EU AI Act SMB Guide: What Small and Mid-Sized Businesses Must Do

The EU AI Act is no longer a distant proposal. It entered into force on 1 August 2024, and the European Commission's own regulatory framework page now lists bans and AI literacy duties as already applying, transparency rules from August 2026, and high-risk rules from December 2027. For a small or mid-sized business, the practical question is not whether the law exists but which parts touch you, and when.

Most smaller firms are deployers, meaning they use AI systems built by someone else, rather than providers who build and sell them. That distinction decides most of your workload. This guide walks through the risk tiers, the revised timeline after the 2026 Digital Omnibus, what deployers must do, and the relief written into the Act for smaller companies. It is general information, not legal advice, so check your specific position with a qualified adviser.

Quick answer

For an SME using third-party AI, the EU AI Act mainly means four things: avoid the banned practices, keep records of AI literacy measures, tell people when they are talking to an AI, and meet extra duties only if you use AI in high-risk areas such as hiring. Those high-risk duties now start on 2 December 2027.

How the EU AI Act sorts AI into risk tiers

The Act is built on risk, not on technology. The Commission's regulatory framework page describes four categories: unacceptable risk, high risk, limited risk (transparency duties) and minimal risk. Where your tools sit in that ladder determines almost everything you have to do.

Unacceptable risk covers practices that are banned outright. The Commission says the Act prohibits nine practices, including social scoring, harmful manipulation and real-time remote biometric identification by law enforcement in public spaces. The ninth, covering non-consensual intimate content and child sexual abuse material, was added by the Omnibus. Almost no ordinary SME use case comes near these, but you should still check that no tool you buy does anything resembling them.

High risk covers systems that can seriously affect health, safety or fundamental rights, with the Commission listing areas such as critical infrastructure, education, employment, essential services, law enforcement, migration and justice. These systems face strict requirements on risk management, data quality, logging, documentation, human oversight, robustness, cybersecurity and accuracy. For SMEs the most common route into this tier is employment: CV screening, candidate ranking and staff monitoring tools.

Limited risk is the transparency tier. The Commission gives the example of telling people when they are interacting with a chatbot, and says generative AI content must be identifiable, with deepfakes and certain public-interest text labelled. Minimal risk, such as spam filters or AI in video games, has no specific obligations under the Act.

A useful first exercise is a simple inventory. List every AI tool your business uses, including features hidden inside software you already pay for, and place each one in a tier. Most firms find the majority land in minimal or limited risk, with a small number needing closer attention. An AI audit does exactly this kind of mapping.

The timeline after the Digital Omnibus

The original dates have shifted. According to law firm Lewis Silkin's summary of the Digital Omnibus on AI, the amending regulation was published in the Official Journal on 24 July 2026 and took effect on 27 July 2026. That ended months of uncertainty about whether the high-risk deadline would really move.

Here is where the main dates now stand, based on the Commission's framework page and that summary:

The delay is a deferral, not a cancellation. If you plan to buy or build anything in the employment or credit space, the safest approach is to design for the 2027 requirements now rather than retrofit later.

What deployers must do

If you use someone else's AI, you are a deployer, and your duties are lighter than a provider's but not zero. They fall into three groups: literacy, transparency and, for high-risk systems only, operational controls.

AI literacy

Article 4 asks providers and deployers to take measures to support AI literacy among their staff and others who operate AI systems on their behalf. The Commission's AI literacy questions and answers confirm the duty applies from 2 February 2025, that supervision and enforcement by national authorities begin on 2 August 2026, and that no certificate is needed. Keeping an internal record of training and awareness activity is enough.

The Omnibus softened the wording. As Lewis Silkin's analysis explains, there is no requirement to guarantee a sufficient level of literacy for each individual, so documenting your programme is the practical focus. A short written AI usage policy plus a brief training session and a log of attendance is a sensible, proportionate response for a small team.

Transparency

Article 50 sets the disclosure rules. A Greenberg Traurig briefing on the Commission's draft guidelines says interactive systems must be designed so users are informed of the artificial, non-human nature of the interaction, and that the disclosure must happen at the moment of contact rather than being buried in terms and conditions. The same briefing notes the draft guidelines are non-binding and were published in May 2026, so final versions may refine the detail.

The legal duty sits primarily with the provider, but if you deploy a chatbot, voice agent or email assistant that talks to customers, you should treat clear disclosure as your responsibility too. Put a plain statement at the start of the chat or call, and make it easy to reach a human.

High-risk operational duties

If you use a high-risk system, Article 26 applies. According to the text of Article 26, deployers must use the system in line with the provider's instructions, assign human oversight to people with the competence, training and authority to do it, and check input data where they control it. They must also monitor operation and report risks or serious incidents, keep automatically generated logs for at least six months where they control them, and inform workers and their representatives before using the system in the workplace.

Where a high-risk system makes or assists decisions about individuals, you must also tell those people it is being used. This is why recruitment is the area to watch. Our own guide to AI for HR covers where automation is low risk and where it needs human sign-off.

Penalties, and what changes for smaller firms

Fines are large on paper. Under Article 99, prohibited practices can attract fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Breaches of most other obligations, including deployer duties and transparency rules under Article 50, can reach EUR 15 million or 3%. Supplying incorrect or misleading information to authorities can reach EUR 7.5 million or 1%.

The important point for SMEs is the cap. The same article says that for SMEs and start-ups each fine is limited to the lower of the percentage and the fixed amount, rather than the higher. The Omnibus extends this lower-of rule to small mid-cap companies for the second and third tiers of fines, as set out in the Article 99 text. Penalties must still be proportionate and effective, so this is a ceiling, not a licence.

SME provisions written into the Act

The Act contains several measures aimed at smaller firms. The Irish Department of Enterprise's SME test summary lists them, and they include priority access to regulatory sandboxes, a simplified technical documentation form for small and micro enterprises, lower penalty thresholds, and proportionate conformity assessment. It also notes that Member States must set up communication channels to answer SME queries, and that the Commission must give particular attention to SME needs in its implementation guidelines.

The Omnibus widened some of this support. Lewis Silkin reports that sandbox priority access now extends to small mid-cap enterprises, and that national authorities have until 2 August 2027 to establish at least one AI regulatory sandbox. If you are building rather than just buying AI, a sandbox is worth investigating in your home market.

These measures reduce cost, but they do not remove obligations. A small company that uses a high-risk system for hiring is still a deployer with real duties.

A practical compliance plan for an SME

You do not need a large legal team to get this right. A sensible sequence for a company of 10 to 250 people looks like this.

Data protection sits alongside all of this. The AI Act does not replace GDPR, and the two interact whenever personal data goes into a model. Our guide to GDPR and custom AI agents covers that overlap, and the piece on AI agent security and prompt injection covers the technical safeguards that support the Act's robustness and cybersecurity expectations.

How Klevere approaches AI Act readiness

Klevere builds custom AI agents for small and mid-sized businesses, with 500+ agents deployed across 50+ projects and 12 industries. We are not a law firm and we do not offer legal advice, but we design agents with the Act's logic in mind from the first scoping call.

In practice that means we start by mapping what the agent will do and who it will affect, so the risk tier is clear before anything is built. We design disclosure into customer-facing agents, keep a human in the loop for decisions that touch people, and log agent actions so you have an audit trail. We also try to keep agents narrow, because a tightly scoped agent is easier to document, oversee and defend than a general-purpose one. For failure scenarios worth planning around, see our piece on what can go wrong with AI agents in production.

If you want an outside view of where your current tools sit, the free AI audit is a good starting point, and the article on what an AI audit covers explains the process. Where a specific legal question arises, we recommend you take it to a qualified adviser in your jurisdiction.

Frequently asked questions

Does the EU AI Act apply to small businesses outside the EU?

Yes, it can. The Act applies based on where the AI system is placed on the market or where its output is used, not only where your company is based. A non-EU business serving EU customers with an AI-powered service should assume the Act is relevant and check its role as provider or deployer with a qualified adviser.

When do the high-risk rules actually start?

After the Digital Omnibus, stand-alone high-risk systems listed in Annex III, such as recruitment and credit scoring tools, are covered from 2 December 2027. High-risk AI embedded in regulated products, such as medical devices, follows on 2 August 2028. The earlier August 2026 date no longer applies for these systems.

Do I need an AI literacy certificate for my staff?

No. The Commission's AI literacy FAQ states that no certificate is needed. You are expected to take reasonable measures to support literacy among people who operate AI systems for you, and keeping an internal record of training and awareness activity is enough evidence for most small firms.

Is my customer service chatbot high risk?

Usually not. A standard customer support chatbot normally falls under limited risk, where the main duty is telling people they are interacting with an AI system. It could become higher risk if it makes decisions in a listed area, such as access to essential services. Check the use case, not the technology.

What are the fines for an SME that breaks the AI Act?

The headline maximums are up to EUR 35 million or 7% of turnover for banned practices and up to EUR 15 million or 3% for most other duties. For SMEs, Article 99 caps each fine at the lower of the percentage and the fixed amount. Authorities must still apply proportionate penalties.

Who enforces the AI Act on SMEs?

National market surveillance authorities in each Member State supervise most obligations on businesses, including AI literacy. The Commission says enforcement powers are shared between the AI Office and national authorities from 2 August 2026, and the AI Office can fine providers of general-purpose AI models.

The Act rewards organisations that know what AI they use and why. If you would like help mapping your tools, risks and next steps, start with a free AI audit.