EU AI Act 2026: What Businesses Need to Know Now
The EU's AI regulation is taking effect step by step, and it affects far more than just tech corporations. If your business uses a chatbot, CV screening or lead scoring, you should know the obligations in 2026. Here is the pragmatic overview.
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive regulation of artificial intelligence. In force since August 2024, the regulation takes effect in stages. The first prohibitions already became enforceable in February 2025. 2026 brings the next big wave, and with it obligations that can affect any company that uses or offers AI.
The good news: contrary to what is often claimed, the AI Act is not a bureaucratic monster that turns every chatbot into a compliance nightmare. Most applications at small and mid-sized businesses fall into the "minimal risk" category and need practically no additional documentation. But there are clear obligations for high-risk systems and transparency obligations for many everyday AI applications. If you act blindly here, you risk hefty fines.
Especially important to know: the AI Act applies extraterritorially. As soon as an AI system is used in the EU, or its output is used in the EU, the regulation applies, no matter where the provider is based. For SMEs, this means: even if you use US tools like ChatGPT, Claude or Gemini, you are responsible as the deployer in the EU. The GDPR already set the standard here, and the AI Act follows the same logic.
This article gives you a factual overview: which deadlines matter in 2026, which risk class your use case falls into, what you need to document, and which five steps you should tackle now.
Key deadlines in 2026 (chronological)
The AI Act doesn't take effect all at once, but in stages. Here are the most important dates at a glance:
| Date | What takes effect | Relevant for |
|---|---|---|
| Feb 2, 2025 | Ban on AI with "unacceptable risk" (social scoring, manipulative AI, real-time biometric identification) | All companies |
| Aug 2, 2025 | Obligations for general purpose AI (GPAI), mainly affecting model providers such as OpenAI, Anthropic, Google | AI model providers, indirectly all users |
| Aug 2, 2026 | Main application: transparency obligations, obligations for high-risk systems, AI literacy obligation (Art. 4) | All companies that use AI |
| Aug 2, 2027 | High-risk requirements for products with embedded AI (e.g. medical devices, machinery) | Manufacturers of regulated products |
For you as an SME, August 2, 2026 is the key date. From then on, the transparency obligations and high-risk requirements apply in full. The AI literacy obligation under Art. 4 also becomes enforceable from that date: employees who use AI must have a "sufficient level of AI literacy".
A common misconception: the AI Act does not replace the GDPR. Both apply in parallel. If your AI system processes personal data (which is very often the case), you still need a legal basis under the GDPR, a data protection impact assessment for high-risk applications and transparent information for the people affected. The AI Act comes on top, not instead.
What about general purpose AI (GPAI)? These are models that can be used for all kinds of tasks, like GPT-4, Claude or Gemini. Since August 2025, their providers have had to supply transparency documentation, publish summaries of their training data and respect copyright. As an end user, you benefit from this: the big providers now publish extensive compliance information that you can reference in your own documentation.
The 4 risk classes: what does each one mean for your use case?
The AI Act follows a risk-based approach. The greater the potential risk to fundamental rights, health or safety, the stricter the rules. These are the four classes you should know:
1. Unacceptable Risk (prohibited)
These AI applications have been completely banned in the EU since February 2025, regardless of their purpose:
- Social scoring by public authorities (rating people based on their behavior)
- Manipulative AI that subliminally influences behavior and causes harm
- Emotion recognition in the workplace and in educational institutions
- Real-time remote biometric identification in public spaces (with narrow exceptions for law enforcement)
- Predictive policing based solely on profiling
2. High Risk (strictly regulated)
These systems are allowed, but they are subject to extensive obligations: conformity assessment, risk management, data quality, transparency, human oversight, logging. Examples from everyday SME life:
- CV screening and automated applicant selection
- Employee evaluation, promotion or termination decisions
- Credit scoring for private individuals
- Access to education or social benefits
- Critical infrastructure (energy, water, transport)
3. Limited Risk (transparency obligation)
The rule here: users must know that they are interacting with AI. In practice, this means:
- Chatbots must identify themselves as AI
- Deepfakes and AI-generated content must be labeled
- Emotion recognition systems (outside prohibited contexts) require a notice
- Biometric categorization must be disclosed
4. Minimal Risk (no obligations)
The vast majority of all AI applications fall into this class. Examples: spam filters, product recommendations, translation, spell checking, code assistants for in-house developers. No obligations specific to the AI Act, but the GDPR and sector-specific rules of course still apply.
Concrete SME scenarios: what is allowed and what isn't?
So this doesn't stay abstract, here are five typical scenarios from small and mid-sized businesses:
Scenario 1: Customer service chatbot on your website
Risk class: Limited Risk. What you need to do: Show a visible notice that the chatbot is an AI, not only when someone asks. A sentence like "Hi, I'm Cleo, the AI assistant of Cogswell IT" is usually enough. In addition: handle conversation data in line with the GDPR.
Scenario 2: CV screening with AI
Risk class: High Risk (Annex III, point 4). What you need to do: Substantial obligations: a risk management system, proof of data quality, logging, human oversight (a person must actually be able to review the AI's decision, not just rubber-stamp it), technical documentation, information for applicants. Without proper compliance: hands off.
Scenario 3: Lead scoring in B2B sales
Risk class: Usually Minimal Risk, because only companies are being evaluated. What you need to do: Nothing specific to the AI Act, but observe the GDPR as soon as personal data of contact persons is processed.
Scenario 4: Voice agent for phone orders
Risk class: Limited Risk. What you need to do: Disclose at the start of the call that the caller is speaking with an AI agent ("Hello, I'm the digital assistant of Restaurant X"). Handle recordings and data processing in line with the GDPR, as before.
Scenario 5: Automated decision on contract renewal
Risk class: Depends on the context. For consumers and decisions with significant impact (e.g. insurance, credit, housing): High Risk. For standard B2B contracts: usually Minimal Risk. What you need to do: When in doubt, treat it as High Risk or have a human make the final decision.
Documentation obligations: what do you have to prove?
The AI Act distinguishes between providers (whoever develops the AI system or markets it under their own name) and deployers (whoever uses the AI system). The obligations differ, and most SMEs are deployers.
As a deployer (you use AI):
- Demonstrate AI literacy (Art. 4): employees who operate AI must be trained. A short internal training session with documentation is usually enough.
- For high-risk systems: follow the provider's instructions, keep logging data for 6 months, inform the people affected, carry out a data protection impact assessment.
- Transparency: for limited-risk systems, place visible notices about the use of AI.
- Appoint a responsible person: one person should be the internal point of contact for AI topics.
As a provider (you build and sell AI):
- Technical documentation according to Annex IV (for high-risk systems): system description, data management, testing procedures, risk assessment.
- Conformity assessment and CE marking for high-risk systems.
- Post-market monitoring: document problems, report serious incidents within 15 days.
- Set up a quality management system.
Penalties and risks: how high are the fines?
The fines in the AI Act are tiered in the style of the GDPR, and in some cases they are significantly higher:
| Violation | Maximum fine |
|---|---|
| Use of prohibited AI practices (Art. 5) | up to €35 million or 7% of worldwide annual turnover |
| Violation of obligations for high-risk AI | up to €15 million or 3% of worldwide annual turnover |
| Providing incorrect information to authorities | up to €7.5 million or 1% of worldwide annual turnover |
For SMEs, the lower of the two amounts always applies (Art. 99(6)). That reduces the risk compared with large corporations, but it doesn't change the fact that even six-figure fines can threaten a company's existence. On top of that come the reputational risk and possible civil law consequences if someone is harmed by faulty AI.
5 concrete steps you should take NOW
- Create an AI inventory. List all AI systems in use at your company, including the AI built into standard tools (Microsoft Copilot, Salesforce Einstein, HubSpot AI, etc.). Without this inventory, you can't manage compliance.
- Assign risk classes. Go through the list and classify each use case. If you're unsure, treat the case as the next higher level. That saves discussions later.
- Build AI literacy. Plan a short internal training session by August 2026. The goal: employees understand what AI can do, where its limits are, how to spot hallucinations and how to handle data carefully. Document the training.
- Implement transparency notices. Chatbots, voice agents, AI-generated content: wherever limited-risk obligations apply, check your notices. One sentence is often enough, but it has to be visible.
- Appoint a responsible person and define a process. One person as "AI Officer", or at least as the point of contact. Plus a simple process for checking new AI tools before they are used. This doesn't have to be a bureaucratic monster: a one-page checklist is enough.
FAQ
Am I affected if I only use ChatGPT for writing?
Yes, but only minimally. As a deployer, you fall under the AI literacy obligation (Art. 4): employees should have a basic understanding of how the tool works and where the risks lie. If ChatGPT output has to be recognizable to customers as AI-generated (e.g. images, deepfakes), transparency obligations are added. Purely internal writing remains uncritical.
What if our AI provider is based outside the EU (e.g. OpenAI, Anthropic)?
The AI Act applies extraterritorially: every provider whose system is used in the EU is covered. The big providers have appointed EU representatives and are adapting their products. As a deployer, you are still responsible for how you use it. Look for compliance assurances when you sign the contract.
Do I need an "AI Officer", like a data protection officer?
There is no formal obligation like the one for a data protection officer. But a named responsible person is best practice and makes contact with the authorities easier. For high-risk applications, human oversight has to be organized anyway, and that includes clear responsibility.
What about open-source AI?
Freely available open-source models are largely exempt from the provider obligations, unless they involve high-risk applications or general purpose AI with systemic risk. If you use open-source models in your product, however, you take on responsibility for the specific use case as the deployer or integrating provider.
Not sure whether your AI setup complies with the AI Act?
A 30-minute intro call. We go through with you which use case falls into which risk class.
Request a compliance check →