Guide
The EU AI Act for SMEs.
What the AI Act asks of a small or mid-sized company, when it applies and what to do first. Written for managers, not lawyers.
DraftDates and article numbers are being checked against the official text on EUR-Lex. This guide is not legal advice.
In short
Most of it is about being open.
The AI Act is an EU regulation on artificial intelligence. It applies directly in every EU country. For most small and mid-sized companies the duties are short: train the people who use AI, tell people when they talk to an AI, label deepfakes and stay away from a short list of banned uses.
Heavier rules apply only to high-risk systems, for example AI that helps decide about hiring, credit or school grades. If you build an AI product under your own name, you are a provider and have more duties than a company that only uses AI, a deployer.
Key dates
What applies when.
| Date | What starts to apply |
|---|---|
| 2 February 2025 | Prohibited practices (the first eight bans) and the duty to train staff who use AI (AI literacy, Art. 4). |
| 2 August 2025 | Rules for providers of general-purpose AI models. |
| 2 August 2026 | Transparency duties (Art. 50), supervision and fines in general. |
| 2 December 2026 | Ninth prohibition: intimate content without consent and child sexual abuse material. |
| 2 December 2027 | High-risk systems listed in Annex III (hiring, credit, education and others), postponed by the AI Omnibus. |
| 2 August 2028 | AI inside regulated products (Annex I), postponed by the AI Omnibus. |
Fines
High ceilings, clear duties.
Fines can reach €35 million or 7% of worldwide annual turnover for prohibited practices and €15 million or 3% for most other breaches. For SMEs the lower of the two amounts applies.
That sounds alarming, but the duties behind it are concrete, and for most companies they are short.
First steps
What to do this month.
- List your AI tools and systems. What you use, what for, which data goes in, who is responsible.
- Check for banned and high-risk uses. Does any AI decide about people: hiring, credit, education?
- Train your team. A short AI literacy session for everyone who uses AI at work, and a record of who took part.
- Be open. Chatbots say they are AI; deepfakes and AI-made media carry a label.
- Write simple rules. Which data may go into which AI service, and who reviews AI output before it goes out.