EU AI Act for SMEs: duties and deadlines

The EU AI Act for SMEs in one sentence: if you use AI, you need to know how risky each system is, train your people to work with AI, and disclose where AI is in play. For most small and mid-sized businesses that is doable, not threatening.

This piece frames the essentials: what the law is, whether it affects you, which deadlines apply and what to do now. Important: this is orientation, not legal advice. For your specific case, talk to a specialist lawyer or your data protection officer.

The EU AI Act is the EU's first comprehensive AI regulation. It came into force in August 2024 and applies in stages over several years. At its core is a risk-based approach: the higher the risk an AI application poses to people, the stricter the obligations. Four classes:

• Prohibited practices. Social scoring or manipulative systems, for example. Banned since February 2025.
• High-risk systems. AI in hiring, lending or critical infrastructure, for instance. Strict obligations apply here.
• Limited risk. Chatbots, for example. The main duty here is transparency: people must know they are talking to AI.
• Minimal risk. The large majority of applications, such as back office automation. Barely any extra obligations.

Most likely as a deployer, not a provider. The strict obligations land mainly on providers who develop high-risk AI. If you only use AI, your duties are much lighter: train your people (more on that shortly), be transparent where AI interacts with people, and check whether an application falls into the high-risk class at all.

For the typical small business automating proposals, reporting or customer service, this is usually minimal or limited risk. The panic that sometimes gets spread is unfounded for these cases.

The most important deadline for almost everyone is already here: since February 2025, the AI literacy obligation applies. If you use AI in your business, you have to make sure your own people have a basic understanding of what the systems can do, where their limits are and how to use them responsibly. The strict high-risk obligations mostly take effect from August 2026, some later still.

Four steps that are enough for most small businesses:

1. Take inventory. List which AI tools and automations you run and what for.
2. Classify the risk. For each application, judge whether it is minimal, limited or high-risk. When in doubt, get expert advice.
3. Train your people. A basic understanding of AI across the team has been mandatory since February 2025 and is worthwhile anyway.
4. Stay transparent. Where customers interact with AI, say so. It is simple and it builds trust.

Data protection always belongs in the mix. How AI and GDPR fit together is in is AI GDPR compliant, and the full picture is in our guide to AI automation for SMEs.

The fines are steep, at the top end up to 35 million euros or 7 percent of global annual revenue for prohibited practices. But that hits extreme cases, not cleanly run back office automation. Not sure which class your applications fall into? Book a free call and we will classify your automations with you. And as a reminder: this is orientation, not legal advice.