Picture the operations director of a 40-person software reseller in Dublin, reading yet another headline about AI rules being “delayed”. She has a website chatbot, a CV-screening add-on in her recruitment tool and a team using ChatGPT daily. She wants one plain answer about the EU AI Act for SMEs: what does it ask of a firm like hers, and when?
Here is the short version. As of October 2026, transparency duties for chatbots and AI-generated content already apply. So does a softened duty to support staff AI literacy. The heavier rules for high-risk systems, such as AI used in hiring or credit decisions, come later. After the EU’s Digital Omnibus moved them back, they start on 2 December 2027 or 2 August 2028.
Where the law stands in October 2026
The AI Act entered into force on 1 August 2024 and phases in over several years. Then, in November 2025, the European Commission proposed a simplification package, usually called the Digital Omnibus on AI. Negotiators reached political agreement in May 2026, according to the Commission’s AI Act policy page.
That package is now law. The EU adopted it as Regulation (EU) 2026/1744 of 8 July 2026. It entered into force on 27 July 2026. In other words, the delays are no longer a proposal or a rumour; they bind.
Crucially, the Omnibus did not pause everything. The general application date of 2 August 2026 still held for most of the Act, including the transparency rules in Article 50. Only the high-risk obligations moved, plus a few targeted changes.
The four risk tiers, in plain English
The Act sorts AI systems by risk rather than by technology. According to the Commission, it defines four levels, and your obligations depend on which one each tool falls into.
| Tier | Examples given by the Commission | What it means for you |
|---|---|---|
| Unacceptable risk | Social scoring, untargeted facial image scraping, emotion recognition at work or in schools | Banned outright |
| High risk | CV-sorting for recruitment, credit scoring, exam scoring, safety components in transport | Strict duties, now from December 2027 or August 2028 |
| Transparency risk | Chatbots, AI-generated content, deepfakes | Tell people, label content; applies now |
| Minimal risk | Spam filters, AI in video games | No new rules under the Act |
The Commission says most AI in use in the EU falls into the minimal tier. For a typical smaller firm, therefore, the practical work concentrates on two places: anything customer-facing, and anything that judges people.
What the EU AI Act for SMEs requires right now
Transparency for chatbots and generated content
Article 50 applies from 2 August 2026. Under the text of Article 50, providers must design systems that talk directly with people to inform them. Those people must know they are dealing with AI. The exception is where that is obvious to a reasonably well-informed person.
The same article covers synthetic media. Providers of systems that generate audio, images, video or text must mark outputs in a machine-readable way. Meanwhile, deployers who publish deepfakes must disclose them, and the information must reach people no later than the first interaction or exposure.
Note the split between roles. If you build your own chatbot, you are likely a provider. If you switch on a vendor’s tool, you are usually a deployer. Either way, a clear “you are chatting with an AI assistant” message costs little and covers the common case. For generative systems already on the market before 2 August 2026, the Omnibus gives providers until 2 December 2026 to meet the content-marking duty.
AI literacy, softened
The original Article 4 required firms to ensure a sufficient level of AI literacy among staff. The amended version now asks providers and deployers to take measures to support that literacy. That is the reading of the AI Act Explorer run by the Future of Life Institute. It does not require any guaranteed level for individuals.
So a short internal guide, a training session and a named contact for questions are a sensible, proportionate response. The amended text also requires the Commission to publish practical examples, with extra support aimed at SMEs.
Prohibited practices
The bans have applied since 2 February 2025. Furthermore, the Omnibus added a new ban. It covers AI systems that generate non-consensual intimate imagery or child sexual abuse material, from 2 December 2026. Few ordinary businesses go near these uses, but the emotion recognition ban at work catches some HR and call-monitoring tools.
What waits until 2027 and 2028
The high-risk rules are where the real compliance burden sits: risk management, data quality, logging, documentation and human oversight. Under the Omnibus, high-risk systems listed in Annex III, which covers areas such as employment, education and credit, must comply from 2 December 2027. Systems embedded in regulated products, such as machinery or toys, follow on 2 August 2028.
For most smaller firms, you will be a deployer rather than a provider of these systems. Deployers must follow the provider’s instructions, assign trained people to oversee the system and monitor how it performs. They must also keep automatically generated logs for at least six months and inform workers before using such a system at work.
The delay is a window, not a reprieve. If your recruitment platform ranks candidates, or your lending tool scores applicants, the vendor will need conformity work done before December 2027. Ask them now how they plan to get there.
Relief the EU AI Act for SMEs actually includes
The Act does carry some proportionality for smaller companies, and the Omnibus extended it. The EU’s SME definition covers firms with fewer than 250 staff and turnover up to €50 million or a balance sheet up to €43 million. The Omnibus also brought a new category, small mid-caps, into some of the same measures.
The main reliefs, as described in the amended text, are:
- Simplified technical documentation. SMEs and small mid-caps that provide high-risk systems may use a simplified form, which the Commission will create.
- Proportionate quality management. Quality management obligations scale to the size of the provider.
- Priority sandbox access. Each member state must run at least one regulatory sandbox by 2 August 2027, with priority for SMEs.
- Lower fine ceilings. Under Article 99, an SME faces whichever is lower: the percentage or the fixed amount.
Those ceilings are still large. For prohibited practices, the maximum is €35 million or 7% of worldwide annual turnover. For most other breaches it is €15 million or 3%; the difference for an SME is simply that the lower figure applies.
Provider or deployer: why your role matters
Much of the EU AI Act for SMEs turns on one question: did you build the system, or did you buy it? The Act calls the builder a provider and the user a deployer. Providers carry most of the documentation and testing duties. Deployers carry fewer, but they still matter.
The line can blur. For example, if you put your own brand on a vendor’s high-risk system, or change its intended purpose, you may become a provider yourself. Likewise, a firm that trains a custom model and sells it to clients has crossed into provider territory.
So record your role next to each tool. It decides which articles you read, which questions you ask suppliers and how much paperwork follows. Most smaller businesses will find they are deployers almost everywhere.
Does it apply to a UK or US business?
Often, yes. The Act reaches providers that place AI systems on the EU market, wherever they sit. It also covers providers and deployers outside the EU when people in the Union use the system’s output.
A UK firm running a chatbot for customers in France or Ireland should therefore treat Article 50 as live. Consequently, the simplest approach for cross-border firms is to apply EU-standard disclosure everywhere rather than run two versions of the same tool.
A practical EU AI Act for SMEs checklist
Adoption is rising fast, which makes the inventory step more urgent than it sounds. According to Eurostat in December 2025, 20% of EU enterprises with ten or more employees used AI technologies in 2025, up from 13.5% in 2024.
- List every AI tool in use. Include features switched on inside existing software, not just new purchases. Our piece on finding the AI agents you already run explains why this list is usually longer than expected.
- Tag each one by tier. Most will be minimal risk; flag anything customer-facing or anything that assesses people.
- Fix disclosure now. Add a clear AI notice to chatbots, voice agents and AI-written public content.
- Document literacy measures. Record the training, guidance and contact person you provide.
- Question high-risk vendors. Ask how they will meet the December 2027 deadline and what they will need from you.
- Name an owner. One person should keep the list current and track guidance from the AI Office.
If the difference between a chatbot and an agent matters for your list, our explainer on how agents differ from chatbots sets out the line. Partners such as Riophany build disclosure and escalation into customer-facing agents from the start. Still, the inventory itself is a job any operations lead can begin this week.
A smaller job than the headlines suggest
For most smaller firms, the AI Act turns out to be a disclosure exercise today and a supplier conversation for 2027. The heavy machinery of conformity assessments mostly lands on the companies that build high-risk systems, not on those that buy them.
Back in Dublin, the operations director’s to-do list ends up short. It holds one chatbot banner, one training note and one pointed email to her recruitment software vendor. The law is long; her part of it is not.
Frequently asked questions
Has the EU AI Act been delayed?
Partly. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moved high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products. Transparency duties under Article 50 still applied from 2 August 2026.
Do small businesses have to comply with the EU AI Act?
Yes, the Act applies regardless of company size, but obligations depend on the risk level of each AI system and your role as provider or deployer. Most AI tools used by small firms fall into the minimal-risk tier with no new rules. Customer-facing chatbots and AI-generated content carry transparency duties.
What fines can SMEs face under the AI Act?
Maximum fines reach €35 million or 7% of worldwide turnover for prohibited practices, and €15 million or 3% for most other breaches. For SMEs, Article 99 caps each fine at whichever of the two figures is lower. The Omnibus extended a similar cap to small mid-cap companies.
Does the EU AI Act apply to UK companies?
It can. The Act covers providers placing AI systems on the EU market wherever they are based, and providers or deployers outside the EU whose system’s output is used in the EU. A UK business serving EU customers with a chatbot should meet the Article 50 transparency rules.