EU AI Act for SMEs: Which obligations now apply and what you need to do

The EU AI Act (AI Regulation, Regulation (EU) 2024/1689) regulates the use of artificial intelligence in the EU according to risk. For most small and medium-sized enterprises that only use AI tools such as chatbots, typing assistants or telephone assistants, two obligations are crucial today: Since February 2, 2025, companies must take measures that support the AI competence of their employees. Since August 2, 2026, the transparency obligation has been in force: people must be able to recognize that they are interacting with an AI system. The strict obligations for high-risk AI only affect certain areas of application and will only apply from December 2027.

This article classifies what affects your company and ends with a checklist. It does not replace legal advice. As of October 2026.

Provider or operator: What is the role of your company?

The obligations of the AI Regulation depend on the role:

• Providers develop an AI system or have it developed and market it under their own name, for example a software manufacturer.
• Operators use an AI system on their own responsibility, for example a craft business that uses an AI telephone assistant or an office that designs texts with a language model.

The vast majority of SMEs are operators. However, anyone who offers or significantly changes a third-party AI system under their own brand can become a provider themselves. This is particularly relevant for software houses and agencies.

The risk levels of the AI Regulation

Typical office applications in SMEs, such as drafting texts, searching documents, sorting inquiries or answering calls, fall into the "transparency" or "minimal" levels. Attention in applicant management: AI that sorts or evaluates applications is one of the high-risk applications.

What has been in force since February 2025: AI competence and bans

According to Art. 4, providers and operators must take measures to support the development of the AI competence of their staff and other persons who use AI systems on their behalf. Since the amendment by the Digital Omnibus (in force since 27 July 2026), they do not have to guarantee a certain level of competence of individual persons – the obligation to act remains. Previous knowledge, training, context of deployment and the people affected by the use of AI are taken into account. What this means in concrete terms is explained in the article AI competence according to Art. 4: What the obligation to train means.

Since the same date, certain AI practices have also been prohibited (Art. 5). For normal SME applications, they play practically no role.

What has been in force since August 2026: Transparency obligations

Since 2 August 2026, the transparency obligations under Art. 50 have been in force. Two cases in particular are relevant for SMEs:

• Chatbots and telephone assistants: Anyone who talks or writes to an AI system must learn at the latest at the beginning that it is an AI, unless this is obvious anyway. A sentence like "You are talking to the digital assistant of ..." is usually sufficient.
• Deepfakes and AI texts on topics of public interest: Artificially generated or manipulated images, videos and sound recordings that appear real must be disclosed as AI-generated. This also applies to texts on topics of public interest, unless a human has editorially checked them and is responsible.

If you use an AI chatbot or AI telephone assistant, you should therefore firmly incorporate the note into the greeting.

High-risk AI: Postponed to December 2027

Originally, the obligations for high-risk AI under Annex III were to apply from August 2026. Regulation (EU) 2026/1744, the so-called Digital Omnibus, postponed this date to 2 December 2027; for AI in Annex I products (such as machinery or medical devices), 2 August 2028 applies. Anyone who uses or plans to use AI in personnel selection, performance evaluation or credit checks should use the time, as the obligations for operators (Art. 26) include, among other things, human supervision, logging and informing those affected.

Who controls, and what threatens?

In Germany, according to the AI Market Surveillance and Innovation Promotion Act (KI-MIG) of 22 July 2026, the Federal Network Agency is generally the market surveillance authority; specialist authorities such as BaFin are responsible for certain areas. Fines are regulated by Art. 99 of the AI Ordinance. Violations of the transparency obligations can be punished with up to €15 million or 3% of global annual turnover; SMEs are subject to the lower of the two values. The regulation does not provide for a separate fine for AI competence under Art. 4. However, a lack of training can speak against you in the event of errors and liability issues.

Checklist for SMEs

1. Stocktaking: Which AI tools are used in the company, officially and unofficially? The latter in particular is common, see shadow AI in the company.
2. Classify: For each tool, record the role (operator/provider) and the risk level.
3. Ensuring AI competence: Training for all those who use AI is documented and adapted to the tasks.
4. Implement transparency: Notifications in chatbots, telephone assistants and AI-generated images or videos.
5. Set rules: A short AI guideline clarifies which tools are allowed and which data does not belong in them.
6. Check data protection: The AI Regulation does not replace the GDPR. Personal data still needs a legal basis and contracts for order processing.
7. Make a note of high risk: Those who use AI in HR plan the requirements for December 2027.

Counselling and accompanied implementation is eligible for funding: Through INQA coaching, the federal government covers 80% of the consulting costs of up to €1,200 per day for up to 12 days, i.e. up to €11,520 subsidy. In Mecklenburg-Western Pomerania and the other new federal states, BAFA consulting funding is also eligible at 80% until 31.12.2026 (50% in the old federal states). Funding is provided for consulting, not software. The funding check shows which program fits.

Frequently Asked Questions

Does the EU AI Act also apply to small companies?

Yes. The AI Regulation applies to all those who use or offer AI systems professionally, regardless of the size of the company. There are facilitations for SMEs, such as lower upper limits on fines and simplified documentation for providers, but there is no general exception.

Do I have to label ChatGPT in the company?

If employees use ChatGPT internally to design texts, they do not have to be labeled across the board. Chatbots in customer contact, deceptively real AI images, videos and voices, and AI texts on topics of public interest without human editorial review are subject to labeling.

Since when does the obligation to provide training under the AI Act apply?

The obligation under Art. 4 to take measures on AI competence has applied to all companies using AI systems since 2 February 2025. Since July 2026, it has been clarified that no specific level of competence has to be guaranteed.

Who is responsible for the AI Act in Germany?

According to the KI-MIG, the Federal Network Agency is generally the responsible market surveillance authority. BaFin is responsible for AI in the financial sector, and the respective specialist authorities are responsible for certain products.

When do the obligations for high-risk AI apply?

For high-risk systems according to Annex III, such as in the area of human resources, from 2 December 2027. For AI in regulated products according to Annex I from 2 August 2028. Both dates were postponed by Regulation (EU) 2026/1744.

Next step

If you want to know which of your AI applications trigger which obligations, our AI consulting will support you. For the training obligation, we offer AI training tailored to your tools and tasks.

Sources: Art. 4, Art. 50, Art. 99 and Art. 113 of the AI Regulation; Regulation (EU) 2026/1744; KI-MIG.