What the EU AI Act means for SMEs

Which dates already apply?

The Act came into force in stages. This is the order:

Date	What came into force
2 February 2025	The ban on unacceptable applications (Article 5) and the AI literacy obligation (Article 4)
2 August 2025	Rules for providers of general-purpose AI models
2 August 2026	Most rules, including the transparency obligations in Article 50
2 December 2027	The rules for high-risk AI such as recruitment and selection (Annex III)
2 August 2028	The rules for AI in products such as machines and medical devices (Annex I)

The obligation that has applied longest is straight away the most important one for an ordinary company: AI literacy, since February 2025.

Which risk class does my use fall into?

The Act does not look at the technology but at what you do with it. For an SME it usually comes down to this.

Minimal risk. Spam filters, stock forecasting, reading invoices in automatically, a summary of your mailbox. No special obligations apply here apart from AI literacy. By far the most SME use sits here.

Limited risk. A chatbot that speaks to customers, or texts on your website made by AI. An information obligation applies here: the other party has to know they are dealing with AI.

High risk. Assessing or selecting applicants, determining creditworthiness, marking exams. A considerable package of obligations comes with this. If you use AI to rank CVs, you are in this category — even if you only get ten applications a year.

What does AI literacy involve?

Article 4 asks you to take measures so that everyone who works with AI inside your company has enough knowledge of the possibilities and the risks; since 27 July 2026 that is an obligation of means. There is no exam in the law and no compulsory number of hours. What it does say: the approach has to suit the size of your company and what you do with AI, and you have to be able to show that you have done something about it.

In practice that comes down to three things:

1. A list of what you use. Which AI tools are running, with whom, for what.
2. An explanation per role. Someone in administration needs different knowledge from someone in sales.
3. A note that it happened. Date, participants, subjects. One sheet of A4 is enough.

That third point is where it usually goes wrong. There is an explanation, but nothing is written down — and then you have nothing to show.

What do I have to tell my customers?

Since August 2026 the transparency obligations in Article 50 apply. Three cases:

• If a customer talks to a chatbot or a voice assistant, it has to be clear that it is not a person.
• If you publish text, images or sound made by AI, a mention belongs with it.
• A deepfake always has to be recognisable as one.

Note the difference from what many people think: a mail you prepared with AI and then checked and sent yourself is your mail. The obligation is about publication and about automated contact, not about your own tools.

What happens if you do not comply?

Article 99 names two ceilings per kind of infringement: an amount and a percentage of worldwide annual turnover.

Infringement	Fine up to	Or up to
A prohibited application (Article 5)	€35,000,000	7% of worldwide annual turnover
Most other obligations	€15,000,000	3% of worldwide annual turnover
Incorrect or misleading information to the supervisory authority	€7,500,000	1% of worldwide annual turnover

For large undertakings the higher of the two applies. For SMEs and for start-ups, Article 99(6) turns that around: there the lower of the two applies. For a company with a turnover of ten million, a prohibited application therefore means at most seven hundred thousand, not 35 million.

More important than the fine is what a customer or an accountant asks. "How do you safeguard that?" has become a normal question in a tender.