The EU AI Act for SMEs: What Applies to You (and What Doesn’t)
The EU AI Act has been generating headlines and consulting brochures in equal volume since 2024, and as of August 2026 its main obligations apply. If you run an SME that uses AI the way most now do, a chatbot on the website, AI-assisted writing, an AI feature inside your CRM, the honest question is simple: what, concretely, do you have to do?
Less than the brochures imply, more than nothing. Here is the sober version. One caveat up front: we are AI implementers, not lawyers, and this is orientation, not legal advice.
The shape of the law
The Act regulates by risk tier, and your obligations depend on two things: what the AI does, and whether you built it or merely use it. The law distinguishes providers, who develop AI systems, from deployers, who use them in the course of business. Most SMEs are deployers. Deployers have real but limited duties; the heavy compliance burden sits with providers.
The timeline arrived in stages: the ban on prohibited practices and the AI literacy duty in February 2025, obligations for general-purpose model providers in August 2025, and the bulk of the framework, including the high-risk regime, from August 2026. In other words: this is no longer a future law.
What almost certainly does not concern you
The prohibited category covers practices like social scoring, manipulative systems causing harm, and untargeted facial image scraping. If any of this is in your business model, you have bigger problems than compliance reading.
The high-risk category is where the frightening obligations live: conformity assessments, risk management systems, logging, human oversight documentation. But high-risk means specific uses listed in the Act: AI in recruitment and worker management, credit scoring, access to essential services, critical infrastructure, education assessment, and similar. A marketing chatbot is not high-risk. AI drafting your blog posts is not high-risk. An AI feature summarising your sales calls is not high-risk.
The trap for SMEs hides in one place: HR. If you use an AI tool to screen CVs, rank candidates or evaluate employees, you are deploying a high-risk system, and deployer duties apply: using it per the provider’s instructions, ensuring human oversight, informing affected workers. If that is you, take it seriously.
What actually applies to a typical SME
Three things, in practice.
AI literacy. Since February 2025, anyone operating AI systems must ensure their staff have adequate AI literacy. For an SME this is not a certification programme; it is making sure the people using AI tools understand what the tools do, where they fail, and what must not be pasted into them. A half-day internal session, documented, covers a lot of ground. We run these for clients and the discussion about confidential data alone usually justifies the morning.
Transparency. People must know when they are talking to a machine: label the chatbot. AI-generated content in certain contexts, notably deepfakes and synthetic media, must be disclosed. Our own approach on this site is a standing disclosure note on every article, which we described in our AI-operated website case study. It costs nothing and builds more trust than it spends.
Know your inventory. The unglamorous foundation: list the AI systems you actually use, what data goes into them, and which vendor stands behind each. Ten lines in a spreadsheet for most SMEs. Without it you cannot answer the customer, auditor or insurer who asks, and they have started asking.
The sensible posture
Do not panic-buy compliance. Do not ignore it either. Make the inventory, label the bot, run the literacy session, and look hard at anything touching hiring or credit. Then get on with using AI well, which remains the actual competitive question. We covered where AI genuinely earns its keep in AI in project delivery, and helping SMEs adopt it with guardrails is what our AI implementation work is for.
Frequently Asked Questions
Does the EU AI Act apply to small companies?
Yes, with no general SME exemption, but obligations depend on role and risk. Most SMEs are deployers of low-risk systems, which mainly triggers transparency and AI literacy duties.
Is a website chatbot high-risk under the AI Act?
No. It carries a transparency obligation: users must be able to tell they are interacting with AI. High-risk classification targets uses such as recruitment, credit scoring and essential services.
What should an SME do first about the AI Act?
Inventory the AI systems in use, ensure staff AI literacy, label AI interactions, and review any AI used in hiring or employee evaluation, which falls in the high-risk category.
Editorial note: This article was researched and drafted with the assistance of Claude (Anthropic), and reviewed and approved by Amazing Projects before publication.
