EU AI Act for SMEs: What you need to know in 2026

As of 10 October 2026

If your company uses ChatGPT for emails, an AI tool in recruiting or an AI-based credit check, it is already a deployer of an AI system within the meaning of the EU AI Act. With obligations, some of which already apply today. The common reflex “We don’t build AI, so this doesn’t affect us” therefore does not hold.

Since 2 August 2026, the situation has become clearer: the transparency obligations under Article 50 are in force, whereas the Digital Omnibus has postponed the high-risk obligations. And since the end of July, Germany finally has a competent supervisory authority under the KI-MIG. It is precisely this simultaneity of “applies now” and “only applies from 2027” that causes uncertainty. This article explains what really affects you as a small or medium-sized company. No alarmism, no playing down. One step at a time.

What the EU AI Act is and who it affects

The EU AI Act, officially the Artificial Intelligence Act, Regulation (EU) 2024/1689, is the world’s first comprehensive regulation of artificial intelligence. It has been in force since August 2024, but its obligations apply in stages over several years. As an EU regulation, it applies directly in all Member States, without Germany having to transpose it into national law first.

For SMEs, the distinction between two roles is important. Providers develop an AI system or have one developed and place it on the market or put it into service under their own name. Deployers use an AI system in their own operations. Most SMEs are deployers, not providers. One exception is more common than you might think: if you have a chatbot built for your own website and use it under your own name, you are its provider. But not building your own AI model does not automatically take you out of the scope of the Regulation.

This is exactly the underestimated point: even using ChatGPT for texts, an AI tool in recruiting or an AI-supported credit check makes you a deployer within the meaning of the law. Which obligations follow from this then depends on the risk class of the specific system, not on the size of the company.

The four risk classes

The EU AI Act does not regulate “AI” across the board, but takes a risk-based approach. The higher the risk to health, safety or fundamental rights, the stricter the obligations. There are four levels.

Unacceptable risk: certain applications are prohibited outright, such as the social scoring of persons (by public or private bodies) or manipulative systems that influence people’s behaviour to their detriment. These prohibitions already apply. With the Digital Omnibus, a further prohibition will be added on 2 December 2026: AI systems that are intended to generate non-consensual intimate material or child sexual abuse material, or that can generate such material without effective safeguards, will be expressly prohibited.

High risk: AI in sensitive areas such as recruitment, lending or critical infrastructure. In SMEs, the typical case is AI-supported applicant screening. The strictest obligations apply here: risk management, technical documentation, human oversight, record-keeping.

Limited risk: systems with transparency obligations. The classic example is the chatbot on your own website or an AI that generates images, texts and videos. Users must be able to recognise that they are dealing with a machine. For SMEs, this is the most common level of regulatory relevance, because generative AI is now widely used in marketing and customer service.

Minimal risk: the majority of today’s applications, from spam filters and product recommendations in the shop to AI in warehouse logistics. The AI Act creates no special obligations here. This is the majority of what a typical business actually uses.

For the vast majority of businesses, the systems in use fall into the two lower classes. Things get sensitive where AI makes decisions about people, above all in recruiting and creditworthiness.

What has the Digital Omnibus changed in the AI Act?

The Digital Omnibus on AI, Regulation (EU) 2026/1744, has been in force since 27 July 2026. It postpones the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), softens the AI literacy obligation and gives existing systems until 2 December 2026 for machine-readable marking. The other transparency obligations under Article 50 have applied since 2 August 2026.

This is the most important change of the year, and many older guides still present it incorrectly. In May 2026, the European Parliament and the Council reached agreement in the trilogue on the “Digital Omnibus on AI”, a package of targeted amendments to the AI Act.

It has since become adopted law: on 16 June 2026, Parliament approved the package (423 votes in favour, 57 against, 174 abstentions), and on 29 June 2026 the Council gave its final green light. On 24 July 2026, the package was published in the Official Journal of the EU as Regulation (EU) 2026/1744, and it entered into force on 27 July 2026, in time before 2 August 2026. The aim is simplification and more time for implementation.

The decisive effect: the deadline for the high-risk obligations that many companies were facing has been postponed. Instead of applying from 2 August 2026, these obligations now apply later in stages, as the table shows. Officially, the Council and Parliament justify the step with simplification and overlaps with sectoral law. The practical reason is more sobering: the technical standards and supervisory infrastructure on which the original timetable was based were not ready in time.

The deadlines in this article are therefore no longer “probable” but published law. If you based your compliance planning on the old timetable, you can now adjust it with certainty.

Digital Omnibus on AI and on the GDPR: only one is in force

The term regularly causes confusion, because on 19 November 2025 the European Commission presented two proposals under the name “Digital Omnibus”. The “Digital Omnibus on AI”, often also called the AI Omnibus, amends the AI Act and has been in force since 27 July 2026. It is the subject of this article.

The second, general Digital Omnibus concerns the GDPR, the EU Data Act and the cookie rules. It is not yet applicable law: as of October 2026, according to the Legislative Observatory, it is still awaiting the vote in the responsible committees of the European Parliament, and the Council has not yet adopted its own negotiating position.

For the GDPR and cookie consent, the previous legal situation therefore continues to apply until further notice. What the general Digital Omnibus provides for cookie banners is explained in our guide to cookies and the TDDDG.

What already applies to SMEs today

Regardless of the Omnibus, three obligations are in force: the prohibitions and AI literacy since 2 February 2025, plus the transparency obligations under Article 50 since 2 August 2026.

First, the prohibitions from the highest risk class. Very few SMEs are directly affected by them, but anyone using a purchased tool should know that emotion recognition in the workplace, for example, is largely prohibited.

Second, and this is the more practically relevant obligation: AI literacy under Article 4. Providers and deployers must take measures so that their staff who operate AI systems or use their results build the necessary AI literacy. This has applied since February 2025 and is not tied to any risk class.

The Omnibus retained this obligation but softened the wording: instead of ensuring AI literacy “to their best extent”, since 27 July 2026 companies take measures “to support” its development. The law expressly does not require a guaranteed level of literacy for each individual. In practice, this changes little. The basic obligation remains, and in both versions compliance is demonstrated with the same instrument: training measures that fit the context of use and are documented.

In everyday terms, this means: as soon as someone in your company uses an AI tool for work, you are obliged to provide training. The law does not prescribe certification. Pragmatic basic training plus role-specific in-depth training meets the requirement in most cases; practical formats such as AI workshops for the team cover exactly this need.

The transparency obligation and AI labelling

The third obligation that affects many businesses in 2026 is transparency under Article 50. The practical message is simple: chatbots must identify themselves as AI, and anyone who publishes deepfakes or certain AI-generated texts must disclose this.

There are two strands behind this. Providers must design chatbots and other systems that communicate directly with people in such a way that users recognise the AI. They also mark the outputs of generative systems in a machine-readable format as artificially generated (watermarking). Deployers, in turn, must disclose deepfakes and AI-generated texts published with the purpose of informing the public on matters of public interest, and inform the persons concerned if they use emotion recognition or biometric categorisation.

For the chatbot on your website, this means: if you had it developed yourself and operate it under your own name, you are its provider according to the Commission’s guidelines, and the AI notice in the greeting is your obligation. Which notices are sufficient and where the typical borderline cases lie is explained in the wiki entry on the AI labelling obligation.

The text obligation contains an exception that is regularly overlooked by SMEs. The Commission’s guidelines on Article 50 of 20 July 2026 make it clear: the disclosure obligation for AI-generated texts does not apply if the text has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for the publication.

For editorially managed content, this means: the obligation targets unreviewed mass output, not every text that has a responsible editorial team behind it. Artistic, creative, satirical and fictional works are also exempt.

It pays to be precise about the deadlines, because a lot of half-knowledge is circulating here. The general transparency obligations under Article 50, such as the providers’ chatbot notice and the labelling of deepfakes by deployers, have applied since 2 August 2026. The Omnibus expressly did not postpone them; the Commission and national authorities have been enforcing them since that day.

Only for the providers’ machine-readable watermarking under Article 50(2) does the finally adopted Omnibus differentiate: systems placed on the market before 2 August 2026 get a grace period until 2 December 2026. This grace period applies exclusively to Article 50(2). The chatbot notice, the labelling of deepfakes and the other transparency obligations under Article 50 are not covered by it and apply without any transition.

So if you use AI content in marketing today, the deadline has already passed. If you do not yet have a labelling practice, set it up now, not as a precaution but to catch up. According to the guidelines, you do not have to label retroactively: what was generated and published before 2 August 2026 can stay as it is. An older AI-generated text that only goes online now, however, needs the notice if it falls under the text obligation.

In practice, this does not mean much effort: a short notice that an image or a text is AI-generated is usually sufficient. The organisational side is more demanding, namely knowing at all where in the company AI content is created. That is exactly why the inventory comes at the beginning of every sensible approach.

You do not have to work out for yourself what proper labelling looks like. In June 2026, the Commission published a Code of Practice on Transparency of AI-generated Content. It is voluntary, but the Commission and the AI Board have confirmed it as a suitable way to demonstrate compliance. If you do not sign it, you have to demonstrate yourself that your own measures are equivalent.

It has been widely adopted: as of 31 July 2026, the Commission counted 95 organisations for the first section (providers) and 192 for the second (deployers), including Aleph Alpha and Lufthansa. The list is growing all the time, so the figures are a snapshot. The Commission had announced two signatory task forces for implementation for September 2026; as of early October 2026, it has not been publicly confirmed that they have started their work.

For the labelling itself, the Commission provides an official EU icon set: three symbols (“Basic”, “Fully AI-Generated”, “Partially AI-Modified”) in four variants each, as SVG and PNG, free of charge and without an attribution requirement. Using the icons is voluntary. You still have to label under Article 50. If you use the icons, you at least avoid the discussion of whether your own label is recognisable enough.

High-risk AI: Digital Omnibus postpones deadlines to 2027 and 2028

For high-risk systems, the timetable changes most clearly. Under the text finally adopted in June 2026, a two-stage approach applies:

Originally, the Annex III obligations were to apply from 2 August 2026. The postponement gives companies more time but does not change the substance: anyone who uses a high-risk system needs risk management, technical documentation, data quality, record-keeping and human oversight.

The EU has a clear expectation here: the additional time is not a reprieve for doing nothing but is meant to enable preparation. If you have a high-risk application in-house, such as AI-supported applicant screening, it is worth doing the inventory now, even if the hard deadline is not until the end of 2027.

One point provides noticeable relief for existing systems: under Article 111(2), operators of high-risk systems placed on the market or put into service before 2 December 2027 only have to meet the requirements if the system is subject to significant changes in its design. For applicant screening that has been running for years, the decisive question is therefore not the date but the next major redesign. If you are planning a release anyway, plan compliance at the same time.

Fines under the EU AI Act: caps, the SME rule, no case so far

The penalties under the EU AI Act are set higher than under the GDPR. The range of fines is graduated according to the severity of the infringement.

For infringements of the prohibitions in the highest risk class, the cap is €35 million or 7 per cent of worldwide annual turnover, whichever is higher. For infringements of other obligations, for example in the high-risk area, it is up to €15 million or 3 per cent. For supplying incorrect or incomplete information to authorities, up to €7.5 million or 1 per cent.

For SMEs and start-ups, the Regulation provides relief: here, the lower of the two values applies in each case, i.e. the absolute amount or the percentage, whichever is less. This significantly softens the top amounts, which are intended for large corporations.

The Omnibus has extended this relief. A new paragraph 6a in Article 99 extends the “whichever is lower” rule to small mid-cap enterprises (SMCs), but only for the two lower tiers: other infringements of obligations (€15 million or 3 per cent) and incorrect information to authorities (€7.5 million or 1 per cent). For the prohibitions under Article 5, the stricter variant remains.

If you read somewhere that the Omnibus has “reduced the fines”: that is not true. The caps are unchanged; only the group of companies that benefit has been extended.

Enforcement also takes effect in stages; part of the sanctions mechanism only becomes effective with the respective obligations. At least since 29 July 2026, it has been clear who is responsible in Germany at all.

Since 2 August 2026, the enforcement powers of the AI Office and the national authorities have also been effective; for this purpose, the AI Office has put a complaints tool, a whistleblower tool and a dedicated channel online for downstream providers, i.e. companies that build a third-party general-purpose AI model into their own product. For you as a deployer, one thing above all is relevant: there is now an open reporting channel, including for people who report you.

What still does not exist, by contrast, is a published fine. The Commission’s enforcement page describes powers and procedures, but no penalty.

This is worth mentioning because two things regularly get mixed up in the debate: the range of fines, which has applied since 2 August, and a fine actually imposed. If you base your compliance planning on figures you read in a newsletter, ask for the primary source first. For an imposed fine, there is none so far.

For most SMEs, the realistic scenario is therefore not the maximum fine but the simple need to properly fulfil the obligations on AI literacy and transparency that already apply. The greatest danger is not the maximum penalty but failing to deal with the topic at all.

Who enforces the EU AI Act in Germany: the Bundesnetzagentur

For a long time, the most important practical question went unanswered: who actually checks this? Since 29 July 2026, the gap has been closed. On that day, the Act on Market Surveillance and the Promotion of Innovation in Artificial Intelligence (KI-MIG) entered into force, one day after its promulgation in the Federal Law Gazette and thus just before the deadline for the transparency obligations.

The central point of contact is the Bundesnetzagentur (Federal Network Agency). It is market surveillance authority, single point of contact and complaints office in one, and it is responsible for prohibited practices, high-risk systems and the transparency obligations. For you as an SME, the practical part is more interesting than the supervisory part: the authority runs an AI Service Desk and has an explicit mandate to advise companies on implementation. That is a different remit from that of a pure sanctioning authority.

Three things can be used today. The AI Compliance Compass (in German) guides you through the risk classification, which is exactly the step where most inventories get stuck. Alongside it, there is a factsheet specifically for SMEs and start-ups. And the complaints office under Section 8 KI-MIG works exclusively via an online form and does not accept complaints by email. This is relevant in both directions, because competitors can use this route too.

The AI regulatory sandboxes, on the other hand, have not yet opened. So far, there is a completed pilot project and participation in an EU project, but no regular offering into which you could submit your system. This is not an omission: the Omnibus only obliges Member States to have at least one operational national sandbox in place by 2 August 2027.

One detail describes the situation well: the Bundesnetzagentur’s deadline timeline has now been fully updated for the Digital Omnibus and expressly marks the postponed entries. The authority’s AI home page, however, still shows the old summary that the rules would apply “in full from August 2027”. Two pages from the same authority, two states of knowledge. For you, this means: check deadlines against the text of the Regulation, not against an authority’s overview page.

One misunderstanding is worth avoiding: the Bundesnetzagentur is not responsible for everything. AI embedded in already regulated products remains with the respective product market surveillance authorities. AI in regulated financial activities falls to BaFin. AI at state authorities remains a matter for the federal states. Before you turn to an authority with a question, first clarify which one is actually the right one for your use case.

In practice, this means: the time when you could point to unclear responsibilities is over. There is a designated body, it accepts complaints, and it offers advice free of charge. If you are unsure about the risk classification, you have a first point of contact before buying in external consulting.

Roadmap for SMEs

Most SMEs do not need an oversized compliance machine. They need a structured start. A sensible order:

1. Inventory: record which AI systems are used in the company, in which departments and for what purpose. Without this inventory, no risk class can be assigned.
2. Risk classification: assign each system to one of the four classes. As a rule, most end up with minimal or limited risk. The few high-risk cases, often in recruiting, deserve special attention.
3. Build AI literacy: set up and document training. Alongside the transparency obligation, this is the obligation that applies to every deployer regardless of the risk class.
4. Regulate labelling: define how AI-generated content is labelled and how your chatbots identify themselves as AI. The transparency obligation has applied since 2 August 2026; this point is no longer preparation but compliance. The grace period until 2 December 2026 only concerns machine-readable watermarking, and that is owed by the providers of generative systems that came onto the market before 2 August 2026. Ask your tool providers how they implement it.
5. Define responsibility: name who is responsible for the topic in the company. In smaller businesses, one person with a clear mandate is often enough.

If you work through these five steps properly, you are well positioned for the realistic range of obligations in 2026. If you need support getting started, structured AI consulting helps with the inventory and risk classification.

Assessment

In 2026, the EU AI Act is in a phase in which a distinction must be made between obligations that apply and obligations that have been postponed. AI literacy and the prohibitions have applied since February 2025, and since 2 August 2026 the transparency obligations under Article 50 as well; only provider watermarking for existing systems follows on 2 December 2026.

This date is therefore the next hard deadline, and it carries two items: first, the grace period for watermarking expires. Second, the new prohibition of AI systems that generate non-consensual intimate material or child sexual abuse material takes effect. The Digital Omnibus has postponed the high-risk obligations to the end of 2027 and 2028. It has been in force as Regulation (EU) 2026/1744 since 27 July 2026, and the timetable is applicable law.

The situation is therefore less dramatic than the headlines about the €35 million fine suggest, but it is not settled either. The obligations on AI literacy and transparency are real and apply now. The rest can be planned if the inventory starts early enough. That is exactly the sensible way to deal with a regulation whose timetable has only just settled: do not wait, but do not overreact either.

If you only get one thing started this week, make it the inventory of the AI systems you use. Everything else builds on it.

Frequently asked questions about the EU AI Act

Has the AI Act been postponed?

In part. At its core, the Digital Omnibus postponed the high-risk obligations: to 2 December 2027 for systems under Annex III and to 2 August 2028 for AI in regulated products under Annex I. In addition, there is a transitional period until 2 December 2026 for machine-readable marking in existing systems. The prohibitions and AI literacy have applied since February 2025, and the transparency obligations under Article 50 since 2 August 2026.

What is the Digital Omnibus?

That is the name of two legislative packages that the European Commission proposed on 19 November 2025. The AI Omnibus amends the AI Act and has been in force as Regulation (EU) 2026/1744 since 27 July 2026. The general Omnibus on the GDPR, the Data Act and the cookie rules is, as of October 2026, still a proposal awaiting the committee votes in the European Parliament.

Do I have to label my chatbot as AI?

Yes, unless it is obvious that an AI is answering. The obligation applies to the provider of the chatbot, and that is you if you developed the bot under your own name or had it developed. The notice belongs in the first message at the latest; according to the Commission’s guidelines, a sentence in the terms and conditions is not sufficient.