EU AI Act — Obligations for SMEs in 2026

With the EU AI Act, the European Union adopted the world's first comprehensive AI legislation in 2024 — and its impact will be felt by SMEs in 2026. While many management boards still dismiss the AI Act as a concern for tech corporations, key obligations apply explicitly to pure deployers as well — meaning any company that uses ChatGPT in recruitment, Copilot in accounting, or a RAG system on customer data. Since February 2025, the AI literacy obligation under Article 4 has been in force; from August 2026, most obligations for high-risk systems apply; and fines of up to €35 million or 7 percent of group-wide turnover significantly exceed GDPR levels. This article explains what the AI Act actually regulates, what the four risk classes are, which obligations genuinely apply to SMEs as deployers, what AI literacy means in practice, and which concrete steps will position you ahead of the August 2026 deadline. For broader strategic context, see our AI Guide for SMEs; for the concurrently applicable data protection requirements, see our cluster AI and GDPR.

What the EU AI Act Is — and the Timeline Through 2027

The EU AI Act — formally Regulation (EU) 2024/1689 — entered into force on 1 August 2024. Like the GDPR, it applies as a European regulation directly in every member state without requiring a national implementing law. It covers the entire lifecycle of AI systems — development, placing on the market, deployment, and market surveillance. Its scope is extraterritorial: US, Chinese, or British providers offering their models in the EU are covered just as much as European providers and deployers.

Applicability is phased — a deliberate compromise between immediate effect and sufficient preparation time. The following timeline shows the most important key dates:

Date	What takes effect	Relevance for SMEs
1 August 2024	Regulation enters into force	Preparation phase begins
2 February 2025	Prohibitions under Art. 5, AI literacy under Art. 4	Immediately relevant — training programme mandatory
2 August 2025	Rules for GPAI models, national supervisory bodies, sanctions	Foundation model providers subject to documentation obligations
2 August 2026	Obligations for high-risk systems under Annex III	Main deadline — HR tools, credit scoring, critical infrastructure
2 August 2027	Obligations for high-risk systems under Annex I	AI embedded in regulated products (medical devices, machinery, toys)

This phased approach creates a clear priority sequence for SMEs: AI literacy is already mandatory and should be implemented immediately; classification of your own AI applications should be completed in 2025; and full high-risk compliance must be in place by August 2026. Those who wait will run into enforcement deadlines.

The Four Risk Classes of the AI Act

The core of the AI Act is a risk-based approach with four classes. Every AI application is assigned to a class, from which the specific obligations are derived. Classification follows the intended purpose — not the technology. One and the same language model can fall into different risk classes depending on its use.

Risk Class	Examples	Consequence
Prohibited practices (Art. 5)	Social scoring by public authorities, manipulation using subliminal techniques, real-time biometric identification in public spaces, emotion recognition in the workplace	Complete prohibition, highest fines
High-risk (Annex III)	HR screening, credit scoring, insurance pricing, critical infrastructure, educational admissions, law enforcement	Full obligations — risk management, data governance, human oversight, conformity assessment
Limited risk (Art. 50)	Customer service chatbots, AI-generated content, deepfakes	Transparency obligations — labelling towards users and affected persons
Minimal risk	Spam filters, AI in video games, recommendation systems in retail	No specific obligations — voluntary codes of conduct possible

An observation from our advisory practice: most SMEs underestimate their high-risk exposure. Any company deploying an AI-assisted applicant tool falls directly into the high-risk category under Annex III, point 4 — regardless of whether it is a custom development or off-the-shelf software such as SAP SuccessFactors with an AI module. High-risk classification follows the intended purpose, not the software brand.

Who Is Affected — Including Pure Deployers

The AI Act distinguishes four roles: provider, deployer, importer, and distributor. For German SMEs, two roles are typically relevant: deployer when using ready-made AI products, and occasionally provider when developing custom solutions or substantially modifying existing models.

A deployer under the AI Act is any natural or legal person that uses an AI system under its own responsibility — except for purely private use. This means every SME that uses ChatGPT Enterprise, Microsoft Copilot, Claude for Work, or a specialised application such as AI-powered applicant screening in a productive capacity is a deployer with its own obligations. These obligations include: using the system only in accordance with the provider's instructions, ensuring human oversight, retaining logs, informing affected persons, and — in the high-risk domain — conducting a fundamental rights impact assessment.

One important scenario: if an SME substantially modifies an existing AI system — through fine-tuning on its own data, repurposing, or embedding it in a proprietary product — it may itself become a provider and thereby take on the stricter provider obligations. This happens more frequently than expected, for example when a mechanical engineering firm fine-tunes a Llama model for its own service portal and makes the result available to its customers.

Obligations by Risk Class

The following overview shows the key obligations broken down by risk class and role. It is intended as a guidance tool — full classification and derivation of obligations requires a documented compliance analysis.

Class	Provider obligations	Deployer obligations
Prohibited practices	Do not place on the market	Do not deploy
High-risk	Risk management system, data governance, technical documentation, transparency, conformity assessment, CE marking, EU database registration	Use in accordance with instructions, human oversight, retain logs, inform affected persons, fundamental rights impact assessment (FRIA) for public bodies and certain private services
Limited risk	Transparency under Art. 50 — label output	Inform users that they are interacting with AI; label AI output accordingly
Minimal risk	No specific obligations	No specific obligations — AI literacy still applies

Across all classes: the AI literacy obligation under Article 4 applies to both providers and deployers — regardless of the risk class of the specific system. Anyone deploying AI must ensure their workforce is competent. Full stop.

AI Literacy Obligation Under Article 4 — In Force Since February 2025

Article 4 is one of the most understated yet consequential provisions of the AI Act. It requires providers and deployers to ensure that all employees who work with AI systems possess a "sufficient level of AI competence." What "sufficient" means is left open in the regulatory text — but it identifies key reference points: technical knowledge, experience, training, and the context of use should all be taken into account.

In practice, this means four concrete building blocks for SMEs. First, a documented training programme that reaches all employees with AI contact — from sales staff using ChatGPT for proposal texts to accounting teams using Copilot for Excel analyses. Second, role differentiation: power users with prompt engineering and model knowledge need deeper content than occasional users who require only basic briefings. Third, attendance records per employee that can be presented in an audit. Fourth, regular refreshers — AI systems evolve too quickly for a one-off training to remain adequate over time.

Three training levels are practically sensible: a 30-minute mandatory module for all employees covering AI fundamentals and risk awareness; a two-hour advanced module for active users focusing on prompt practice and data protection; and a half-day intensive module for power users and multipliers. This structure is easy to document in an audit and fits the scale and resource capacity of SMEs. More on the operational structure can be found in our cluster AI Training for Employees.

High-Risk Systems — Examples from SME Practice

High-risk classification under Annex III is the area that most often catches SMEs off guard. The following three scenarios come up most frequently in our work:

• HR Screening and Applicant SortingAnnex III, point 4 places AI systems used for personnel selection, evaluation of applications, and performance assessment under high-risk status. This covers not only exotic specialist tools but also AI modules in common ATS systems such as SAP SuccessFactors, Workday, or Personio, when these automatically rank or summarise incoming applications. Consequence: risk assessment, human oversight of every algorithmic decision, notification of applicants, fundamental rights impact assessment.
• Credit Scoring and Creditworthiness AssessmentAnnex III, point 5 covers AI systems that assess natural persons for access to essential private services. Banks, leasing providers, insurers, landlords, and large online retailers conducting creditworthiness checks fall directly into the high-risk category. In the SME space, we frequently see this with machinery rental companies using automated customer assessments and B2B platforms with creditworthiness scoring.
• AI in Critical InfrastructureAnnex III, point 2 covers AI systems as safety components in the management of critical infrastructure — transport, water, gas, electricity, and heat. SME-scale municipal utilities, network operators, and water suppliers are doubly affected here, since the NIS2 directive applies in parallel. Any KRITIS operator deploying AI-assisted anomaly detection or predictive maintenance within its control network is a high-risk deployer.

Further high-risk areas under Annex III that may become relevant for SMEs: AI in educational admissions and examination assessment, AI in migration and asylum administration (relevant for service providers to public bodies), AI in justice and democratic processes, and AI modules in regulated products under Annex I — such as medical devices, machinery, or toys.

Transparency Obligations Under Article 50

Article 50 governs the transparency obligations for AI systems with limited risk — and applies in addition to all other obligations. Three scenarios are central here.

First, chatbot labelling: every AI system that interacts with natural persons must inform them in a clear, unambiguous way that they are speaking with an AI. Exceptions apply only when this is obvious from the context. In practice, this means every customer service chatbot requires visible labelling in the first message block.

Second, output labelling: synthetically generated audio, image, video, or text content must be labelled in a way that makes it recognisable as artificially created or manipulated. For providers, this means technical labelling within the output format itself — for example via watermarks or C2PA metadata. For deployers, it means making AI-generated content identifiable in external communications — such as generated images in marketing materials or auto-generated blog posts.

Third, deepfake disclosure: when an AI system generates content that closely resembles real persons, objects, or events, this fact must be disclosed. Exceptions apply to artistic and satirical works, where appropriate labelling suffices without destroying the artistic effect.

GPAI and Foundation Model Obligations

With the rules for General-Purpose AI (GPAI) models — foundation models such as GPT-4, Claude, Gemini, or Mistral — the AI Act specifically targets the providers of these base models. SME deployers are only indirectly affected by these obligations: they must be able to rely on providers fulfilling their obligations and be able to present corresponding evidence in an audit.

Specifically, GPAI providers are required to maintain technical documentation, provide information to downstream providers, comply with copyright policies, and publish a summary of training data. For GPAI models with systemic risk — currently large models exceeding a training compute of 10^25 FLOPs — additional obligations apply regarding model evaluation, risk mitigation, incident reporting, and cybersecurity.

For SME deployers, the practical implication is straightforward: in vendor selection and procurement processes, questions about the provider's AI Act compliance should be part of the standard questionnaire. Anyone deploying an AI platform should obtain written confirmation from the provider that all relevant GPAI obligations are met and that corresponding evidence will be made available upon request.

Sanctions — Up to €35 Million or 7 Percent of Group Turnover

The AI Act introduces a tiered sanctions system that significantly exceeds GDPR maxima. The following overview shows the three tiers:

Violation	Fine up to	Alternative
Prohibited practices under Art. 5	€35 million	7% of worldwide annual turnover
High-risk obligations, transparency under Art. 50, GPAI obligations	€15 million	3% of worldwide annual turnover
False or incomplete information provided to the supervisory authority	€7.5 million	1% of worldwide annual turnover

The group principle is important here: fines are calculated on worldwide group turnover, not on the turnover of the individual infringing subsidiary. For SME-scale corporate groups, this can in the worst case become an existential threat. Additional consequences include the usual accompanying measures — injunctions, market withdrawal orders, reputational damage, and supplier audit repercussions.

One notable detail: for small and medium-sized enterprises and start-ups, the AI Act provides for reduced fines under Article 99 — the maximum rates then apply as ceilings rather than standard values. This SME benefit is not a free pass in an audit, however — it is merely a reduction in the assessment baseline.

Concrete Steps — the Pragmatic Roadmap

For SMEs that do not yet have a complete AI Act roadmap, we recommend the following five steps in this order. In our experience, the first three steps can be completed within two to three months; the final two require six to twelve months depending on high-risk exposure.

• Create an AI inventoryRecord all AI applications in productive or pilot use across your organisation — from individual employees' ChatGPT accounts and Copilot licences to AI modules embedded in standard software such as ATS, CRM, or ERP. For each application, capture: provider, intended purpose, data involved, persons affected, and the model family used.
• Risk classification per systemAssign each recorded AI application to one of the four AI Act classes. Pay particular attention to hidden high-risk areas — HR modules in ATS systems, creditworthiness assessment in sales tools, AI in control systems. Document the classification decision with reasoning — this is the most important piece of evidence in an audit.
• Set up AI literacy trainingImplement the three-tier training model — mandatory module for all employees, advanced module for active users, intensive module for power users. Secure attendance records and integrate an annual refresher into HR processes.
• Build documentation and governanceEstablish AI governance with clear responsibilities — typically an AI officer combined with the Data Protection Officer or CISO. Maintain a register of AI applications and document classifications, training sessions, and measures taken.
• Roll out high-risk complianceFor identified high-risk applications: implement risk management, data governance, human oversight, logging, notification of affected persons, and where applicable the fundamental rights impact assessment. Coordinate the approach with data protection, works council, and legal. Deadline: August 2026.

One key practical point: do not be paralysed by the complexity. Most SMEs have between three and ten high-risk applications — a manageable number that can be brought to a sound compliance level with moderate effort. Those who start early are well positioned with a project timeline of three to six months. Those who wait will encounter bottlenecks in 2026 — both in their own teams and among external consultants.

Frequently Asked Questions