared rules.

2 December: a deadline for your tools, not for you

There's one more date on the calendar, and it helps to know whose it is. The transparency rules that started on 2 August include a duty for providers of generative AI to mark their output (images, audio, video, text) so a machine can detect that it's artificial. The omnibus gives systems already on the market before August until 2 December 2026 to comply.

In plain terms, that's a job for the company selling you the image generator or writing assistant, not for you. The only thing it asks of you is a quick check: if you use a small or lesser-known tool to create content, ask them before December whether they'll be compliant.

What has been yours since August is what we covered in the transparency article: your assistant must say it's an assistant, and generated content that could pass for real needs a label.

What isn't worth your time this autumn

• Opening extra WhatsApp numbers to multiply the allowance. Covered above: the savings don't justify the mess.
• Switching providers over the October prices. If you're near 1,000 messages per number, the difference between providers will be a few euros at most. Check first what your provider charges on top of Meta.
• Expensive AI courses to satisfy Article 4. The new wording asks for proportionate measures. Well-run, documented in-house training is worth more than a generic certificate.
• The new bans that apply from 2 December. The omnibus outlaws apps that generate fake intimate images of real people. A normal business has nothing to review here.

If the numbers show your WhatsApp replies already go past a thousand a month, a receptionist agent that settles each enquiry in fewer messages saves you on both sides: on Meta's bill and on your team's hours. You approve, it executes. And if what worries you is everyone using AI their own way, that's what AI for teams sorts out.