Complete guide → For the full breakdown of EU AI Act obligations for SMEs and SMBs (Art. 4, 5, 26, 27, 50, fines, timeline), see our complete EU AI Act SME compliance guide.
Since when do the AI Act GPAI obligations apply, and by when must existing models catch up? The obligations for general-purpose AI models have applied since 2 August 2025, models already on the market before then must comply by 2 August 2027 under Article 111(3), and the rules are enforceable through the Commission's powers since 2 August 2026. For a company that merely uses such a model, a different question matters: which deployer duties already bind you today.
Stand: 2026-10-06
Regulation (EU) 2024/1689, the AI Act, is in force for the large language models that European businesses use every single day: ChatGPT, Claude, Gemini, Mistral Large. If you deploy any of these in a work context, you are not a passive user. You are a "deployer" under the AI Act, and deployers have obligations.
The European SMB market largely shrugged this off for a long time. In our work with clients across the EU, fewer than 15 percent had documented their deployer duties at all. Most are betting that national regulators and the European Data Protection Board (EDPB) will go after large enterprises first. That is a risky bet: the AI Act interlocks with the GDPR, and the fine ceilings, up to 35 million euros or 7 percent of global annual turnover, flow through Article 99 straight to national market-surveillance authorities.
What the AI Act requires
The core GPAI rules sit in Article 53 of the Regulation. Providers of general-purpose AI models must:
- Maintain up-to-date technical documentation of the model (Art. 53(1)(a)) covering training data, evaluation, and energy consumption.
- Supply information to downstream providers (Art. 53(1)(b)) so they can meet their own obligations.
- Implement a policy for EU copyright compliance (Art. 53(1)(c)), including respect for text-and-data-mining opt-outs under Art. 4(3) of the DSM Directive.
- Publish a sufficiently detailed summary of the training data (Art. 53(1)(d)).
For models with "systemic risk" (Art. 55), roughly every frontier model above 10^25 FLOPs of training compute, add red-teaming, incident reporting, and cybersecurity duties. The Code of Practice introduced by Art. 56, whose final version the Commission published on 10 July 2025 across three chapters on transparency, copyright, and safety and security, operationalises these. It is voluntary but serves as a route to demonstrate conformity.
More immediately relevant for SMBs is Article 50: anyone publishing AI-generated text, images, or audio must label them as such when they resemble real persons, places or events (the deepfake clause). Synthetic text output must also be machine-readably marked as AI-generated. This transparency duty has applied since 2 August 2026.
Provider vs deployer
The AI Act separates two roles cleanly, and which one you are determines everything:
- Provider (Art. 3(3)) is whoever develops the AI system or places it on the market under their own name. For GPT-4, that is OpenAI. For Llama 3.3, that is Meta. In almost every case, it is not your SMB.
- Deployer (Art. 3(4)) is whoever uses an AI system under their own authority. That is the accounting firm in Dublin drafting client letters with Claude. The Amsterdam online retailer generating product descriptions with GPT-4. That is you.
Deployer obligations are lighter than provider obligations, but they are real. The GPAI obligations bind model providers (applying since 2 August 2025, due for legacy models by 2 August 2027, enforceable since 2 August 2026). For deployers, Art. 4 and Art. 50 remain the relevant duties; high-risk duties under Art. 26 apply only from 2 December 2027. Where your own role flips from deployer to provider is covered in deployer or provider.
Deployer obligations in detail
Based on our reading of the AI Act, four obligations every EU SMB using language models should review:
- Transparency towards users (Art. 50(1) and (4)). Customers speaking to your AI chatbot must be told. Applicants whose documents are pre-filtered by an AI tool must be told. AI-generated text on your website needs a disclosure.
- AI literacy (Art. 4). Since 2 February 2025 the AI Act requires measures to support the development of AI literacy among the people working with the system. It is the most easily overlooked and the most easily met of the duties.
- Data Protection Impact Assessment. The moment personal data flows into the model, employee names, customer records, health data, Art. 35 GDPR requires a DPIA. That is not strictly an AI Act obligation, but the EDPB and national authorities read both texts together. When a DPIA becomes mandatory is set out in DPIA for an AI system.
- Record-keeping (Art. 26(6), for high-risk systems from December 2027). Automatically generated logs must be retained for at least six months where the deployer controls them. With cloud APIs, you usually do not control them, the provider retains logs under its own policy, not yours. That gap is a compliance problem.
Why local LLMs are the simplest compliance answer
Here is where the strategic opportunity shows up. The Schrems-II ruling of the CJEU (C-311/18) made clear that transferring personal data to the United States without additional safeguards is incompatible with the GDPR. The 2023 EU-US Data Privacy Framework has formally defused the issue, but noyb and other NGOs have already filed challenges. Building today on US cloud models alone means placing a political bet on whether that framework survives.
Layer the AI Act on top. When you run a cloud model, you inherit dependencies on the upstream provider: their technical documentation, their training-data summary, their incident reporting. You must reference these in your own deployer records, and you get only what the provider chooses to release.
Running a local model solves both problems in one step. Open models such as Llama, Qwen or Mistral run, according to community measurements, on a well-specified workstation fast enough for production use. The weights are openly available, the model cards are documented, and inference happens in your own server room. No Schrems-II question. No hyperscaler logs. No dependence on a foreign provider's next policy update.
The saving on deployer duties is substantial: your DPIA becomes simpler (no third-country transfer), your logs sit on your own hardware, your transparency obligations can be met end-to-end. In short, you move the compliance burden from the legal side of the house to the technical side, and that is where we prefer to have it.
Implementation details live in our guide to data sovereignty.
What to do now
A minimal roadmap for a typical 20-200-person European SMB:
- Inventory. List every AI service used in your company. Include shadow IT, your staff use AI tools on personal accounts, and you know it. Classify each use by risk tier under Annex III.
- DPIA and deployer records. For each use involving personal data, run a DPIA. For each deployment, write a short deployer description: purpose, data flows, accountable person, human oversight arrangements.
- Transparency and training. Labels on the website, in the chatbot, in generated content. Staff information sheet. Build AI literacy you can evidence, because Art. 4 has required it since February 2025. Our training programmes cover this mandatory piece.
- Strategic cut. Decide which use cases should move in-house. A pilot with an open model on dedicated hardware, retrieval-augmented against your knowledge base, a few weeks of evaluation. Most professional-services firms and manufacturers we work with run around 20 users comfortably on a single compact local setup.
The GPAI obligations are no longer a distant threat but settled law, and the deployer side of it counts every day. If you cannot build this alongside day-to-day operations, that is what we are here for. Start with a pilot project, 14 days, flat fee, a clean go/no-go decision at the end.