If your company uses ChatGPT to draft emails, runs a chatbot on its website or screens CVs with software that has AI built in, the EU AI Act already applies to you. The good news: for most small and mid-sized businesses, compliance is manageable, as long as you know which parts apply to you and when.
The short answer
- What it is: Regulation (EU) 2024/1689, the EU Artificial Intelligence Act. It applies directly in every EU member state, with no national law needed to make it binding.
- Who it covers: companies that build AI (providers) and companies that use AI at work (deployers). Almost every SME is a deployer.
- What applies today: a ban on prohibited practices (since February 2025), AI literacy for your staff (Article 4) and, since 2 August 2026, telling people when they’re talking to a chatbot and labelling certain AI-generated content.
- What’s coming: the high-risk rules, which cover AI used in hiring or credit decisions, apply from 2 December 2027, after the Digital Omnibus pushed them back.
- Who enforces it: the European Commission’s AI Office for general-purpose AI models (and, since the Omnibus, for AI systems built on a provider’s own model or embedded in very large online platforms), and national authorities for everything else, from August 2026.
What is the EU AI Act?
It’s the world’s first comprehensive law on artificial intelligence. It was published in the EU’s Official Journal on 12 July 2024 (full text on EUR-Lex) and entered into force on 1 August 2024, but its obligations are phased in until 2028.
It doesn’t regulate the technology in the abstract; it regulates uses. The same tool can carry no obligations when it summarises emails and be high-risk when it decides who gets a job interview. So the useful question isn’t “do we use AI?” but “what do we use it for?”.
It also reaches beyond the EU. It applies to non-EU companies that place AI systems on the EU market, and to those whose AI output is used in the EU. A US company offering a chatbot to European customers has to follow the transparency rules.
The four risk levels, with business examples
| Risk level | What it means | Business examples | Applies from |
|---|---|---|---|
| Unacceptable | Banned | Inferring employees’ emotions at work, social scoring, manipulating vulnerable customers | 2 February 2025 |
| High | Allowed, with strict obligations | CV screening, employee performance evaluation, credit scoring, pricing life or health insurance | 2 December 2027 (Annex III) |
| Transparency (limited) | You must disclose | Chatbots and voice agents, realistic AI images or video, AI-written text published to inform the public | 2 August 2026 |
| Minimal | No specific obligations | Drafting emails, meeting summaries, spam filters, translating internal documents | Only Article 4 (AI literacy) |
Most of an SME’s AI use sits in the minimal or transparency tiers. But a single high-risk use case, usually in HR, changes the picture.
Prohibited AI practices (since February 2025)
The European Commission lists nine prohibited practices. The ones most relevant to an ordinary business are:
- Emotion recognition in the workplace and in education, except for medical or safety reasons. Software that analyses your sales team’s tone of voice to “measure their mood” is banned.
- Harmful manipulation or deception, and exploiting vulnerabilities (age, disability, social or economic situation) to influence decisions.
- Social scoring: rating people on their behaviour or personal traits in ways that lead to unfair treatment.
- Biometric categorisation to infer sensitive traits such as sexual orientation, religion or trade union membership.
- Untargeted scraping of facial images from the internet or CCTV to build facial recognition databases.
The Digital Omnibus added a ninth: AI systems that generate non-consensual sexual imagery of real people or child sexual abuse material. It applies from 2 December 2026.
High-risk AI: watch your HR tools
Annex III of the Act classes these uses, among others, as high-risk:
- Employment: AI used to target job ads, filter applications, evaluate candidates, decide promotions or dismissals, allocate tasks based on personal traits, or monitor performance.
- Essential services: AI that assesses individuals’ creditworthiness or credit score, or prices life and health insurance.
- Education: AI that decides admissions, grades exams or monitors students during tests.
- Biometrics and critical infrastructure, plus areas less common for SMEs.
If you use a high-risk system bought from a vendor, your obligations as a deployer (Article 26) from December 2027 will be to:
- Use it according to the provider’s instructions.
- Assign human oversight to people with the training and authority to step in.
- Monitor how it works and suspend it if you spot a risk.
- Keep the logs it generates for at least six months.
- Inform workers’ representatives and affected staff before using it at work.
- Tell people that the system makes, or helps make, decisions about them.
- Carry out a data protection impact assessment where required.
Provider or deployer: which one are you?
This distinction changes your obligations more than anything else:
- Provider: whoever develops an AI system (or has it developed) and places it on the market or puts it into service under their own name. OpenAI, Microsoft and the company selling you recruitment software are providers.
- Deployer: anyone using an AI system in a professional capacity. An estate agency using ChatGPT or a hotel with a website chatbot is a deployer.
Almost every SME is a deployer. But watch out: you can become the provider of a high-risk system without realising it, if you put your brand on it, substantially modify it, or use a general-purpose tool such as ChatGPT for a high-risk purpose, for example building your own CV filter. From then on, the obligations are much heavier.
The full EU AI Act timeline after the Digital Omnibus
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published on 24 July 2026 and entered into force on 27 July 2026. It delayed the high-risk rules and softened Article 4. This is the current timeline:
| Date | What applies |
|---|---|
| 1 August 2024 | The AI Act enters into force |
| 2 February 2025 | Prohibited practices and AI literacy (Article 4) |
| 2 August 2025 | General-purpose AI model obligations, governance and penalty rules |
| 27 July 2026 | The Digital Omnibus enters into force. Article 4 becomes an obligation to take measures to support AI literacy |
| 2 August 2026 | General application: transparency (Article 50), enforcement by the AI Office and national authorities |
| 2 December 2026 | Machine-readable marking of AI-generated content (Article 50(2)) for systems already on the market before August 2026. New ban on non-consensual sexual content |
| 2 August 2027 | General-purpose AI models placed on the market before August 2025 must comply |
| 2 December 2027 | High-risk rules for Annex III uses: employment, credit, education, biometrics… |
| 2 August 2028 | High-risk rules for Annex I: AI built into regulated products (machinery, medical devices, toys…) |
One detail: high-risk systems already on the market before their deadline are only caught if they’re significantly changed afterwards (systems used by public authorities must comply by 2 August 2030 in any case). How your specific tool fits that rule is worth confirming with its vendor.
Is the EU AI Act being delayed? Partly. The high-risk deadlines moved, but the bans, Article 4 and the chatbot transparency rules did not.
Transparency: chatbots and AI-generated content
Since 2 August 2026, Article 50 requires:
- Chatbots and voice agents: people must be told they’re interacting with an AI, at the latest at the first interaction, unless it’s obvious. The duty sits with whoever builds the system, but if your chatbot doesn’t say it, it’s your customers you’ll be answering to.
- Synthetic content: providers of generative AI must mark outputs (text, images, audio, video) in a machine-readable way. Systems already on the market have until 2 December 2026.
- Deepfakes: if you publish AI-generated images, audio or video that look real, you must disclose it. For clearly creative or satirical work, a light-touch mention is enough.
- Public-interest text: if you publish AI-generated text to inform the public, you must disclose it, unless a person has reviewed it and someone takes editorial responsibility.
- Permitted emotion recognition or biometric categorisation: the people exposed must be informed.
For everyday SME marketing (a blog post your team has reviewed, an obviously artistic illustration), the duty is limited. For an advert featuring a realistic-looking person generated by AI, it isn’t.
General-purpose AI models: do they affect you?
General-purpose AI models (GPT, Claude, Gemini, Llama, Mistral…) have had their own obligations since 2 August 2025: technical documentation, information for companies building on them, a copyright policy and a public summary of training content. The most powerful models, those with “systemic risk”, must also assess and mitigate those risks.
These obligations fall on whoever creates the model, not on whoever uses it. If your company uses ChatGPT or builds an agent on a provider’s API, you’re not the model’s provider. What you should do is choose providers that comply and ask them for documentation when you need it.
EU AI Act fines
| Breach | Maximum fine | For SMEs |
|---|---|---|
| Prohibited practices | €35 million or 7% of worldwide turnover, whichever is higher | Whichever is lower |
| Other obligations (high-risk, Article 50 transparency) | €15 million or 3%, whichever is higher | Whichever is lower |
| Incorrect or misleading information to authorities | €7.5 million or 1%, whichever is higher | Whichever is lower |
| General-purpose AI model providers (fined by the Commission) | €15 million or 3%, whichever is higher | — |
For SMEs and start-ups (Article 99(6)), the lower of the two figures applies. The Omnibus extended that rule to small mid-cap companies for the fines in Articles 99(4) and 99(5), and asks authorities to take SMEs’ economic viability into account. Article 4 (AI literacy) has no fine of its own in the Act.
Who enforces it? The AI Office and national authorities
- The AI Office, part of the European Commission, supervises general-purpose AI models and can fine their providers. Since the Omnibus, it also supervises AI systems built by the same provider on its own model (with exceptions such as biometrics) and those embedded in very large online platforms or search engines.
- National market surveillance authorities enforce the rest. In Spain, that’s AESIA (the Spanish Agency for the Supervision of Artificial Intelligence), alongside the data protection authority (AEPD) whenever personal data is involved. Other member states have designated their own authorities.
- Spain’s own AI law lapsed. Spain’s government approved a draft Organic Law on the proper use and governance of AI on 26 May 2026 to set national penalties and split supervision between authorities. It reached Parliament in June, but lapsed when the Cortes were dissolved on 6 October 2026 ahead of the 29 November election. It will have to be reintroduced.
What this means for you: the EU regulation applies regardless, because it doesn’t depend on national law. What’s still pending in some countries is the detail of national penalties and which authority handles what. That’s no reason to wait.
The risks of assuming “this doesn’t apply to us”
This is what we see in companies that haven’t reviewed their AI use:
- “We don’t build AI, so it doesn’t apply.” If anyone in your company uses AI for work, you’re a deployer. That already means AI literacy (Article 4) and, if AI talks to your customers, transparency.
- HR tools that turn out to be high-risk. That “smart” module in your recruitment software that ranks candidates, or the productivity analytics in your workforce platform, may be high-risk. If you find out in November 2027, there won’t be time to set up human oversight, logging and staff notices.
- Chatbots that don’t say they’re AI. Since August 2026, that’s a transparency breach that can be fined. And a chatbot that passes itself off as a person and gets something wrong is an instant reputational problem.
- No inventory of AI use. Without one, you can’t classify risks or answer an authority’s questions. And “shadow AI” (personal ChatGPT accounts with customer data) adds a GDPR problem on top.
- No training. Article 4 has applied since February 2025. If an employee makes a mistake with AI, being unable to show you trained them leaves the company in a weaker position.
- Clients and tenders are already asking. Supplier questionnaires, audits by larger clients and public tenders increasingly ask about your AI policy, staff training and where data is processed. Having no answer can cost you a contract long before it costs you a fine.
- Building without compliance in mind. An agent with no conversation logs, no AI disclosure and no way to hand over to a person can be rebuilt, but it costs more than getting it right first time.
Working with a team that builds and deploys AI with the Act in mind avoids most of these problems by design: user disclosure, logs, human oversight and documentation come as standard, not as a patch.
Not sure which risk level your AI use falls into? Book a free call and we’ll go through it with you.
EU AI Act compliance checklist for SMEs
- Inventory: which AI tools are used, by whom, for what and with which data (including unapproved ones).
- Classification: mark each use as minimal, transparency, high-risk or prohibited. Look hard at HR, credit and insurance.
- Prohibited practices: confirm nothing infers employees’ emotions or scores people.
- Role: check whether you’re a provider anywhere (your own brand, modifications, high-risk uses you built yourself).
- AI literacy (Article 4): a general session and one per department, with attendance records. See our EU AI Act Article 4 guide.
- AI use policy: approved tools, data that must never go in, human review, and who to ask.
- Transparency: your chatbots and voice agents say they’re AI. Check how you label realistic AI images and video.
- Vendors: ask HR and credit software vendors whether their system is high-risk and what documentation they’ll give you.
- Data: data processing agreements, EU processing where needed, and an impact assessment if AI makes decisions about people. More in our guide to EU data residency for AI models.
- A plan for December 2027: if you have any high-risk use, decide now who oversees it, how logs are kept and when staff are informed.
How we do it at Aitomatik
We build AI agents and automations for SMEs, and the AI Act is part of the design from day one:
- Our agents say they’re an AI. On web chat, WhatsApp or the phone, users know from the start who they’re talking to, and can reach a person when needed. If you want to know how an agent works under the hood, read what an AI agent is.
- We save and evaluate every conversation. We keep a record of what the user asked, what the agent answered and what it did, and we test every change against real conversations before it goes live. It’s good practice, and it’s the foundation of any oversight.
- EU data for EU clients. Models processed in the EU, zero data retention, no training on your data, and a backup model from a different provider, also in the EU. International clients aren’t limited to EU models.
- Training for the whole team. For a multi-company group in the Balearic Islands, we mapped 75 processes across 8 departments, trained the whole office with a clear AI use policy and connected AI to their ERP with read-only access. The result: more than 1,600 hours a year freed up. Read the full success story.
If you need help getting your company’s AI use in order, start with our AI and automation consulting or our AI training for companies.
Frequently asked questions
When did the EU AI Act come into effect? It entered into force on 1 August 2024 and applies in phases: bans and AI literacy from February 2025, general-purpose AI rules from August 2025, transparency and enforcement from August 2026, and high-risk rules from December 2027 (Annex III) and August 2028 (Annex I).
What are the key changes to the EU AI Act in 2026? The Digital Omnibus (Regulation (EU) 2026/1744) delayed the high-risk deadlines, turned Article 4 into an obligation to take measures to support AI literacy rather than guarantee a level of literacy, added a ban on non-consensual sexual deepfakes, gave existing generative AI systems until 2 December 2026 to mark their output, and extended some SME simplifications to small mid-caps. Separately, transparency obligations and enforcement started on 2 August 2026.
Does the EU AI Act apply to US companies? Yes, if they place AI systems on the EU market or their AI’s output is used in the EU. Where the company is based doesn’t matter; where the AI is used does.
Does the EU AI Act apply to small businesses? Yes. There’s no size threshold: any company or sole trader using AI professionally is a deployer. SMEs get lower fine caps and some simplifications, but the same core obligations.
Does using ChatGPT at work trigger any obligations? For tasks like drafting or summarising, it’s minimal risk: you need to train the people using it (Article 4) and be careful with the data that goes in. That changes if you use it to make decisions about people, such as screening candidates, or put it in front of your customers.
Want to know what applies to you?
On a call, we’ll go through the AI your company uses, the risk level of each use and what to do first: train your team, fix your chatbots or prepare an HR tool for 2027. And if you’re building an agent, we’ll build it compliant by design. Book a free call.
This guide is for information only and isn’t legal advice. Last reviewed: 15 October 2026.
