The EU AI Act for SMEs:what applies now

Why another article on the AI Act

The AI Act entered into force in August 2024, but its rules apply in phases. This summer the EU changed the timeline with the Digital Omnibus, a package that simplifies and postpones parts of the law. Many articles online still describe the old dates. This is what we know in October 2026.

We are not lawyers. We build AI into the software companies use every day, and clients ask us what the law means for them. This is the answer we give, with links to the official texts at the bottom. For decisions with legal weight, check with a lawyer.

First: what is your role?

The AI Act distinguishes between providers, who develop an AI system and put it on the market, and deployers, who use an AI system in their work. Most SMEs are deployers. When you use a tool that reads incoming mail, an assistant that answers from your files or an agent that drafts reminders, you are using AI, not selling it.

That matters, because the heaviest obligations sit with providers. If you have software built for your own use, the builder takes on part of the provider role for that system. Agree in writing who does what.

Four levels of risk

The law sorts AI by risk. A small number of uses are forbidden, such as social scoring or manipulating people in harmful ways. High risk uses, such as AI that screens job applicants, assesses creditworthiness or decides on access to education, come with strict requirements. Some uses only carry transparency duties. Everything else, which is most business use, has no specific obligations beyond the general ones.

Reading and linking mails, drafting replies, following up deadlines or answering questions from your own files are not high risk. A tool that ranks job applicants or decides who gets a discount on a loan is a different story.

What already applies

Since 2 February 2025 the forbidden practices are banned, and companies that use AI must take measures to support the AI literacy of the people who work with it. The Digital Omnibus kept that duty, but made clear that it is about taking measures, not about guaranteeing a level of knowledge per person. The European Commission and the member states have to support SMEs in this.

Since 2 August 2026 most of the other rules apply, including transparency. People must know when they are dealing with an AI system, AI generated content has to be marked, and deepfakes must be labelled. For generative AI systems that were already on the market before that date, the technical marking duty moved to 2 December 2026. From that same date, systems that generate intimate images of real people without consent are banned.

The fines are not small: up to €35 million or 7% of worldwide turnover for forbidden practices, and up to €15 million or 3% for most other violations. For SMEs the lower of the two amounts applies.

What moved to later

The Digital Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the rules for high risk systems listed in Annex III of the law, such as recruitment, credit and education, from 2 August 2026 to 2 December 2027. High risk AI that is part of regulated products, such as machines or medical devices, moved to 2 August 2028. The deadline for member states to set up regulatory sandboxes moved to August 2027.

Postponed is not cancelled. If you plan to use AI in hiring or in decisions about people, the requirements are coming, and building them in now is cheaper than adding them later.

What an SME should do this year

Make a list of the AI tools people use, including free ones in the browser. For each tool, write down what it is used for and which data goes in.

Agree on short guidelines: which tools are approved, which data may never be shared outside them, and who to ask when in doubt. Give people a short training on how the tools work and where they go wrong. That covers the core of AI literacy, and you can show what you did.

Check whether any use touches the high risk list, especially anything around hiring, evaluating staff or deciding about customers. And when you publish content made with AI, or let customers chat with an AI, make sure that is clear to them.

When you have AI built

When AI is built into your own software, ask the builder how the system logs what it does, how people approve what matters and how you can show where an answer came from. Those are good practices for any system, and they are exactly what the law asks for higher risk uses. A system built that way does not need to be rebuilt when the rules get stricter.