# The EU AI Act for SMEs: what to do, and by when

URL: https://casterconsulting.hu/en/eu-ai-act-smes-what-to-do/
Published: 2026-10-15
Updated: 2026-10-15
Author: Caster Consulting

> If your company uses Claude, ChatGPT, Copilot or Gemini, the EU AI Act asks less of you than you might fear, but not nothing. Three things already apply: supporting your staff's AI literacy, staying clear of prohibited practices and being transparent.

**Short answer: if your company only uses the big AI tools, the AI Act asks far less of you than the headlines suggest.** No certificate, no registration, no legal department. Three things, however, already apply: supporting your staff's AI literacy, staying clear of prohibited practices and being transparent. The heavy rules only reach you if you use AI in hiring or credit decisions, and those deadlines moved back in the summer of 2026.

In smaller companies we keep seeing one of two reactions. Panic ("ban ChatGPT until legal has looked at it") or calm indifference ("this is for Big Tech"). Both are wrong. The first costs you a competitive edge. The second leaves an easy obligation undone, and that is hard to explain once someone asks.

## What the AI Act is, and who it applies to

The AI Act (Regulation (EU) 2024/1689) regulates artificial intelligence by risk: the more harm a system can do, the more its makers and users have to do. It separates two roles, and you need to know which one you are in:

- **Provider:** whoever develops an AI system and places it on the market under their own name. Anthropic, OpenAI, Microsoft and Google are providers. So are you, if you sell your own AI product.
- **Deployer:** whoever uses an AI system in their own operations. A typical SME is a deployer: it drafts proposals with Claude or ChatGPT, summarises meetings with Copilot, translates with Gemini.

Most obligations sit with providers. As a deployer your list is short. But if you build your own chatbot on top of an API and put it on your website for customers, you may count as a provider on some points. Go through it system by system.

## The deadlines after the 2026 amendment

The AI Act entered into force on 1 August 2024, but its rules apply in stages. In July 2026 the EU changed the timetable: Regulation (EU) 2026/1744, the AI part of the "Digital Omnibus", entered into force on 27 July 2026 and pushed several dates back.

| From | What | Does it affect you? |
|---|---|---|
| 2 February 2025 | prohibited practices, AI literacy (Article 4) | yes |
| 2 August 2025 | providers of general-purpose AI models | no, this is for model developers such as Anthropic and OpenAI |
| 2 August 2026 | general application, transparency (Article 50), enforcement begins | yes, if you use chatbots or generated content externally |
| 2 December 2026 | new prohibitions; marking of generated content for systems already on the market | partly |
| 2 December 2027 | high-risk systems under Annex III (e.g. recruitment, creditworthiness) | only if you use AI for these |
| 2 August 2028 | high-risk systems in products (Annex I) | rarely |

The point: **what affects an ordinary SME is already partly in force.** The delay for high-risk systems does not mean there is nothing to do until then.

## The three things that already apply

### 1. AI literacy: support it, don't guarantee it

Article 4 originally required companies to "ensure" a sufficient level of AI literacy among their staff. The 2026 amendment softened this. Providers and deployers must now **take measures to support the development of AI literacy** of their staff and anyone using AI systems on their behalf, taking into account their technical knowledge, experience, education and the context of use. The text states explicitly that the obligation does not require anyone to guarantee a specific level of AI literacy for any individual.

That is good news, but not a free pass. If anyone asks, you need to show that you **did something**. In practice that is little work:

- a one-page internal guide on what AI may and may not be used for in your company;
- a 60 to 90-minute internal session on common failure modes (made-up facts, data protection, copyright);
- one named person staff can ask.

Document it. An email listing participants and the date is already evidence. Repeat the session when a new tool arrives or new people join; one session in 2025 will not cover a team that has changed since.

### 2. Prohibited practices

Article 5 lists AI uses that are simply banned. Most SMEs never come near them, but one is worth knowing: **emotion recognition in the workplace is prohibited**, except for medical or safety reasons. If a tool promises to analyse your team's mood from calls or video meetings, don't buy it. Manipulative systems, systems exploiting vulnerabilities and "social scoring" are banned too.

### 3. Transparency

Article 50 applies from 2 August 2026. For an SME it matters in two situations:

- **A chatbot for customers.** If AI answers visitors on your website, they must know they are talking to a machine, unless that is obvious. A clear label is enough.
- **Generated images, audio or video.** If you publish realistic content made with AI (a deepfake), you must disclose that it was artificially generated. Generative systems already on the market have until 2 December 2026 to add machine-readable marking.

Internal use (summaries, draft emails, translation) is not covered.

## When you become "high-risk"

This is where the real line is. Annex III lists, among others, two areas that matter to smaller companies:

- **employment:** filtering CVs, ranking candidates, supporting decisions on promotion or dismissal;
- **creditworthiness:** evaluating the creditworthiness of natural persons.

If an HR tool ranks applicants with AI, deployers will have serious obligations from 2 December 2027: use the system according to the provider's instructions, ensure human oversight, keep the logs and inform the employees concerned. If you are about to buy such a tool, ask the vendor now how they will comply. The purchasing decision happens today; the obligation lands fourteen months later.

## What SMEs get as relief

The 2026 amendment includes concessions for smaller companies, mainly those that build AI themselves:

- simplified technical documentation;
- a proportionate quality management system;
- priority access to regulatory sandboxes;
- for small mid-caps, fines capped at the lower of the percentage and the fixed amount.

Under Article 4, the Commission and the Member States must also help SMEs build AI literacy, and the Commission publishes practical examples.

## Who enforces it

Each Member State designates its own market surveillance authority and a single point of contact, and sets national fines within the limits of the regulation. The Commission's AI Office supervises the general-purpose model providers. In practice this means your contact point depends on where you operate. Hungary, for example, has named the minister responsible for enterprise development as its market surveillance authority, with fines set in forint. If you operate in several countries, check each national designation; the Commission's AI Act Service Desk is the best starting point.

## Four common myths

**"The AI Act is only for Big Tech."** Most obligations do sit with providers, but AI literacy and the prohibitions apply to every deployer, regardless of size. A ten-person company is a deployer if its staff use AI at work.

**"The 2026 amendment postponed everything."** It did not. It mainly moved the high-risk deadlines and softened the AI literacy wording. The prohibitions have applied since February 2025, and the transparency rules since August 2026.

**"If we ban AI, there's no risk."** This is the most expensive answer. Bans rarely work: people carry on with free personal accounts on their own phones, only now without rules or oversight. The risk does not shrink; it just becomes invisible.

**"It's enough if the vendor complies."** The vendor answers for its own obligations. What your people use the tool for, and whether visitors know your chatbot is a machine, is on you.

## What we see

In companies where we talk about AI, the law is rarely the bottleneck. Much more often, nobody knows exactly who uses which AI tool, and for what. Staff work with free personal accounts and paste in client names and contract details, and management has no idea. That is a data protection and business risk more than an AI Act one, but the fix is the same: an inventory, a rule and some training.

In that sense the AI Act is a useful push. Take the AI literacy duty seriously and you deal with shadow AI at the same time.

## What to do now

1. **Make an inventory.** Which AI tools does the company use, who uses them, and for what? Half an hour in a spreadsheet.
2. **Decide your role per system.** Are you a deployer, or do you also put your own AI product in front of customers?
3. **Write a one-page AI policy.** What is allowed, what isn't, which data must never be pasted in, which company account to use.
4. **Run a short training session and document it.** That is your evidence of AI literacy measures.
5. **Review customer-facing AI.** Chatbot, generated images or video: are they labelled?
6. **If you plan HR or credit-scoring AI, ask the vendor now.** The 2027 deadline depends on today's purchase.
7. **Put an annual review in the calendar.** Tools, people and rules change. Once a year, revisit the inventory and the policy, and refresh the training when a new tool arrives.

If you want someone to walk through this list with your team in a morning and leave you with a usable policy, have a look at our [AI solutions](/en/ai-solutions/) or our [IT consulting](/en/it-consulting/).

## FAQ

### Do we need a licence or registration to use Claude or ChatGPT in our company?

No. Using a general-purpose AI tool internally requires no licence, registration or certificate. Supporting AI literacy and avoiding prohibited practices still apply to you.

### What exactly does the AI literacy obligation mean in 2026?

Since the 2026 amendment, it means taking measures to support your staff's AI literacy. You don't have to guarantee a particular level. An internal guide and a documented training session are usually a sound starting point.

### When do the high-risk rules apply?

For Annex III systems (such as recruitment or creditworthiness) from 2 December 2027, and for systems built into products from 2 August 2028. Regulation (EU) 2026/1744 moved both dates.

### Who enforces the AI Act?

National market surveillance authorities designated by each Member State, plus the Commission's AI Office for general-purpose model providers. Your contact point depends on the country you operate in.

### Do we have to label a blog post written with AI?

Article 50 requires disclosure for AI-generated text published to inform the public on matters of public interest, unless a human has reviewed it and someone holds editorial responsibility. A company blog post that a colleague reviews and approves usually falls outside it, but transparency never hurts.

## Sources

- [AI Act Service Desk – Article 113: Entry into force and application](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113)
- [AI Act Service Desk – Timeline for the implementation of the EU AI Act](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act)
- [AI Act Service Desk – Article 4: AI literacy](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4)
- [European Commission – Navigating the AI Act (FAQ)](https://digital-strategy.ec.europa.eu/en/faqs/navigating-ai-act)
- [NicFab – Digital Omnibus on AI: Regulation (EU) 2026/1744 Is Published in the Official Journal](https://www.nicfab.eu/en/posts/digital-omnibus-ai-official-journal/)
- [ERTICO – Digital Omnibus on AI Enters into Force](https://ertico.com/digital-omnibus-on-ai-enters-into-force)