The EU AI Act for SMEs: what applies now and what is still to come?
5 min read
Short answer
For most small and mid-sized companies, the obligations under the EU AI Act are manageable, because they deploy AI rather than provide it. Since 2025: promote staff AI literacy and avoid prohibited practices. Since August 2026, transparency obligations apply. Strict rules for high-risk systems, for example in recruitment, apply from December 2027.
What does this mean for your company? Book an intro call
Few laws cause as much uncertainty among small and mid-sized companies as the EU AI Act. The good news first: typical applications such as drafting texts, reading documents or sorting emails fall into the low-risk category. For them, the obligations are manageable and easy to implement.
Are you a provider or a deployer?
The regulation mainly distinguishes between providers, who develop an AI system or place it on the market under their own name, and deployers, who use an AI system under their own authority. Most small and mid-sized companies are deployers.
Be careful with custom development: if you have a system built specifically for you and use it under your own name, you may count as a provider yourself. For low-risk applications this has little effect, for high-risk systems it matters a great deal.
Which obligations already apply?
AI literacy (Art. 4 AI Act). Since February 2025, companies using AI must look after their staff's AI literacy. Since late July 2026, the Digital Omnibus has softened this obligation: what is required are measures that promote AI literacy, without having to guarantee a specific level. In practice that means a short training, clear rules, and documenting both.
Prohibited practices (Art. 5 AI Act). Certain applications have been banned since February 2025, for example emotion recognition in the workplace, except for medical or safety reasons, or manipulative techniques that influence people to their detriment.
Transparency (Art. 50 AI Act). Since 2 August 2026, people should be able to tell when they are talking to an AI, for example a chatbot. Deceptively realistic AI-generated images, videos or audio must be labelled. The same applies to AI texts meant to inform the public on matters of public interest, unless a person takes editorial responsibility for them. More on chatbots in Is an AI chatbot on your website worth it?
What is still to come?
The Digital Omnibus, in force since 27 July 2026, postponed the obligations for high-risk systems:
- From 2 December 2027: standalone high-risk systems, such as AI for selecting applicants, evaluating employees, assessing creditworthiness or in critical infrastructure.
- From 2 August 2028: AI built into regulated products, such as machinery or medical devices.
Two cases matter most for SMEs: AI in HR work, and manufacturers that build AI into their products. In both cases it pays to prepare now, with legal advice.
What should you do now?
- List your AI tools: which tools are in use, for what, with which data?
- Rules and training: the basics are in ChatGPT at work.
- Check for high-risk use: are there applications in HR, lending or your products?
- Do not forget data protection: the GDPR continues to apply regardless of the AI Act. More in Using AI in line with data protection.
Julius Launhardt helps small and mid-sized companies use AI safely and proportionately: inventory, rules and training. This does not replace legal advice. More on the IT, data and AI security page.
Frequently asked questions
Does the EU AI Act apply to small companies too?
Yes, there is no general exemption by company size. For typical SME applications, however, the obligations are manageable: promote AI literacy, ensure transparency and avoid prohibited practices.
Do I have to label every AI-generated text?
No. Labelling is required mainly for published texts on matters of public interest if no person reviews them and takes editorial responsibility. Internal drafts and reviewed texts are usually not covered.
Was the AI Act postponed?
Partly. The so-called Digital Omnibus moved the obligations for high-risk systems to December 2027 and August 2028. The AI literacy obligation, the prohibitions and the transparency obligations still apply.
May I use AI to select job applicants?
In principle yes, but such systems count as high-risk. Strict requirements apply from December 2027. Anyone planning this today should take the rules into account early and seek legal advice.