EU AI Act · Sources checked 29 July 2026
EU AI Act for SMEs: check the system, role, and date
List each AI system your company uses or sells. Then record your role, the people affected, the evidence owner, and the next legal date.
The decision
- Start with one system and its intended purpose. Your company may be a deployer for Copilot, a provider for an own-brand AI product, and a product manufacturer in a third case.
- Definitions, AI-literacy measures, and the first prohibited practices have applied since 2 February 2025. GPAI-model-provider rules have applied since 2 August 2025. See the official AI Act text.
- Article 50 transparency duties apply from 2 August 2026. The final Digital Omnibus on AI moved Annex III high-risk rules to 2 December 2027 and product-embedded Annex I rules to 2 August 2028.
- SME status provides support and simplified measures in specific cases. It does not remove the need to check scope, role, intended purpose, prohibited practices, or transparency.
- Keep a system-and-role register with an evidence owner and review date. A generic AI policy cannot answer these system-level questions.
Current timeline
The next date depends on the rule.
| Date | What applies | What an SME should be able to show |
|---|---|---|
| 2 Feb 2025 | Definitions, AI-literacy measures, and the first prohibited practices | System list, use context, people involved, instruction or review record, and a prohibition screen |
| 2 Aug 2025 | Rules for providers of general-purpose AI models and EU governance | Model-provider role decision if your company develops or places a GPAI model on the EU market |
| 2 Aug 2026 | Most remaining provisions, enforcement for applicable rules, and Article 50 transparency duties | A scenario-specific transparency decision, implemented notice or marking where required, owner, and test evidence |
| 2 Dec 2027 | Chapter III rules for Annex III high-risk systems | Legal classification plus provider or deployer evidence for employment, education, credit, biometrics, and other listed cases |
| 2 Aug 2028 | Chapter III rules for high-risk AI embedded in Annex I regulated products | Product classification, supply-chain roles, technical file, and conformity path |
Role check
How the system reaches the market changes your role.
| Situation | Role to test | Next evidence |
|---|---|---|
| Your staff use a supplier tool for company work | Deployer | Supplier, intended purpose, instructions, users, data, human review, transparency trigger, and change log |
| You sell an AI system under your company name | Provider | Intended purpose, system description, risk classification, technical and supplier evidence, release controls, and customer instructions |
| You change the intended purpose or substantially modify a system | Provider duties may move to your company | Written change boundary, before-and-after design, supplier terms, and a fresh classification |
| You place a third-country system on the EU market | Importer | Provider identity, conformity evidence where applicable, instructions, traceability, and authority contact path |
| You make a system available in the supply chain | Distributor | Supplier and conformity checks, storage or handling controls, records, and escalation path |
| You integrate AI as a safety component in a regulated product | Product manufacturer and possible provider | Annex I product route, safety function, intended purpose, and conformity responsibilities |
| You develop and place a general-purpose AI model on the EU market | GPAI-model provider | A separate GPAI workstream; ordinary API use alone does not establish this role |
Working register
Record seven fields for every AI system.
✓
**System and supplier:** product name, version, model or embedded feature, contract, and business contact.
✓
**Intended purpose:** the exact task, input, output, decision, action, and affected people.
✓
**Company role:** provider, deployer, importer, distributor, product manufacturer, or more than one role.
✓
**Scope and prohibition screen:** why it is or is not an AI system, territorial link, and any Article 5 concern.
✓
**Possible duty:** Article 50 scenario, Annex III use, Annex I product route, GPAI-provider rule, or no specific AI Act duty found at this screen.
✓
**Evidence and owner:** supplier documents, instructions, test results, user notice, human review, training or literacy record, incidents, and the person responsible for each.
✓
**Next review:** date plus triggers such as a new model, supplier term, feature, purpose, user group, market, or legal update.
Common SME cases
The product name does not decide the outcome.
| Use case | First question | Useful next step |
|---|---|---|
| ChatGPT or Copilot for drafting and summarising | What data enters the tool, who checks the output, and does the use affect a listed decision? | Record the supplier, users, allowed tasks, data boundary, review rule, and literacy measure |
| Customer chatbot | Does the system interact directly with a natural person, and is that interaction already obvious? | Test the Article 50 notice duty, make the notice accessible, and store the release test |
| CV screening or candidate ranking | Does the intended purpose fall within the Annex III employment category, and is an exception relevant? | Freeze the use description and obtain legal classification before relying on the 2 December 2027 path |
| Own-brand AI SaaS built on a model API | Are you placing an AI system on the market under your name or changing its intended purpose? | Treat provider status as an open workstream; collect model, system, test, customer, and change evidence |
| AI-generated marketing copy | Is it public-interest text, a deepfake, or ordinary edited commercial content? | Apply the exact Article 50 scenario and exception instead of adding a universal AI label |
| AI inside machinery or another regulated product | Is the AI a safety component or the product itself under Annex I legislation? | Join the AI and product-conformity workstreams; test the 2 August 2028 date |
Article 50
Transparency duties are tied to a scenario.
From 2 August 2026, Article 50 separates several duties. Providers design notice into systems meant to interact directly with people and machine-readable marking into systems that generate synthetic content. Deployers have separate disclosure duties for emotion recognition, biometric categorisation, deepfakes, and certain public-interest text. Read the official Article 50 text.
Do not turn that into “label every AI-assisted text.” Public-interest text has an exception where human review or editorial control occurs and a person or company takes editorial responsibility. Record the scenario, exception, notice wording, accessibility check, release test, and owner.
Compliance next step
Get a compliance check on: EU AI Act for SMEs
Send us where your site stands today. We reply with the risks that carry real exposure, not a generic checklist.
Evidence pack
Keep the record that explains the decision.
Store the system entry, intended purpose, role reasoning, supplier documents, contract, data boundary, applicable rule, test results, user notice, human review, literacy measure, incident path, and approval together. Date the sources and the decision.
Review the entry when the model, supplier, feature, purpose, affected group, level of autonomy, market, contract, or law changes. Also set a calendar review. The Commission overview and live implementation timeline are the first sources to recheck.
Buyer questions
Answers for the approval meeting.
We only use ChatGPT and Copilot. What must we do?
Record each use rather than classifying the brand. Capture the task, users, data, output review, affected people, supplier terms, and AI-literacy measure. Then test whether the specific use triggers a prohibition, Article 50 duty, or high-risk category. Ordinary drafting does not automatically make your company a GPAI-model provider.
Does an SME have an exemption from the EU AI Act?
No blanket exemption exists. SMEs receive support and specific simplifications, including a simplified technical-documentation route in relevant provider cases. Scope, role, prohibited practices, transparency, and high-risk classification still depend on the system and use.
What fines can apply to an SME?
Article 99 sets ceilings by violation. For an SME, the lower of the fixed amount or turnover percentage applies. Other undertakings use the higher amount. The authority must also consider the facts of the case. Use the official text for a live legal assessment rather than quoting one headline maximum.
Did the August 2026 high-risk deadline change?
Yes. Regulation (EU) 2026/1744 moved Annex III high-risk rules to 2 December 2027 and Annex I product-embedded high-risk rules to 2 August 2028. Article 50 transparency duties and other applicable provisions still start on 2 August 2026.
Who should decide whether our system is high risk?
The business and technical teams should freeze the facts: intended purpose, users, affected people, decisions, actions, product context, supplier, and changes. Qualified counsel can then classify the legal case. Technical teams should implement and test the resulting controls; an automation supplier should not sell its own legal conclusion.
What should we send for an AI system review?
Send one system entry, the supplier contract or terms, intended purpose, data flow, screenshots, user notice, output-review rule, affected groups, and known changes. We can map the technical evidence and implementation gaps, then mark questions that require legal advice.
Implementation
Turn the legal decision into system controls.
Some Tech Work can build the register, map suppliers and data flows, add accessible notices, define human-review steps, record model or prompt changes, and test the release path. The output gives your team and counsel technical evidence. Legal opinions and certification remain outside this work.
For a portfolio-level decision, request an AI advisory review. For one workflow, send the task, tools, data, people affected, and current review step through our AI automation service.
Written by
Vineet Talwar
Co-founder, Tech & Operations at Some Tech Work. WordCamp speaker across Europe and Asia, and host of the WP Shoutout podcast.
Start here
Ready to talk.Book a short diagnostic.
Tell us what needs fixing
We read every brief and reply within one business day.
Prefer to talk first?or request a tech stack audit →or email us directly →
Not sure where to start? Send the stuck decision, workflow, or page. We will say whether you need a diagnostic call, a tech stack audit, or a different first step.