Skip to content
Optim-AI

Regulation

The EU AI Act: what applies to an SME, and when

Up to date as of 10 October 2026. The EU AI Act (Regulation (EU) 2024/1689, amended in July 2026) classifies uses by level of risk. An SME that uses AI tools currently has a general obligation: to take measures so that its teams understand these tools, with no level to guarantee and no certificate to obtain. Certain practices have been prohibited since February 2025, and since August 2026 manipulated content (“deepfakes”) that you distribute must be disclosed. Most office uses entail no other obligation. High-risk uses, such as screening job applications, access to credit or employee monitoring, will be subject to stricter obligations from 2 December 2027 and deserve a dedicated review before any deployment.

Who is affected

Provider or deployer

The regulation distinguishes between two roles.

  • The provider develops an AI system, or has it developed, and places it on the market under its own name. Software publishers fall into this category.
  • The deployer uses an AI system under its own authority, in a professional context. Personal, non-professional use is not covered.

An SME that buys or subscribes to an AI tool is almost always a deployer. Most of the heavy obligations fall on the provider.

One exception matters for SMEs. You become the provider of a high-risk system if you put your name on it, if you substantially modify it, or if you change its intended purpose to the point of making it high-risk (Article 25).

Timeline

What applies, date by date

Application timeline of the EU AI Act
DateWhat appliesWho is covered
1 August 2024Entry into force of the regulation—
2 February 2025Prohibited practices (Art. 5). Measures for AI literacy (Art. 4)Everyone
2 August 2025General-purpose AI models, governance, penaltiesModel providers, Member States
27 July 2026Entry into force of the Omnibus (Regulation 2026/1744). Article 4 relaxedEveryone
2 August 2026Transparency (Art. 50): deepfakes, certain published textsProviders and deployers
2 December 2026New prohibitions: non-consensual intimate content of an identifiable person, child sexual abuse materialEveryone
2 December 2027High-risk systems listed in Annex III (recruitment, credit, etc.)Providers and deployers
2 August 2028High-risk systems built into regulated products (Annex I)Providers and deployers

The 2027 and 2028 dates are fixed. They do not depend on the publication of technical standards.

In practice

What an SME that uses AI should do

  1. Know which tools are in use.

    The regulation does not require an inventory as such. But you can only apply the following points to tools you know about.

  2. Take measures so that your teams understand these tools (Art. 4).

    This applies to your employees and to the people who use them on your behalf, such as a contractor. An awareness session, a written usage rule or targeted training are examples. No certificate is required. An internal record of the measures taken is sufficient.

  3. Check that no use is prohibited (Art. 5).

    A useful example for companies: emotion recognition in the workplace is prohibited, except for medical or safety reasons.

  4. Disclose what must be disclosed (Art. 50).

    A manipulated image, audio or video that you distribute must be disclosed as generated or manipulated. A text published to inform the public on matters of public interest must be disclosed too, unless it has been reviewed by a person who holds editorial responsibility for it.

  5. Identify high-risk uses before 2 December 2027.

    See the next section.

High risk

High-risk uses

Annex III lists the areas concerned. For an SME, three are the most common:

  • Recruitment: targeted job advertising, screening applications, evaluating candidates.
  • Workforce management: decisions on promotion or dismissal, allocating tasks based on personal traits, monitoring performance and behaviour.
  • Financial services: creditworthiness assessment or credit scoring (excluding fraud detection), pricing of life and health insurance.

The other areas are biometrics, critical infrastructure, education, access to public and emergency services, law enforcement, migration and justice.

From 2 December 2027, the deployer of such a system must in particular (Art. 26):

  • use it in accordance with the provider's instructions for use;
  • assign human oversight to people who are competent, trained and have the necessary authority;
  • ensure that input data is relevant, where it controls that data;
  • monitor operation, suspend use in the event of risk and report serious incidents;
  • keep the automatically generated logs for at least six months;
  • inform workers' representatives and the employees concerned before putting the system into service in the workplace;
  • inform the people subject to a decision made or assisted by the system;
  • cooperate with the competent authorities.

These uses deserve a dedicated review before any deployment. If you already use HR or credit software with built-in AI, ask your vendor now whether it considers the tool to fall under Annex III, and when its instructions for use will be available.

Penalties

The maximum fines

The caps set by the regulation (Art. 99) are:

  • prohibited practices: €35 million or 7% of total worldwide annual turnover;
  • other obligations, including those of deployers and transparency: €15 million or 3%;
  • incorrect information supplied to authorities: €7.5 million or 1%.

For a large company, the higher of the two amounts applies. For an SME or a start-up, it is the lower. Since July 2026, penalties may also take the form of a warning or a non-monetary measure, and Member States must take into account the economic viability of SMEs.

Article 4 does not appear in any of these lists. It has no EU-level cap. Any penalty for it is a matter for national law.

Support

What Optim-AI can do

  • The two-day diagnostic identifies the AI tools already in use in the company.
  • The audit maps actual use, including use that has not been declared, and flags any that might fall under Annex III.
  • The AI usage rules, delivered with the countermeasures plan, are written to be read by your teams and are ready to be attached to the company's internal regulations. They provide a written record of the measures taken.
  • The AI awareness engagement is a separate engagement, with a written report, the materials presented and a short assessment questionnaire before and after the session, to measure what has changed. It is one possible measure under Article 4, not the only one.

Optim-AI is not a law firm. For a high-risk use, the final legal analysis is a matter for your legal adviser.

Frequently asked questions

Questions from business leaders

Does using Copilot or ChatGPT make my SME a user of a high-risk system?
Generally, no. A drafting or summarising assistant does not fall under Annex III. It does if you use it for a purpose listed there, for example screening job applications. You are still covered by Article 4 and, if you distribute deepfakes, by Article 50.
Do all employees need training and a certificate?
No. Since 27 July 2026, the regulation requires measures to support AI literacy, with no level to guarantee. The Commission states that no certificate is needed. The measures are adapted to the people and the tools. Keep a written record of them.
Do I have to disclose texts written with AI?
Only for texts published to inform the public on matters of public interest, and only if they have not undergone human review under the editorial responsibility of a person. A sales newsletter or a product sheet does not, in principle, fall into this category.
Our HR software sorts CVs. What should we do now?
This type of tool falls under Annex III. Deployer obligations apply from 2 December 2027. In the meantime, ask the vendor for its position and its instructions for use, appoint the person who will oversee the tool, and plan how workers' representatives will be informed.
Could an SME be fined €35 million?
That cap applies to prohibited practices. For an SME, the cap used is the lower of the two amounts provided for, and the authority may limit itself to a warning.

Sources

The texts consulted

Page up to date as of 10 October 2026. The articles are read in the version consolidated as of 27 July 2026, published by the European Commission.

AI audit for SMEs and mid-sized companiesIdentify actual use, including use that has not been declared.Risks and controlThe five real risks of AI in business and their countermeasures.Questions and answersShort answers on regulation, costs and organisation.Understanding AIWhat generative AI is, what it does well, what it does badly.

Next step

Find out which AI tools are in use in your company

The first conversation lasts thirty minutes, with no commitment. It is used to decide what to look at first.

Book 30 minutesTake the AI maturity test