The EU AI Act for SMEs: what has applied since August 2026

What the EU AI Act is

The EU AI Act is Regulation (EU) 2024/1689, the EU’s Artificial Intelligence Act. It was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. It follows a risk-based approach with four tiers: unacceptable (prohibited) risk, high risk, limited risk with transparency obligations, and minimal risk. Since 27 July 2026 it applies as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744).

The timeline: what applies when

• 1 August 2024: the regulation enters into force.
• 2 February 2025: the prohibited AI practices (Art. 5) and the AI literacy obligation (Art. 4) apply.
• 2 August 2025: the obligations for general-purpose AI models (GPAI), the governance rules and the penalty provisions apply.
• 27 July 2026: the Digital Omnibus on AI enters into force. Among other things, a softened version of Art. 4 has applied since then.
• 2 August 2026: the regulation applies generally, including the transparency obligations under Art. 50 (chatbots, AI-generated content, deepfakes). National authorities have been supervising compliance since then.
• 2 December 2026: providers of generative AI systems already on the market before 2 August 2026 must have implemented machine-readable marking under Art. 50(2). Two new prohibitions in Art. 5 apply from the same date.
• 2 December 2027: the high-risk obligations for systems under Annex III apply (postponed by the Digital Omnibus, originally 2 August 2026).
• 2 August 2028: the high-risk obligations for AI in regulated products under Annex I apply (originally 2 August 2027).

Digital Omnibus: what changed in 2026

The EU eased the AI Act before its strictest obligations even took effect. The Commission presented the proposal on 19 November 2025, the Council and Parliament reached a political agreement on 7 May 2026, Parliament approved it on 16 June 2026 and the Council on 29 June 2026. Regulation (EU) 2026/1744 of 8 July 2026 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The core change: the high-risk obligations arrive considerably later, the other deadlines stay.

• High-risk systems under Annex III (for example certain HR or credit applications): obligations apply from 2 December 2027 instead of 2 August 2026.
• AI as a safety component of regulated products under Annex I: from 2 August 2028 instead of 2 August 2027.
• AI literacy (Art. 4): instead of ensuring a sufficient level of AI literacy, providers and deployers must now take measures to support its development. They are expressly not required to guarantee any specific level for any individual; the Commission and Member States are to support SMEs in particular.
• New prohibitions from 2 December 2026: AI systems that generate or manipulate realistic intimate depictions of identifiable people without their explicit consent, or child sexual abuse material.
• Not postponed: the transparency obligations under Art. 50. They have applied since 2 August 2026; only providers of generative systems already on the market have until 2 December 2026 for machine-readable marking.
• Relief for SMEs and, newly, for small mid-cap enterprises (SMCs): simplified technical documentation and proportionate quality management for providers of high-risk systems, plus priority access to AI regulatory sandboxes.

What it means for SMEs that only use AI

Most small and medium businesses are deployers, not providers. They use finished AI tools rather than developing and placing their own AI systems on the market. That reduces obligations considerably, but it does not exempt you from everything.

• AI literacy (Art. 4): deployers too must take measures to support the AI literacy of their staff and of other people working with AI systems on their behalf, tailored to prior knowledge and context of use. According to the European Commission’s questions and answers, no certificate is needed; training and guidance can be recorded internally. The obligation has applied since 2 February 2025, in this version since 27 July 2026.
• Prohibited practices (Art. 5): certain uses are banned outright, such as manipulative or certain biometric approaches. The two new prohibitions are added from 2 December 2026.
• Transparency (Art. 50): anyone offering their own chatbot or publishing deepfakes and AI texts has information and labelling duties (see below).
• High-risk use: if you use an AI system in a high-risk area (for example certain HR applications under Annex III), the deployer obligations under Art. 26 apply from 2 December 2027: use in line with the instructions for use, human oversight by competent people, control of input data where you control it, keeping the automatically generated logs for at least six months, and informing affected employees and their representatives beforehand.

When you turn from user into provider

Careful: under Art. 3(3), a provider is anyone who develops an AI system or has it developed and places it on the market or puts it into service under their own name or trademark. That can already be your own chatbot built on a third-party language model, for example for the notice duty under Art. 50(1). For high-risk systems, Art. 25 also sets out when deployers become providers with considerably broader obligations: if they offer a high-risk system under their own name or trademark, substantially modify it, or change a system’s intended purpose so that it becomes high-risk. Anyone offering an AI product under their own brand should check this early.

Transparency: labelling chatbots and AI content (Art. 50)

• Chatbots (Art. 50(1)): people must be told that they are interacting with an AI system. This does not apply where it is obvious from the circumstances to a reasonably well-informed, observant and circumspect person. The duty lies with the provider of the system.
• Machine-readable marking (Art. 50(2)): providers of generative AI systems must mark generated audio, image, video and text content in a machine-readable way as artificially generated or manipulated. This mainly concerns the makers of the tools, not their users.
• Deepfakes and texts on matters of public interest (Art. 50(4)): deployers, which includes you as a user, must disclose that deepfakes have been artificially generated or manipulated. For evidently artistic, satirical or fictional works, a notice that does not hamper enjoyment of the work is enough. AI texts published to inform the public on matters of public interest must be labelled unless a human has reviewed them and someone holds editorial responsibility.
• The information must be provided clearly and distinguishably at the latest at the first interaction or exposure and must meet the accessibility requirements (Art. 50(5)).

Supervision in Germany and fines

In Germany, the AI Market Surveillance and Innovation Promotion Act (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG) has been in force since 29 July 2026. It designates the Federal Network Agency (Bundesnetzagentur) as the central market surveillance authority for the AI Act; other bodies remain responsible for certain areas, such as BaFin for AI at supervised financial firms. With its AI Service Desk, the Bundesnetzagentur offers information and an online tool for risk classification, explicitly also for SMEs. The ranges for fines are set by the AI Act itself (Art. 99):

• Prohibited practices: up to 35 million EUR or 7 percent of worldwide annual turnover.
• Breaches of other obligations, for example as a deployer or under Art. 50: up to 15 million EUR or 3 percent.
• Incorrect, incomplete or misleading information to authorities: up to 7.5 million EUR or 1 percent.
• As a rule the higher of the two amounts applies; for SMEs including start-ups, the lower one. Since the Digital Omnibus the lower amount also applies to small mid-caps, except for prohibited practices. When penalties are set, the interests and economic viability of SMEs must be taken into account.

The second lever: the GDPR

The AI Act does not replace the GDPR, both apply in parallel. As soon as your AI processes personal data, data protection comes into play. The GDPR itself is unchanged: the amendments the Commission proposed in November 2025 in a separate Digital Omnibus package, including for AI, have not been adopted as of September 2026. Three points matter most in practice:

• Automated decisions (Art. 22 GDPR): a person has the right not to be subject to a solely automated decision with legal or similarly significant effect. The Court of Justice of the EU reads this as a prohibition in principle, with exceptions (contract, legal authorisation, explicit consent) and safeguards such as the right to human intervention. In practice: for consequential decisions, a human stays in the loop.
• Processing on behalf (Art. 28 GDPR): if an external service (such as an LLM provider) processes personal data on your instructions, you need a data processing agreement with the legally required minimum content.
• Third-country transfers (Art. 44 ff. GDPR): if data goes to the US, you need a legal basis. For US providers certified under the EU-US Data Privacy Framework there has been an adequacy decision since 10 July 2023; for non-certified providers EU standard contractual clauses plus supplementary measures are usually required.

How to implement this GDPR homework in practice, from tier choice via the data processing agreement to the team AI policy, is shown step by step in the guide Using ChatGPT and co. in line with the GDPR.

Practical steps for SMEs

• Get an overview of which AI is actually in use at your company, including hidden inside existing tools.
• Build AI literacy in your team: short training tailored to the tools you use and clear guidance, recorded internally. Art. 4 requires it, and it pays off anyway.
• Check chatbots and published AI content against the information and labelling duties under Art. 50, which have applied since 2 August 2026.
• Sign a data processing agreement with AI service providers wherever personal data is involved.
• For sensitive data, consider EU hosting or locally operated models.
• Keep a human in the loop for decisions with consequences.

This is exactly where I come in as part of my AI automation services: I integrate AI where it delivers concrete value and clarify its purpose, risk and transparency and labelling duties with you beforehand. I handle the technical implementation; the legal assessment stays with you. Language models EU-hosted or local, answers with source references from your own knowledge base, and you at the decision points.