The AI Act for SMEs: your obligations and how to prepare
Guide to the EU AI Act for SMEs: what affects you if you use AI, deadlines after the Digital Omnibus, penalties and a five-step action plan.
AI inventory · compliance
Writing assistant Minimal
Website chatbot Limited
CV screening High
AI literacy (Art. 4)
AI notice in the chatbot (Art. 50)
High-risk system assessmentBefore 2 Dec 2027
Neural Soft Updated 9 min read
Key points
The AI Act also applies to whoever uses AI, not just whoever builds it; almost every SME is a "deployer".
Staff AI literacy (Art. 4) and transparency (Art. 50) already apply.
High-risk uses, such as screening CVs, have obligations from 2 December 2027.
To get started, an inventory, a short usage policy and role-based training are enough.
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689, known as the AI Act) is the world’s first general law on AI. Many SMEs think it only affects whoever develops models like ChatGPT, but that is not the case: anyone who uses AI systems in their business also has obligations, even when the tool is bought in.
The good news is that, for most SMEs, the obligations are reasonable and can be met with some order and a bit of training. Here is the summary on one page; the detail follows below.
Visual guide · Regulation (EU) 2024/1689
The AI Act for SMEs on one page
What affects you, when, and where to start if your company uses AI, even an off-the-shelf tool.
01 · Your role
Do you build AI or use it?
Provider
Develops an AI system and sells it or puts it into service under its own name.
Almost every SME
Deployer
Uses an AI system in its business: a chatbot, Copilot, an assistant that sorts emails…
02 · Risk levels
The use is regulated, not the technology
ProhibitedCannot be usedSocial scoring, detecting employees’ emotions, manipulation
High riskStrict obligations (Dec 2027)Screening CVs, assessing employees, personal creditworthiness
TransparencySay it is AIChatbots, generated images, audio or video
MinimalAI literacy onlySummarising, drafting, sorting emails, extracting invoice data
Most uses in an SME are minimal risk or transparency.
03 · Timeline
It applies in phases
Prohibitions and AI literacy
General-purpose models
Transparency (Art. 50)
Marking generated content
High risk (Annex III)
High risk (Annex I)
You are here
Today · Nov 2026
Prohibitions and AI literacy
In force
General-purpose models
In force
Transparency (Art. 50)
In force
Today · Nov 2026
Marking generated content
Upcoming
High risk (Annex III)
Upcoming
High risk (Annex I)
Upcoming
04 · What to do now
Five steps to get up to date
1
1. Inventory
Which AI is used, what for and with what data
2
2. Classify
Each use, at its risk level
3
3. Usage policy
Approved tools and forbidden data
4
4. Train the team
By role, and keep a record
5
5. Transparency
Chatbot notice and labelled content
05 · Penalties
€35M or 7 %
of worldwide turnover: maximum fine for prohibited practices. €15M or 3% for other breaches.
The AI Act assigns obligations according to each company’s role:
Provider: develops an AI system (or has it developed) and places it on the market or puts it into service under its own name or brand. For example, a software company selling a recruitment tool with AI.
Deployer: uses an AI system under its authority in the course of its professional activity. For example, an accountancy firm using an assistant to classify emails, or an online shop with a customer service chatbot.
Almost all SMEs are deployers. If you also develop an AI solution to sell to others, you will be a provider of that product too.
The four risk levels
The Regulation does not regulate the technology itself, but how it is used. The higher the risk to people, the more obligations.
Level
Examples
What it means
Unacceptable (prohibited)
Social scoring, manipulation that exploits vulnerabilities, emotion recognition at work or in school, biometric categorisation based on sensitive data
Cannot be used
High risk
CV screening, assessing employee performance or promotion, creditworthiness of individuals, access and assessment in education
Strict obligations for the provider and for the deployer
Limited risk (transparency)
Chatbots, AI-generated or manipulated content (images, audio, video, deepfakes)
Disclose that it is AI
Minimal risk
Spam filters, document summaries, writing help, extracting data from invoices
No specific obligations beyond AI literacy
Most everyday uses in an SME (drafting, summarising, classifying emails, searching internal documentation, extracting data from documents) are minimal or limited risk.
Which level is each of your company’s uses at?
Go through this tree for each AI tool or use. It is a simplification, but it quickly shows where to pay attention.
The timeline after the Digital Omnibus
The AI Act entered into force on 1 August 2024, but it applies in stages. In 2026, the European Union approved the so-called Digital Omnibus on AI, which postpones the obligations for high-risk systems and keeps the rest of the timeline.
2 February 2025: prohibitions (Article 5) and the AI literacy obligation (Article 4). Already applicable.
2 August 2025: obligations for general-purpose AI models (large language models) and the penalty regime.
2 August 2026:transparency obligations (Article 50) and market surveillance.
2 December 2026: end of the transition period for technical marking of content generated by systems already on the market.
2 December 2027:high-risk systems in Annex III (employment, education, credit, essential services…).
2 August 2028: high-risk systems embedded in regulated products (Annex I: machinery, medical devices, toys…).
In other words: AI literacy and transparency already affect you today, and if you use AI in HR or in decisions about customers, you have until the end of 2027 to prepare.
What already affects you if you use AI in your company
AI literacy (Art. 4)
People who use AI on your behalf must have sufficient knowledge for their role. No official qualification is required, but you must be able to show what you have done: training, usage guidelines, materials.
Transparency (Art. 50)
A chatbot must make clear it is an AI, unless that is obvious.
Generated images, audio or video that look real: you must say so.
AI-generated text informing the public on matters of public interest: also, unless it has had human review with editorial responsibility.
Prohibitions (Art. 5)
Rare for an SME, but there is one typical case: systems that "detect emotions" in employees (in video calls or at the workplace) are prohibited except for medical or safety reasons.
The GDPR is still there
If an AI tool processes personal data, you still need a legal basis, a data processing agreement, information for data subjects and, where the risk is high, an impact assessment.
Even though the deadline has been postponed, the tool you buy today will still be in use in 2028. It is worth asking the vendor now how they plan to comply.
Penalties
The maximum fines are high: up to 35 million euros or 7% of worldwide turnover for prohibited practices, and up to 15 million or 3% for breaching other obligations. For SMEs, the lower of the two amounts applies. In Spain, the supervisory authority is the Spanish Agency for the Supervision of Artificial Intelligence (AESIA).
Beyond fines, the real risk for an SME is usually different: losing a large customer that requires compliance from its suppliers, or reputational damage from careless use of data.
Five-step action plan
Build an inventory of the AI tools used in the company, including those people use on their own (ChatGPT, browser extensions, AI features in the CRM…). Note what they are used for and what data they handle.
Classify each use by risk level, with the tree above. Most will be minimal risk; flag those that touch HR, customers or decisions about people.
Write a short usage policy: which tools are approved, which data is never entered (customers’ personal data, confidential information) and who reviews what gets published.
Train the team according to their role and keep a record of the training. It is the obligation that already applies and the one that reduces risk the most.
Review contracts and transparency: data processing agreements with vendors, a notice on the chatbot and labelling of synthetic content.
If you do not know where to start, our AI maturity test includes governance questions and gives you a first steer in three minutes.
In short
For a typical SME, complying with the AI Act today means knowing which AI is used, setting some simple rules and training the team. Doing it well does not just avoid problems: it brings order to how AI is used and makes it easier to get value from it.
Does using ChatGPT or Copilot at the office oblige me to do anything?
Yes, AI literacy: the team must know how to use it with judgement (limits, errors, data that must not be entered). As general productivity use, it is minimal risk.
Do I have to register my AI tools anywhere?
As a deployer of minimal or limited-risk systems, no. Registration in the EU database mainly affects providers of high-risk systems and certain uses by public authorities.
Does the AI Act apply if my AI vendor is based in the United States?
Yes. It applies to systems placed on the market or used in the European Union, whatever the provider's country.
We help small and medium-sized businesses find where AI can add value, which cases are worth testing and how to start without investing in solutions they do not need.
We use Google Analytics to see which pages are visited. Its cookies are only set if you accept; if you decline, Google only receives cookieless signals. You can change this at any time from the footer. Cookie policy
