If your website has a chatbot, your phone line has an AI receptionist, your ads use AI-generated visuals or your HR team lets software pre-sort applications, the EU AI Act applies to you — not just to OpenAI, Google or Microsoft. The good news: for most small and mid-sized companies the obligations are narrow, predictable and inexpensive to meet once you know which ones apply and when. The bad news: some of them have been in force since February 2025, and the transparency rules switched on in August 2026.
This guide maps the complete timeline after the Digital Omnibus amendments, shows where typical SMB use cases land, explains the fines, and ends with a 30-day plan you can run without a legal department.
The AI Act in one paragraph
The AI Act (Regulation (EU) 2024/1689) regulates artificial intelligence by risk. A short list of practices is banned outright. “High-risk” systems — in hiring, credit, education, critical infrastructure and a few other areas — carry heavy obligations. Systems that talk to people or generate content carry transparency duties. Everything else is “minimal risk” and can be used freely, subject to general law such as the GDPR. In July 2026 the EU adopted the Digital Omnibus package (Regulation 2026/1744, in force since 27 July 2026), which pushed back the high-risk deadlines but left the transparency rules untouched (Cooley, ActuIA).
First question: are you a provider or a deployer?
Almost every duty in the Act attaches to a role, so start here.
- Provider — whoever develops an AI system (or has it developed) and places it on the market or puts it into service under its own name. Think OpenAI, a SaaS vendor selling an AI receptionist, or a software house selling its own AI product.
- Deployer — whoever uses an AI system under its authority in a professional context. A dental clinic using an AI receptionist, an online shop running a support bot, an HR team using a screening tool.
Most SMBs are deployers. You can, however, become a provider without noticing (Article 25): if you put your own name or trademark on a high-risk system, make a substantial modification to it, or use a general tool for a high-risk purpose — for example, turning a general-purpose chatbot into a candidate-ranking engine. If an agency builds a custom agent for you, the contract should state clearly who holds which role.
The timeline after the Digital Omnibus
| Date | What applies | What it means for an SMB |
|---|---|---|
| 2 Feb 2025 | Prohibited practices (Art. 5), including emotion recognition at work and in education; AI literacy (Art. 4, softened by the Omnibus into “support measures”) | Switch off any emotion analytics on staff; train the people who use AI |
| 2 Aug 2025 | Obligations for providers of general-purpose AI models (GPAI) | Mostly your model vendors — make sure their documentation reaches your contracts |
| 2 Aug 2026 | Transparency (Art. 50): disclose chatbots and voice agents, machine-readable marking of synthetic content, labelling of deepfakes | Every customer-facing bot and voice agent must say it is AI; marketing must label realistic synthetic media |
| 2 Dec 2026 | End of the marking grace period for generative systems placed on the market before 2 Aug 2026; new bans on non-consensual intimate deepfakes and CSAM | Update your acceptable-use policy; expect watermarking in vendor tools |
| 2 Dec 2027 | High-risk systems in Annex III: employment, credit, education, essential services, biometrics and more | Hiring tools, scoring and admission systems need full deployer controls |
| 2 Aug 2028 | High-risk AI inside regulated products (Annex I: medical devices, machinery, vehicles) | Relevant for manufacturers and med-tech |
Sources: ActuIA, AI Act Explorer, Jones Walker.
The most common misreading of the Omnibus is “the AI Act has been postponed”. It has not. Only the high-risk dates moved. If there is a chatbot on your website today, its transparency duty is already live.
Where typical SMB use cases land
| Use case | Risk tier | Main duty | Applies from |
|---|---|---|---|
| Website or WhatsApp support bot | Transparency | Tell users they are talking to AI | 2 Aug 2026 |
| AI receptionist or voice agent | Transparency | Disclose at the first interaction | 2 Aug 2026 |
| AI-generated ad visuals, avatars, voice clones | Transparency (deepfakes) | Visible label; consent for any real person’s likeness | 2 Aug 2026 |
| Internal knowledge assistant (RAG) | Minimal | AI literacy, GDPR | Already |
| Invoice and document extraction | Minimal | GDPR, human check on exceptions | Already |
| Call QA scoring script adherence and outcomes | Minimal | GDPR; no emotion inference | Already |
| Call QA that infers agents’ emotions | Prohibited | Switch it off | Since 2 Feb 2025 |
| CV screening, candidate ranking, interview scoring | High-risk (Annex III) | Deployer duties, Art. 26 | 2 Dec 2027 |
| Consumer credit scoring | High-risk (Annex III) | Deployer duties, Art. 26 and 27 | 2 Dec 2027 |
This is a simplification: the exact classification depends on the intended purpose of the system. Article 6(3) also lets some Annex III systems fall outside the high-risk tier when they only perform a narrow procedural task and do not materially influence a decision — but that exception has to be assessed and documented, not assumed.
What is already banned
Article 5 has applied since 2 February 2025, and its list is short but absolute (full text):
- manipulative or deceptive techniques that cause significant harm;
- exploiting vulnerabilities linked to age, disability or social and economic situation;
- social scoring;
- predicting criminal offences purely from profiling or personality traits;
- untargeted scraping of facial images to build recognition databases;
- biometric categorisation to infer sensitive traits such as religion or sexual orientation;
- emotion recognition in the workplace and in education (Art. 5(1)(f)), except for medical or safety reasons.
The last ban is the one SMBs actually trip over. “Sentiment” dashboards that score how frustrated or enthusiastic call-centre agents sound are a popular product category in the US. In the EU, quality control has to assess what was said and done — script adherence, resolution, mandatory phrases — not how the employee felt.
Transparency since 2 August 2026
Article 50 is the duty most SMBs face today (text):
- Bots and voice agents must inform people that they are interacting with AI, at the latest at the first interaction, unless it is obvious from the context.
- Providers of generative tools must mark outputs in a machine-readable way. The transparency Code of Practice, which the Commission confirmed as adequate, expects at least two layers — for example signed metadata plus an invisible watermark (Reed Smith).
- Deployers who publish deepfakes — realistic synthetic images, audio or video — must label them visibly. Under the Commission’s final guidelines of 20 July 2026, advertising generally does not qualify for the lighter regime reserved for artistic or satirical work (Faegre Drinker).
- Fines for transparency breaches reach €15 million or 3% of worldwide turnover.
Wording, placement and edge cases are covered in our Article 50 guide. If your agents also call customers in the US, read legal AI phone calls: TCPA, AI Act and GDPR.
High-risk from 2 December 2027: what deployers must do
If you use AI to screen candidates, decide on promotions, assess creditworthiness or grade students, you are deploying a high-risk system. The heavy lifting — risk management, technical documentation, conformity assessment, CE marking, registration — sits with the provider. The deployer’s duties under Article 26 are still substantial:
- Use the system according to the provider’s instructions for use.
- Assign human oversight to people with the competence, training and authority to override it.
- Make sure the input data you control is relevant and sufficiently representative.
- Monitor operation and report serious incidents and risks to the provider and the authority.
- Keep the automatically generated logs for at least six months.
- Inform workers and their representatives before using a high-risk system at the workplace.
- Inform people that decisions about them are made or supported by a high-risk system; they have a right to an explanation (Art. 86).
- Carry out a GDPR data protection impact assessment where required, using the provider’s information.
Public bodies, private companies providing public services, and deployers that score consumer credit or price life and health insurance must additionally run a fundamental rights impact assessment (Art. 27).
Hiring is the high-risk area SMBs encounter most often. Workday’s acquisition of Paradox, a recruiting assistant with 189 million candidate conversations behind it, shows how quickly this technology is spreading (HR Executive). We unpack the rules in AI in hiring: high-risk rules and safe use.
Fines and enforcement
- Prohibited practices: up to €35 million or 7% of worldwide annual turnover.
- Most other breaches, including transparency and high-risk duties: up to €15 million or 3%.
- SMEs and start-ups: the lower of the two amounts applies (ActuIA).
Enforcement is national. Germany, for example, assigned AI market surveillance to the Bundesnetzagentur under the KI-MIG law, effective 29 July 2026. Fines are not the only risk, either: a non-compliant bot can be pulled by a platform, flagged by a regulator or rejected by an enterprise customer’s procurement team long before any penalty is issued.
A 30-day action plan
Week 1 — Inventory. List every AI system in use: SaaS features (helpdesk AI, CRM assistants), custom agents, and the browser tools employees pay for themselves. Shadow AI is real: in the US around 27% of AI application spend comes from self-serve purchases, and nearly 40% if you include personal cards (Menlo Ventures). For each system, note its purpose, vendor, the data it processes and who is affected.
Week 2 — Classify. For every system, decide your role (provider or deployer) and its tier (prohibited, high-risk, transparency, minimal). Write down the reasoning in two or three sentences. Switch off anything that falls under Article 5.
Week 3 — Fix the live duties. Add disclosure lines to bots and voice agents, labels to synthetic media, and update your privacy notice. Review vendor contracts: do they cover machine-readable marking, access to logs and instructions for use?
Week 4 — People and roadmap. Run a one-hour AI literacy session for everyone who uses AI and keep the attendance list. Even after the Omnibus softened Article 4, documented training remains your best evidence of diligence. For any high-risk candidate, draft a roadmap to December 2027: oversight owner, logging, worker information, DPIA.
Put everything into one folder: inventory, classifications, disclosure texts, training records, vendor documents. That folder is your answer when a customer, auditor or authority asks how you handle AI.
Typical mistakes
- “We only use ChatGPT, the Act is for AI companies.” Using AI professionally makes you a deployer.
- Reading the Omnibus as a general delay. Transparency has applied since 2 August 2026.
- Outsourcing responsibility to the vendor. A compliant tool used for the wrong purpose — or without disclosure — is still your problem.
- Keeping “emotion AI” in call QA. It has been banned at the workplace since February 2025.
- Skipping the inventory. You cannot classify what you have not listed.
- Treating the AI Act separately from the GDPR. In practice the same system needs both: a DPIA, a data processing agreement with vendors, retention rules. See GDPR for AI chatbots.
Compliance as a competitive advantage
European buyers are cautious. Among German companies already using AI, 66% name data protection requirements and 56% legal uncertainty as obstacles (Bitkom). Across the EU only 17% of small companies used AI in 2025, compared with 55% of large ones (Eurostat). When you can show a clean inventory, ready disclosure texts and a vendor file, you remove the top objections before procurement even raises them — and that shortens sales cycles for your own AI-powered services too.
Conclusion
For most SMBs the AI Act boils down to four habits: stay away from the banned practices, tell people when they are talking to a machine, label realistic synthetic media, and prepare properly before December 2027 if you touch hiring, credit or education. None of this requires a compliance department. It requires an inventory, a few clear texts and the discipline to document decisions.
At Lotus Libre we build AI agents and governed AI systems with disclosure, logging and EU hosting designed in from day one. If you want to know where your current tools land on the timeline, book a free 15-minute audit — we will map your systems and tell you what, if anything, needs fixing.
This article is general information and not legal advice. For decisions about your specific situation, consult a qualified lawyer.