Cyber-Management
EN / FRbook a consultation

EU AI Act

The EU AI Act for SMBs: which duties apply to you, and when?

Most companies only use AI tools. See what the law asks of you, and what can wait.

book a free 25-minute consultation

Does it apply to you?

Four questions to find where you stand.

Yes only to the first: your duties are light. Each further yes adds duties. The exact tests are in the section for your IT manager, below.

  • Does your team use AI tools?ChatGPT, Claude, Copilot, or AI inside your software. The law calls you a "deployer": a business that uses AI. Your main duty is to help staff understand the tools they use.
  • Could any of your uses be banned?For example, software that reads your staff’s emotions. A handful of uses are banned outright, and a quick check rules them out.
  • Does AI help you decide about people?Hiring, credit, insurance pricing, access to education or public services. These "high-risk" uses face stricter rules from 2 December 2027.
  • Do you sell a product with AI built in?Even one built on a model such as ChatGPT or Claude. You are then usually its "provider": people must be told when they are dealing with an AI, and AI-made content must be marked.

Not in scope?

Light duties? Your customers may still ask.

Larger customers now ask, in security questionnaires and contracts, how you control your use of AI. A short AI policy and a list of approved tools answer most of those questions.

see how we set AI rules

What changes for you

For most companies: clear rules for staff, and a check.

If your team only uses AI tools, the law asks two things. Help your staff understand the tools they use, in proportion to the risk; no test or certificate is required. And make sure none of your uses is banned.

Stricter rules start on 2 December 2027 for AI that helps decide about people, such as hiring or credit: human oversight, records, and in some cases an impact assessment. Companies that sell such systems carry the heaviest load.

For most companies the real risk is not a fine. It is client data pasted into the wrong tool, or an AI answer sent to a customer unchecked. Three rules cover most of it: what data may go in, which tools are approved, and a human check before anything reaches a client.

What to do first

Map your AI use, then set the rules.

What we deliver

  • A list of every AI tool and feature in use, and your role for each
  • A check that none of your uses is banned or high-risk without you knowing
  • An AI use policy and a list of approved tools
  • Staff awareness matched to the tools each role uses
  • If AI decides about people: the high-risk plan, with the 2027 deadline in your calendar

Who does what

We set the rules. Your teams and suppliers run the AI.

What we lead

  • Map your AI use and your role for each tool
  • Check for banned and high-risk uses
  • Write the AI policy and the approved-tools list
  • Train staff on the tools they use
  • Prepare the evidence a customer or authority will ask for

What stays with your IT provider

  • Configure the AI tools and their data settings
  • Manage accounts and access
  • Keep the logs and records the plan requires

We do not build, deploy or configure AI systems.

How it starts

Your first step: a map of your AI use.

In 1–2 weeks you know which AI you use, your role for each tool and which rules apply. The rest of the work is sized from that map, at a fixed fee.

Price
Fixed fee
Duration
First results in 1–2 weeks

Fixed quote after the free call.

see the AI governance service

Start the AI Act assessment

For your IT manager, DPO or CFO

What the regulation requires, by article.

The obligation set that applies to you is scoped in Phase 1 Discovery by your role and your systems. These are the articles that most often land on an SMB.

  1. 01Art. 5

    Prohibited AI practices

    Binding since February 2025. Social scoring, untargeted facial-recognition scraping, emotion recognition in the workplace and education, certain biometric categorisation. The 2026 Omnibus added two more — AI-generated non-consensual intimate imagery, and CSAM — which apply from 2 December 2026. Carries the maximum fine band, and small mid-caps get no relief from it.

  2. 02Art. 4

    AI literacy

    Binding since February 2025, and softened by the Omnibus. Providers and deployers must take measures to support the development of AI literacy among staff who use or oversee AI, proportionate to the risk and context of use. The amended article says expressly that no specific level need be guaranteed for any individual — an obligation of effort, not of result.

  3. 03Art. 6 · Annex III

    High-risk classification

    Eight Annex III areas define stand-alone high-risk use: biometrics, critical infrastructure, education, employment and worker management, access to essential public and private services (incl. creditworthiness and insurance), law enforcement, migration and border control, and administration of justice.

  4. 04Art. 9 · 10

    Risk management & data governance

    Providers of high-risk systems must run a continuous risk-management system across the lifecycle and govern the quality, relevance, and representativeness of training, validation, and testing data.

  5. 05Art. 13 · 14

    Transparency & human oversight

    High-risk systems must be transparent enough for deployers to interpret and use them correctly, and must be designed for effective human oversight — including the ability to intervene, override, or halt the system.

  6. 06Art. 15

    Accuracy, robustness & cybersecurity

    High-risk systems must achieve appropriate accuracy, robustness, and cybersecurity across their lifecycle — resilient against errors, faults, and adversarial attempts to manipulate the model or its data.

  7. 07Art. 26

    Deployer duties (high-risk)

    Binding December 2027. Use per the provider instructions, assign competent human oversight, monitor operation and keep logs, suspend and report where risks emerge, and inform affected persons. The primary obligation set for organisations deploying Annex III AI.

  8. 08Art. 27

    Fundamental Rights Impact Assessment

    Public bodies and certain private deployers of high-risk AI (including creditworthiness and insurance-risk use) must complete a FRIA before deployment. Engineered to integrate with the GDPR DPIA rather than duplicate it.

  9. 09Art. 50

    Transparency obligations

    Applies from 2 August 2026, and was explicitly not deferred. Users must be told they are interacting with an AI system; AI-generated or manipulated content (deepfakes, synthetic media) must be disclosed and machine-readable marked. Article 111(4) gives systems placed on the market before 2 August 2026 until 2 December 2026 to meet that marking duty.

  10. 10Art. 53 · 55

    General-purpose AI models

    Binding since August 2025. GPAI providers must maintain technical documentation, publish training-data summaries, and respect EU copyright; models posing systemic risk carry additional evaluation, red-teaming, and incident-reporting duties.

Article 99: three fine bands, and a real SME cushion.

The AI Act's fines scale with the severity of the breach and are set as the higher of a fixed amount or a percentage of total worldwide annual turnover. Prohibited practices under Article 5 sit in the top band; the high-risk and transparency obligations that bind through 2026–2028 sit in the middle; supplying incorrect or misleading information to authorities sits at the bottom.

There is a genuine cushion for smaller organisations, and it is not the same cushion for everyone. Under Article 99(6) an SME or start-up pays the lower of the fixed amount or the percentage across all three bands — the inverse of the rule for large enterprises. A firm with €2M turnover therefore faces a top-band ceiling of €140,000, not €35M. The Omnibus added Article 99(6a) for small mid-caps, but only for the €15M/3% and €7.5M/1% bands: an SMC that breaches the Article 5 prohibitions still faces the higher of €35M or 7%. And the reputational and procurement consequences of an undocumented AI estate — surfacing in any customer, partner, or insurer due-diligence conversation — typically bite long before a regulator does.

  • Prohibited practices (Art. 5)

    €35M / 7%

    whichever is higher, of total worldwide annual turnover. Only SMEs get the lower figure in this band.

  • High-risk & transparency obligations

    €15M / 3%

    most operator obligation breaches, Article 50 included. GPAI model providers are fined by the Commission under Article 101, on the same ceiling, from August 2026.

  • Incorrect information

    €7.5M / 1%

    misleading or incomplete information to authorities. SMEs and small mid-caps pay the lower figure.

Typical timeline

The Omnibus delay is planning runway, not a holiday. A Regulated AI Deployment engagement plus pilot rollout, sign-off, and a remediation cycle is a seven-to-nine-month project, so the latest realistic kick-off for December 2027 is Q1 2027. And the nearest AI Act deadline is not 2027 at all — it is 2 December 2026.

  1. 1–2 weeks

    Discovery & classification

    AI estate inventory, role determination, per-system risk-tier classification, and a Service Profile that scopes the rest of the engagement.

  2. Following discovery

    Risk & gap analysis

    ISO/IEC 23894-aligned AI risk assessment per system, AI Act gap analysis for your role, and a remediation roadmap with the real deadlines mapped to your calendar.

  3. Deepest phase

    Governance & controls

    AI policy, roles, literacy programme, vendor due diligence, and the role-specific layer — FRIA for regulated deployers, technical documentation and QMS for providers, evaluation protocols for GPAI integrators.

  4. Pre-deadline

    Readiness & validation

    Internal review against your obligations, evidence-pack assembly, gap closure, and a management-body sign-off pack ready for audit or regulator scrutiny.

FAQ

What IT and product teams ask us about the AI Act.

Does the AI Act apply to us if we only use tools like ChatGPT, Claude and Copilot?
Yes: you are a deployer, a business that uses AI. Two duties already apply: the Article 5 bans, and Article 4 AI literacy, binding since February 2025 and softened by the Omnibus into a duty to take measures, not to guarantee a result. If any use touches an Annex III high-risk area (recruiting, credit, health, education, essential services), Article 26 deployer duties apply from 2 December 2027. Most SMB use is limited- or minimal-risk, but you only know once the classification is run.
Are we a deployer, a provider, or both?
It depends on each system, and one company can be both. A deployer uses an AI system at work. A provider develops one, or substantially modifies or rebrands one, and places it on the EU market; high-risk providers carry the Chapter III load, up to conformity assessment and CE marking. Building a system on a general-purpose model makes you its provider (Article 3(68)), so Article 50 transparency almost always applies. Fine-tuning beyond the Commission’s indicative threshold can also make you a GPAI model provider for the modification (Article 53, Recital 109). The Act also reaches providers and deployers outside the EU when the output is used in the Union.
How does the AI Act sort AI systems?
By risk, in four tiers: unacceptable (prohibited under Article 5), high-risk (permitted under strict conditions, Article 6 and Annex III), limited-risk (transparency duties under Article 50) and minimal-risk (no specific duties). General-purpose AI models, the foundation models most AI features are built on, have their own regime. The Act is Regulation (EU) 2024/1689, in force since 1 August 2024 and applying in phases.
What did the 2026 Omnibus actually change?
The Digital Omnibus on AI is Regulation (EU) 2026/1744, in force since 27 July 2026. It moved Annex III stand-alone high-risk obligations to 2 December 2027, and high-risk AI embedded in regulated products to 2 August 2028 (from 2 August 2027). It extended part of the SME relief to small mid-caps. It also created work: two new Article 5 prohibitions, on AI-generated non-consensual intimate imagery and on CSAM, apply from 2 December 2026, and Article 111(4) gives generative systems already on the market until that date to meet Article 50(2) marking. It softened Article 4. Only the GPAI duties came through untouched.
When are the deadlines now?
Already in force: Article 5 prohibited practices and Article 4 AI literacy since 2 February 2025, GPAI provider obligations (Articles 53/55) since 2 August 2025, and Article 50 transparency since 2 August 2026. Next: 2 December 2026, when the two new Article 5 prohibitions apply and generative systems placed on the market before 2 August 2026 must carry Article 50(2) marking (Article 111(4)). Then 2 December 2027 for stand-alone Annex III high-risk systems, and 2 August 2028 for high-risk AI embedded in regulated products.
How large are the fines?
Article 99 sets three bands, each the higher of a fixed sum or a share of worldwide annual turnover: €35M or 7% for prohibited practices, €15M or 3% for most other operator breaches, Article 50 included, and €7.5M or 1% for incorrect information to authorities. SMEs and start-ups pay the lower of the two figures in all three bands; small mid-caps only in the 3% and 1% bands (Article 99(6a)). The Commission fines GPAI model providers under Article 101, up to €15M or 3%, since 2 August 2026.
Is the AI Act the same as ISO/IEC 42001?
No, but they fit together. The AI Act is mandatory law; ISO/IEC 42001 is a voluntary, certifiable AI management system standard. A well-scoped management system covers much of the Act’s provider and deployer obligations, but ISO 42001 certification alone is not AI Act conformity. We prepare the AI Act evidence and the ISO 42001 base together, so they arrive in one engagement rather than as two projects.
Do the SMB simplifications actually reduce the work?
They reduce the paperwork, not the analysis. The Omnibus extended part of the SME relief to small mid-caps (not already an SME, fewer than 750 staff, and turnover no more than €150M or a balance sheet no more than €129M, per Commission Recommendation (EU) 2025/1099): the simplified Annex IV technical documentation (Article 11(1)), a proportionate quality management system (Article 17(2)), and the lower fine in the 3% and 1% bands (Article 99(6a)). Priority access to national sandboxes stays with SMEs (Article 62(1)(a)); small mid-caps get priority only in the Union-level sandbox, for AI systems built on a GPAI model by the same provider (Articles 57(3a), 75(1)). Your AI use still has to be mapped, your role classified and the Article 5 screen run.

Related

The AI regulatory neighbours.

ISO 42001

The certifiable AI Management System standard. A well-scoped AIMS covers substantial portions of the AI Act — we prepare both together so certification is assembly work, not rework.

Read more

EU GDPR

The personal-data overlay — where AI processes personal data, EDPB Opinion 28/2024 governs the intersection, and the AI Act FRIA integrates with the GDPR DPIA.

Read more

NIS2

Sector overlay for essential and important entities whose AI estate now sits inside Article 21 risk-management obligations.

Read more

DORA

Sector overlay for financial entities using AI in ICT operations — credit scoring, fraud detection, AML screening, and customer-facing AI.

Read more

Cyber Resilience Act

Where a high-risk AI system is also a product with digital elements, CRA Article 12 means meeting Annex I satisfies the AI Act’s Article 15 cybersecurity requirement — one assessment, two regimes.

Read more
back to compliance hub