The EU AI Act for SMEs: what applies when

The EU Artificial Intelligence Act (AI Act) is the world's first comprehensive law on AI. For many small and mid-sized companies it causes more uncertainty than it should. Most businesses that use AI for everyday tasks such as writing, search, customer service or document processing face a manageable set of duties. The heavy obligations apply to a narrow group of high-risk systems.

In 2026 the EU also changed the timeline. The so-called Digital Omnibus on AI, in force since 27 July 2026, postponed the high-risk deadlines. This article sorts out what applies when, and what you should do now.

This article is general information, not legal advice. For your specific case, consult a lawyer.

Provider or deployer: which role do you have?

The AI Act distinguishes two main roles:

• Provider: you develop an AI system, or have one developed, and place it on the market or put it into service under your own name. A software company selling an AI feature is a provider.
• Deployer: you use an AI system in your business under your own authority. A company using an AI assistant for its support team is a deployer.

Most SMEs are deployers. If you have a custom AI system built for internal use, you are usually the deployer and may also be treated as the provider, so clarify the roles in your development contract.

The four risk levels

1. Prohibited practices. Some uses are banned outright, such as social scoring, manipulative techniques that exploit vulnerabilities, untargeted scraping of facial images and emotion recognition in the workplace or in schools (with narrow exceptions).

2. High-risk systems. AI used in sensitive areas listed in the Act, for example recruitment and staff management, credit scoring, education, critical infrastructure, and AI that is a safety component of regulated products such as machinery or medical devices. These systems need risk management, data governance, documentation, human oversight, logging and, for providers, a conformity assessment.

3. Limited risk with transparency duties. Chatbots must tell users they are talking to an AI. AI-generated or manipulated images, audio and video (deepfakes) must be labelled, and providers of generative AI must mark output in a machine-readable way.

4. Minimal risk. Spam filters, AI in internal search, translation, most document processing. No specific duties beyond the general ones.

Most SME use cases fall into levels 3 and 4.

Timeline: what applies when

• Since 2 February 2025: prohibited practices are banned. Companies are also expected to ensure that staff who work with AI have sufficient AI literacy; the 2026 amendment emphasises support for SMEs here, but training your people remains the sensible standard.
• Since 2 August 2025: obligations for providers of general-purpose AI models (the large model vendors) and the penalty regime.
• Since 2 August 2026: transparency duties under Article 50 (chatbot disclosure, deepfake labelling, marking of AI-generated content). Generative systems already on the market before that date have until 2 December 2026 to add machine-readable marking.
• From 2 December 2027: obligations for stand-alone high-risk systems (Annex III), such as AI in recruitment or credit scoring. Originally planned for August 2026, postponed by the Digital Omnibus.
• From 2 August 2028: obligations for high-risk AI embedded in regulated products (Annex I), such as machinery or medical devices. Originally August 2027.

Important: the Omnibus moved deadlines, it did not remove the rules. If you plan an AI system in a high-risk area now, design for the requirements from the start. Retrofitting documentation, logging and human oversight later is far more expensive.

What changed for SMEs

The Digital Omnibus also extended relief that previously applied only to SMEs to small mid-cap companies: simplified documentation, priority access to regulatory sandboxes and proportionate fines. Fines under the Act are high in theory (up to 35 million euros or 7% of worldwide turnover for prohibited practices), but for SMEs the lower of the two amounts applies.

Checklist for SMEs that use AI

1. Make an inventory. List every AI tool and feature in use, including AI inside software you already pay for. Note the purpose, the department and what data goes in.
2. Classify each use. Is it minimal risk, a transparency case or possibly high-risk (for example, AI that pre-selects job applicants)?
3. Check for prohibited uses. Rare in practice, but check for emotion recognition of employees or similar features in HR or monitoring tools.
4. Implement transparency. Chatbots on your website or in your app must say they are AI. Label AI-generated images and videos where the rules require it.
5. Train your people. A short internal guideline and training on what tools may be used, with which data, and how outputs are checked.
6. Align with the GDPR. The AI Act does not replace data protection. Personal data in prompts and documents still needs a legal basis, a data processing agreement with the vendor and, where needed, a data protection impact assessment.
7. Clarify contracts. For custom AI, define in the contract who is provider, who documents what, and how logging and human oversight work.

Checklist for SMEs that build AI products

If you sell software with AI features, you are a provider. In addition to the points above:

• Assess whether your product falls into a high-risk area, now and in the roadmap.
• Build transparency in: disclosure in the interface, machine-readable marking for generated content.
• Keep technical documentation from the start: model choice, data sources, evaluation results, known limitations.
• Plan logging and human oversight into the architecture, not as an afterthought.

How we approach this in projects

When we build AI assistants, agents or computer-vision systems, we document model choices, data sources and evaluation results as part of normal engineering, offer EU hosting or self-hosted models, and design human oversight into the workflow. That makes compliance a by-product of good engineering rather than a separate project. More in our article on RAG assistants over your own documents and on our AI development page.

Discuss your AI project