AI Act: what already applies to your SMB in 2026

What already applies in 2026

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, entered into force in August 2024. It has been rolling out in stages rather than all at once. Practices considered unacceptable have been banned since February 2025. Obligations for providers of general purpose AI models have applied since August 2025. And since August 2026, a new obligation reaches SMBs directly whenever they use AI in contact with customers or staff: transparency.

A staged calendar, not a single deadline

For an SMB owner, this gradual rollout changes how to approach the topic. It is not a single text that lands all at once and needs to be absorbed in a hurry, but a series of deadlines arriving one after another, each with its own scope. That leaves time to handle the obligations already in force without waiting to understand the entire regulation first. The sensible approach is to identify what already applies to your business today, then keep an eye on the deadlines that follow as they approach, rather than trying to anticipate everything at once.

The transparency obligation is the one that matters most to an SMB

Article 50 of the Regulation requires telling people when they are interacting with an AI system, unless that is already obvious from the context. In practice, a chatbot on your website needs to identify itself as one. Content generated or edited by AI, especially an image or video that could pass as real, needs to be labelled as such. If you use AI to produce marketing visuals, meeting notes, or a booking assistant, this obligation already applies to you, whether your company has five employees or two hundred.

Concrete situations where the obligation applies

In practice, this obligation touches very common uses inside an SMB, often set up without much thought about transparency at the time. A tradesperson who installs a booking assistant on their website needs to make clear the visitor is talking to an automated system. An online shop that generates product visuals with an AI tool needs to flag them if the image could be mistaken for a real photograph. A firm that uses AI to draft meeting notes sent to external clients needs to make sure that origin stays identifiable. These examples cover a good share of the uses found in a small business, even when AI was only introduced on an experimental basis by a single staff member.

How to disclose without disrupting the customer experience

Disclosing an AI use does not require heavy machinery. What matters is that the information is visible at the moment of interaction, rather than buried in a legal notice nobody reads. A clear name for the chat assistant, a discreet but legible mention at the top of a chat window, a caption under a generated visual: this kind of signal is enough in most cases. The point of the Regulation is not to discourage AI use, but to prevent someone from thinking they are talking to a human, or looking at an authentic piece of content, when that is not the case.

Practices banned since February 2025

A handful of uses have been outright banned since February 2025: behavioural manipulation that bypasses a person's judgement, blanket social scoring, and certain forms of emotion recognition in the workplace. Few manufacturing SMBs are directly exposed as users, but any vendor or integrator selling you a system should be able to explain how they comply.

What to check with a vendor or integrator

Before choosing an AI tool, whether a sales chatbot, a resume screening piece of software, or a smart video surveillance solution, it is reasonable to ask the vendor how their product stands relative to these prohibitions. A serious vendor should be able to answer directly, especially if their tool processes data about employees or evaluates people in any way. A vague answer, or no answer at all, is a signal worth taking seriously before signing a contract.

What the Digital Omnibus changed this year

A simplification text, proposed in November 2025 and in force since 27 July 2026, shifted several deadlines in the Regulation. The omnibus also adds two prohibitions: generating intimate imagery without the depicted person's consent, and generating child sexual abuse material. The obligation to support your staff's AI literacy remains in force, but its wording changed: the text now asks companies to take measures supporting that progress, without requiring a guaranteed level or a set training format.

A duty of means rather than a duty of results, in practice

This distinction changes how an SMB can approach training its teams on AI. It is not about passing an exam or issuing a certification, but about putting reasonable actions in place: a session presenting the tools in use, time set aside to discuss good habits, internal documentation on what the company does and does not expect from AI. What counts is the effort made, not a result measured against a fixed scale. An SMB that organises this kind of support, even a modest one, is well placed to meet this obligation without stress.

What is still ahead

The heaviest obligations, the ones targeting so called high risk systems such as automated hiring, credit scoring, or certain medical uses, apply from 2 December 2027 for systems listed in Annex III of the Regulation, and from 2 August 2028 for those embedded in products already regulated elsewhere. If you are not planning to use that kind of system, you have time. If one is on your roadmap, it is worth designing it with that deadline in mind rather than discovering it later.

Getting ready without waiting for the deadline

For an SMB considering, say, an automated resume screening tool or a credit assessment system, the most efficient move is to build this deadline into the project's framing from the start, before any development work begins. A project designed with this constraint in mind is generally cheaper to adjust than one already in production that then needs to be brought into compliance under pressure. It is worth raising explicitly during an initial diagnostic, whenever a project might touch this kind of high risk system.

What an SMB can do right now

You do not need a legal department to make progress here. The first step is listing the uses of AI inside your company, even occasional ones run by a single person on their own machine: a writing assistant, an image editing tool, a chatbot installed in a few clicks on the online shop. Many owners discover at this point that AI is already more present than they thought, usually without any defined framework around it.

Next comes the check: every customer or staff interaction that runs through AI needs to be labelled as such inside the interface itself, not buried in a legal notice nobody reads. Finally, ask your vendors, in writing, where your data is hosted and whether it trains a model somewhere you do not control. Our responsible AI memo walks through these points with concrete examples, sized for a company without a full-time legal team.

A minimal compliance checklist

• List every AI tool used in the company, including ones installed by a single employee without formal sign off.
• For each tool that interacts with a customer or a staff member, check whether its AI nature is visibly disclosed in the interface.
• Ask every vendor in writing where your data is hosted and whether it feeds the training of a model.
• Identify uses that could fall under a banned practice, particularly anything involving evaluating or scoring people.
• Put a simple team support action in place around AI use, even a modest one.
• Note upcoming deadlines for high risk systems if a project of that kind is being considered.

Common mistakes to avoid

The first mistake is assuming this topic only concerns large companies with a legal department. The transparency obligation applies as soon as an interaction takes place with a customer or a staff member, regardless of company size. The second mistake is placing the AI disclosure somewhere nobody reads, such as the bottom of a legal notice page, instead of making it visible at the moment of interaction itself. The third is never asking vendors about data hosting, assuming a mainstream tool must be compliant by default. The fourth, more subtle one, is assuming the staff training obligation disappeared because the Digital Omnibus softened it: it remains in force, only its intensity changed.

Questions to ask a vendor before choosing an AI solution

A few simple questions help clarify the situation before committing. Where is my data hosted, and does it train a model outside my company? How does your tool disclose to the user that they are interacting with AI? Does your solution touch, even indirectly, on evaluating people, scoring them, or recognising their emotions? If my project evolves toward a more sensitive use, such as screening job applications, how is that handled in your offering? These answers, obtained in writing, form a solid basis for documenting your compliance approach.

Most of these checks do not require a full legal audit or a dedicated budget. When doubt remains about a specific project, such as adding an AI agent to an existing customer relationship, a free diagnostic clarifies what actually applies to your case before committing to anything. Our engagement and use cases pages detail how we frame this kind of project upstream, precisely to avoid regulatory surprises once the system is in production.

Keeping this documentation alive over time

A list of AI tools and a set of vendor answers gathered once are only useful if someone keeps them current. Tools get added, a new assistant replaces an old one, a vendor changes how a feature works. Revisiting this short list every few months, at the same time you review other supplier commitments, keeps the picture accurate without turning it into a standalone compliance project. For a small team, folding this review into an existing routine, such as a quarterly check on suppliers or software licences, is usually simpler than creating a dedicated process just for AI disclosure. The goal is not paperwork for its own sake, but being able to answer, at any point, which AI tools are in use, whether each one discloses itself properly, and where the data involved actually sits.

Sources

• Cadre réglementaire sur l'IA, Commission européenne
• Règlement (UE) 2024/1689 (AI Act)
• Règlement (UE) 2024/1689, version consolidée au 27/07/2026

Frequently asked questions

My company uses an AI tool internally, does the AI Act apply to me?

If the tool interacts with your customers or produces externally visible content without disclosing it, the transparency obligation applies. A strictly internal use falls outside that specific obligation, but you should still check your vendor's terms on where your data is hosted.

What happens to an SMB that ignores the transparency obligation?

The Regulation provides for penalties in case of a breach. We do not quote an amount here, because it depends on the nature of the breach: for your specific situation, refer to the text of the Regulation or to your legal counsel.

Did the Digital Omnibus remove the obligation to train staff on AI?

No. It reworded it into an obligation of effort rather than of result: you must take measures supporting your team's AI literacy, without having to guarantee a specific level or impose a fixed training format.

From when do the rules on high risk systems apply?

From 2 December 2027 for systems listed in Annex III, such as automated hiring or credit scoring. From 2 August 2028 for those embedded in products already regulated elsewhere, such as certain medical devices.