EU AI Act Q&A
EU AI Act for SMEs: every obligation, deadline and exemption — 2026/27
For most small businesses the Act is three live duties: AI literacy since 2 February 2025, transparency from 2 August 2026, and staying clear of the banned practices in Article 5. High-risk product rules were put back to December 2027 and August 2028; SMEs get the lower of two fine caps, not a free pass.
Answered by GlassBots' AI assistant — not a person, not legal advice. We review new questions and publish them as permanent answers.
For most small businesses the Act is three live duties: AI literacy since 2 February 2025, transparency from 2 August 2026, and staying clear of the banned practices in Article 5. If you only use everyday tools as the deployer, you are not asked to sign a Union register.
Extra high-risk product rules were put back to 2 December 2027 (Annex III uses) and 2 August 2028 (Annex I product-safety systems) by the Digital Omnibus on AI. That is extra time, not a pause on literacy or transparency. SMEs get the lower of two fine caps in each band — that is a ceiling, not a free pass.
This is general information, not legal advice.
What the law actually says
"It shall apply from 2 August 2026. However: (a) Chapters I and II shall apply from 2 February 2025."— EU AI Act, Article 113 (Regulation (EU) 2024/1689) · eur-lex.europa.eu
"Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I."— Article 113 as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI) · eur-lex.europa.eu
In plain words
- Chapter I includes Article 4 literacy — in force from 2 February 2025.
- Article 50 transparency — tell people they are talking to AI, and mark listed AI-made content — applies from 2 August 2026.
- Article 5 banned practices have applied since 2 February 2025. Almost no shop using a writing assistant is in that list; the page on prohibited practices explains how to be sure.
- If you only use everyday tools as the deployer, you are not asked to sign a Union register.
Timeline that actually bites a small shop
- 2 February 2025 — Article 4 literacy duty (Article 113(a); Chapters I and II).
- 2 August 2026 — Article 50 transparency, and the general application date in Article 113.
- 2 December 2027 — extra high-risk duties for Annex III uses, after the Digital Omnibus on AI (Regulation (EU) 2026/1744).
- 2 August 2028 — extra high-risk duties for Annex I product-safety systems, same Omnibus amendment.
Deployer versus provider, in plain words
"‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;"— EU AI Act, Article 3(4) (Regulation (EU) 2024/1689) · eur-lex.europa.eu
- Provider = the firm that puts the tool on the market (OpenAI, Microsoft, a vendor with its own named system).
- Deployer = you, when your business uses that tool under your authority. A sole trader counts.
- Personal, non-professional use is carved out. Serving customers is not personal use.
Reliefs that apply to small businesses — not a free pass
"In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower."— EU AI Act, Article 99(6) (Regulation (EU) 2024/1689) · eur-lex.europa.eu
- Article 99(6) is a lower cap, not a promise that nobody will ever be asked questions.
- The later high-risk dates are extra time for those systems. They do not pause Article 4 or Article 50.
- Article 62 asks Member States to help SMEs (including sandbox access). The exact help on offer is national — see the country guides.
Every answer in this Q&A
- Do I need to register my business somewhere for using AI tools?
- What are the fines, realistically, for a small business?
- When did the EU AI Act start applying to my business?
- Do I have to tell customers when AI wrote something?
- What counts as an "AI system" for a small business?
- Do my staff need AI training, and what counts as enough?
- What is a "deployer" — is that me?
- Does the EU AI Act apply if I'm outside the EU?
- What records should I keep, exactly?
- Does using free AI tools like ChatGPT create duties?
- I use my own personal AI account at work — do I have duties, or just my employer?
- Does the EU AI Act apply to sole traders?
- Do I need a lawyer to be compliant-ready?
- What happens at a border control or audit — what do I show?
- Can I use AI for hiring?
- Can I use AI to write customer emails?
- Do chatbots on my website need an AI notice?
- Is Excel-with-AI-features an AI system?
- What if I only use AI internally, never for customers?
- Do freelancers count as staff for training?
- What's the difference between the EU AI Act and GDPR?
- What AI practices does the EU AI Act ban?
- The EU AI Act in Germany
- The EU AI Act in France
- The EU AI Act in the Netherlands
- The EU AI Act in Spain
- The EU AI Act in Poland
What GlassBots does for this
- Scans your computer and lists every AI tool your business actually uses.
- Checks your settings files for the transparency basics and produces a plain-language readiness report.
- Runs in your browser, free, nothing uploaded.
Get notified
free · local · nothing uploaded
- Every month: re-scan, and the report can be updated each month — "what changed since last check" is written for you.
- Your records build into a printable readiness pack: tool inventory, training journal, disclosure checklist.
- Keeps the dated history an inspector would ask to see.
See a sample Guard Report →
Guard $29/month · cancel anytime
Did this answer your question?
Readiness guidance, not legal advice. GlassBots checks your own computer — nothing leaves it.