What is the EU AI Act and how does it affect SMEs?
The 芦EU AI Act禄 is Regulation (EU) 2024/1689. It applies directly in every EU Member State since 1 August 2024, with phased entry into force: prohibited practices (Art. 5) and AI literacy (Art. 4) from 2 February 2025, GPAI obligations from 2 August 2025, and the national competent authorities gain their enforcement powers on 2 August 2026. After the Digital Omnibus agreement of May 2026 (formal adoption pending), the obligations for high-risk systems are postponed and apply from 2 December 2027 (Annex III, stand-alone systems) and 2 August 2028 (Annex I, AI embedded in regulated products). It affects any SME or SMB that deploys, markets or uses AI systems, regardless of sector.
What are the EU AI Act obligations for an SME?
An SME has five groups of obligations depending on its role and the AI systems it uses. Art. 4: promote AI literacy among staff. Art. 5: do not use prohibited AI systems. Art. 26: comply with provider instructions when deploying high-risk systems, keep records, ensure human oversight. Art. 50: inform users when interacting with chatbots, label AI-generated content. Art. 27: carry out a FRIA when deploying high-risk systems in sensitive sectors.
My SME only uses ChatGPT, is the AI Act still relevant?
Yes. Using general-purpose cloud AI assistants (ChatGPT, Copilot, Gemini, Claude) triggers at least two obligations: the obligation of means to support AI literacy among staff (Art. 4) and, where chatbots interact with customers, the duty to inform users and label AI-generated content (Art. 50). GDPR also applies: data entered into a public cloud assistant may amount to an international transfer, which requires verifying the legal basis and the provider's contract.
What fines does the EU AI Act provide for?
Article 99 sets three tiers: up to EUR 35 million or 7 % of worldwide annual turnover for breaches of Article 5 prohibitions; up to EUR 15 million or 3 % for breaches of certain provider and deployer obligations (Articles 16, 26 and 50, among others); up to EUR 7.5 million or 1 % for supplying incorrect information to an authority. The AI Act sets no specific fine for Article 4 (AI literacy): its sanctions are left to each Member State. For SMEs, SMBs and startups, Article 99(6) requires that fines be calibrated by size and turnover. Each Member State designates its own enforcement authority.
When does active enforcement really start?
Prohibited practices and AI literacy are enforceable since 2 February 2025. GPAI obligations since 2 August 2025. On 2 August 2026 the national competent authorities gain their supervision and enforcement powers, including over Article 4. After the Digital Omnibus of 7 May 2026 (formal adoption pending), the high-risk obligations are postponed: Annex III stand-alone systems to 2 December 2027 and Annex I systems embedded in regulated products to 2 August 2028.
What is AI literacy under Article 4 and how do you comply?
Article 4 requires providers and deployers to take measures to support a sufficient level of AI literacy among staff. Following the Digital Omnibus of 7 May 2026 it is framed as an
obligation of means, not an obligation of result, but the duty remains. It is satisfied with a documented training programme covering the legal framework, usage risks, GDPR applied to AI, transparency and prohibited practices. Freshlab provides a turnkey training service at
EUR 20 per participant with named certificates and a cryptographically signed audit dossier. More at
Art. 4 AI Act Training.
Which AI practices are prohibited for an SME (Article 5)?
Article 5 prohibits, including for SMEs: social scoring of natural persons, emotion recognition in the workplace and education (except for medical or safety reasons), biometric categorisation to infer race, ideology, sexual orientation, religion, systems that exploit vulnerabilities, subliminal techniques, and real-time remote biometric identification in publicly accessible spaces. An SME using HR software with video or voice emotion analysis has been in breach of Article 5 since 2 February 2025.
What obligations does a deployer have under Article 26?
When deploying a high-risk AI system (HR, credit scoring, insurance, education, critical infrastructure, justice), Article 26 requires: following provider instructions, assigning human oversight to persons with the necessary competence and authority, controlling input data, retaining logs for at least six months, reporting serious incidents, and notifying natural persons affected by AI-based decisions. In employment contexts, you must also inform workers' representatives before putting the system into service.
When is a FRIA mandatory?
Article 27 requires deployers that are public-law bodies, providers of public services or operators in sensitive sectors (banking, insurance) to carry out a FRIA before putting a high-risk AI system into service. The FRIA covers deployment processes, period of use, categories of persons concerned, specific fundamental-rights risks and oversight measures. The outcome is notified to the market surveillance authority. An SME serving a public administration or a bank may need to support its client's FRIA.
What are the transparency obligations under Article 50?
Article 50 sets four requirements from 2 August 2026. Chatbots interacting with natural persons must clearly disclose the AI. AI-generated content (image, audio, video, significant text) must be machine-readable labelled and, where appropriate, disclosed to the user. Deepfakes must be explicitly labelled. When using permitted emotion recognition or biometric categorisation, exposed persons must be informed.
How does local AI (without cloud) fit AI Act compliance?
Local AI infrastructure (on-premise LLM)
does not exempt you from the Regulation, but simplifies several blocks.
GDPR: no international data transfer to justify.
Art. 4: training is the same.
Art. 50: still applies to chatbots. The real AI Act benefits of local AI are
full traceability of input data,
complete logs under your control, no shadow AI with sensitive data, and compatibility with national data protection rules for specially protected data. More at
Local AI & Localized AI.
What about GPAI models that my SME uses?
The GPAI obligations under Articles 53 and following (technical documentation, copyright compliance policy, training-data summary) fall on the model provider, not on the SME using it. As a deployer of a GPAI-based tool (ChatGPT, Copilot, Mistral), your SME's responsibility is the same as any deployer's: Art. 4, Art. 50 and GDPR. If your SME integrates a GPAI model into a product it markets, it then takes on provider obligations for that product.