For most SMEs, EU AI Act compliance in 2026 comes down to four jobs. First, confirm you are not doing anything on the prohibited list, which has been banned since February 2025. Second, make sure the people using AI have adequate AI literacy, which has also applied since February 2025. Third, meet the transparency rules for chatbots and AI-generated content, which have applied since 2 August 2026. Fourth, work out whether any system you build or use counts as high-risk, because that category carries almost all of the heavy obligations.
If your AI use is limited to general-purpose assistants for drafting, summarising and analysis, your list is short. If you use AI to screen CVs, score creditworthiness, price insurance or decide who gets access to a service, it is not short, and the clock is already running.
This article is the checklist version. For the wider picture, including GDPR overlap, model security and data residency, see our complete guide to AI security and compliance for EU firms.
The EU AI Act deadlines that matter in 2026
The Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. It applies in phases, three of them are already behind us, and the 2026 Digital Omnibus moved the high-risk dates.
| Date | What applies | Who it hits |
|---|---|---|
| 2 February 2025 | Prohibited practices (Article 5) and AI literacy (Article 4) | Every provider and deployer, regardless of size |
| 2 August 2025 | General-purpose AI model obligations, governance structures, penalty regime | Mainly foundation model providers. Most SMEs are downstream of this |
| 2 August 2026 | Transparency obligations (Article 50) | Anyone running chatbots or generating synthetic content |
| 2 December 2026 | End of the grace period for machine-readable marking of AI-generated content (Article 50(2)) by systems already on the market before 2 August 2026 | Providers of generative AI systems |
| 2 December 2027 | High-risk obligations for Annex III use cases, such as recruitment and credit scoring (moved from 2 August 2026) | Anyone building or deploying high-risk systems |
| 2 August 2028 | High-risk obligations for AI embedded in products already covered by EU product safety law (Annex I), such as machinery and medical devices (moved from 2 August 2027) | Manufacturers and their AI suppliers |
A note on the dates. The original timetable put Annex III high-risk obligations on 2 August 2026 and Annex I on 2 August 2027. The Digital Omnibus on AI (Regulation (EU) 2026/1744), published in the Official Journal on 24 July 2026, moved them to 2 December 2027 and 2 August 2028. Check the current status on the Commission’s AI Act page. The prohibitions, the AI literacy duty and the transparency rules were not postponed. Treating the whole Act as postponed is the most expensive misreading you can make right now.
Step one: work out your role
The Act assigns obligations by role, and most of the confusion SMEs run into comes from skipping this step.
Provider or deployer
A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority in a professional context. A recruitment agency running a third-party CV-screening tool is a deployer. The software company that built the tool is the provider.
Most Irish and UK SMEs selling into the EU are deployers for most of their AI use. That matters, because provider obligations for high-risk systems are extensive: risk management, technical documentation, conformity assessment and CE marking. Deployer obligations are real but much narrower.
When a deployer quietly becomes a provider
Under Article 25 you take on provider obligations if you put your name or trademark on a high-risk system, make a substantial modification to one, or change the intended purpose of a system so that it becomes high-risk. That last route is the one to watch. Suppose you wire a general-purpose model into an internal tool that ranks job applicants. You have just created a high-risk system, and you are its provider. The vendor of the underlying model is not.
This applies to custom agents too. If you are commissioning one, our breakdown of what it costs to build an AI agent in 2026 covers where compliance work sits in the budget. It is far cheaper to scope it in at the start than to retrofit it later.
Step two: classify every AI system you use
Make an inventory before you classify anything. Include the obvious tools, the AI features switched on inside your existing SaaS (CRM lead scoring, helpdesk auto-replies, HR platform screening), and the scripts someone in operations wrote against an API last year. Then sort each one into one of four buckets.
Prohibited
These practices have been illegal since 2 February 2025. They include social scoring, manipulative or deceptive techniques that cause significant harm, exploiting vulnerabilities linked to age or disability, emotion recognition in workplaces and schools (outside medical or safety uses), untargeted scraping of facial images, and biometric categorisation that infers sensitive traits such as ethnicity or political views. Few SMEs do any of this deliberately. Emotion-analysis features in call-centre or interview software are the realistic way to stumble into it.
High-risk
Annex III lists the use cases. For a typical business, the relevant ones are:
- employment: recruitment, CV filtering, candidate evaluation, promotion or termination decisions, task allocation and performance monitoring;
- access to essential private services: credit scoring, and risk assessment and pricing for life and health insurance;
- education and vocational training: admissions, assessment and exam proctoring;
- critical infrastructure: safety components in the management of utilities, digital infrastructure and road traffic;
- biometrics: remote identification and emotion recognition where not prohibited.
Article 6(3) provides an exit. A system in an Annex III area is not high-risk if it performs a narrow procedural task, improves the result of a completed human activity, detects patterns without replacing human assessment, or does preparatory work. Any system that profiles individuals stays high-risk regardless. If you rely on the exemption, the provider must document the reasoning and register the system. Write that assessment down carefully, because a regulator will ask for it.
Transparency-only
From 2 August 2026, people must be told when they are interacting with an AI system, unless it is obvious. Providers must mark synthetic audio, image, video and text in a machine-readable way. Deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless a human has editorial responsibility for it. In practice, if you run a customer-facing chatbot or publish generated imagery, this applies to you.
Minimal risk
Everything else falls here: spam filters, internal summarisation, code assistants, forecasting. There are no specific obligations beyond AI literacy, although GDPR still applies to whatever personal data flows through these tools.
The EU AI Act compliance checklist for SMEs
Work through this in order. The early items are cheap and the later ones only matter if the classification step says they do.
- Build the AI inventory. Record every tool, embedded feature and internal script, with an owner, a purpose, the data it touches and the vendor.
- Assign your role per system. Mark each one as provider or deployer, and flag anything you have rebranded, substantially modified or repurposed.
- Screen against the prohibited list. Pay particular attention to emotion recognition and biometric features in vendor products.
- Classify each system’s risk. Use the four buckets above and record the reasoning, especially for any Article 6(3) exemption.
- Run AI literacy training now. It has applied since February 2025. Tailor it to role: what the tools can and cannot do, when to escalate, what data must not go in. Keep attendance records.
- Fix transparency now: it has applied since 2 August 2026. Add AI disclosure to chatbots and voice agents, label generated content, and check that your vendors provide watermarking where they are the provider.
- For high-risk systems you deploy: get the provider’s instructions for use, assign trained people to human oversight, check that your input data is relevant to the intended purpose, keep the system’s logs for at least six months, and inform workers and their representatives before using it in the workplace.
- Check whether you need a fundamental rights impact assessment. This applies to public bodies, private entities providing public services, and deployers using AI for credit scoring or life and health insurance pricing.
- For high-risk systems you provide: scope the full provider stack (see below) and budget for it honestly.
- Update contracts. Vendor agreements should cover AI Act cooperation, documentation access, incident notification and who carries provider responsibility.
- Set a review cadence. Re-run the inventory quarterly and whenever a vendor ships a new AI feature, which happens more often than release notes suggest.
High-risk AI obligations in practice
If you are a deployer
The deployer duties in Article 26 are operational rather than documentary, and human oversight is where they most often fail. A named person needs the competence, authority and time to override the system. A rubber stamp on a queue of 400 automated decisions a day does not count. Design the workflow so a human can see the inputs, the output and the confidence, and can stop or reverse the action. We have written about one pattern for this in our own work: human-in-the-loop action tags that make AI agents easy to steer from your phone. The principle carries over to regulated decisions. Make the approval step fast enough that people actually use it.
Affected individuals also gain a right under Article 86 to an explanation of decisions made with high-risk AI that significantly affect them. If you cannot reconstruct why a candidate was rejected, you have a problem whatever the vendor’s documentation says.
If you are a provider
The provider stack is substantial. It covers a risk management system across the lifecycle, data governance for training and test data, technical documentation, automatic logging, instructions for use, built-in human oversight, accuracy, robustness and cybersecurity measures, a quality management system, conformity assessment, an EU declaration of conformity, CE marking, registration in the EU database, post-market monitoring and serious incident reporting. For most Annex III systems the conformity assessment is internal, so you do not need a notified body. You still need the evidence.
Much of this is reporting and evidence-gathering, and it automates well. Logs, test results and monitoring metrics can feed documentation directly instead of being assembled by hand before an audit. Our piece on compliance reporting automation for regulated industries covers the patterns.
What the Act gives SMEs in return
The Act is not size-blind. Article 62 directs member states to give SMEs and start-ups priority access to regulatory sandboxes, dedicated guidance channels and awareness training. Conformity assessment fees are meant to scale with company size. The Commission is required to provide a simplified technical documentation form for small and micro enterprises, and microenterprises get a lighter route on quality management. On fines, the ceilings run up to €35 million or 7% of worldwide turnover for prohibited practices and €15 million or 3% for most other breaches. For SMEs, the applicable figure is whichever is lower, not higher.
In Ireland, the Government has opted for a distributed model in which existing sectoral regulators supervise AI in their own domains, coordinated nationally. If you are already regulated by a sector body, expect AI questions to arrive through that relationship. Enforcement is also becoming more active internationally. The US, for example, is moving away from voluntary commitments, as covered in our note on the FTC compelling AI lab testimony. Waiting to see whether anyone enforces is a weaker bet than it looked two years ago.
Proportionality cuts both ways. The obligations are lighter for a small firm, but the evidence still has to exist. A two-page risk classification memo, a training log and a vendor contract clause will carry a minimal-risk SME a long way. Missing all three will not.
How D3X Solutions LABS helps
We are an AI engineering studio, not a law firm, and we work alongside your legal advisers rather than replacing them. Where we add value is the technical side of compliance: knowing what a system actually does, what data it touches and how to make oversight and logging real rather than theoretical.
We start with the inventory. We go through your tools, embedded SaaS features and internal scripts, map each to a role and a risk bucket, and write down the reasoning in a form your legal team can review. Where a system is high-risk or close to the line, we look at the engineering changes that reduce exposure. Sometimes that means narrowing a tool to a preparatory task. Sometimes it means designing a human approval step people will actually use, or adding logging and monitoring that generates the documentation you need. If you are building something new, we scope compliance into the architecture from day one, which is the approach we describe in practical AI for mid-sized companies.
If you want a second pair of engineering eyes on where you stand before the December 2027 high-risk deadline, book a free 30-minute call using the form below. We will go through your current AI use and tell you plainly which items on this checklist apply to you.
Frequently Asked Questions
Does the EU AI Act apply to SMEs?
Yes. The Act applies to any organisation that provides or deploys AI systems in the EU, whatever its size. SMEs do get proportionate treatment, including priority access to regulatory sandboxes, simplified documentation, reduced conformity assessment fees, and fines capped at whichever of the percentage or fixed amount is lower.
What are the EU AI Act deadlines for 2026?
Since 2 August 2026 the transparency obligations for chatbots and AI-generated content apply, with a grace period to 2 December 2026 for machine-readable marking by systems already on the market. The prohibitions and AI literacy duty have applied since 2 February 2025. The 2026 Digital Omnibus (Regulation (EU) 2026/1744) moved the Annex III high-risk obligations, such as recruitment and credit scoring, to 2 December 2027, and Annex I obligations to 2 August 2028.
Is using ChatGPT or Copilot at work high-risk under the EU AI Act?
Usually not. Using general-purpose assistants for drafting, summarising or analysis is minimal risk, and the main duty is ensuring staff have adequate AI literacy. It becomes high-risk if you use such a tool for an Annex III purpose, such as ranking job applicants. In that case you may also become the provider of a high-risk system.
What are the fines for non-compliance with the EU AI Act?
Prohibited practices carry fines of up to €35 million or 7% of worldwide annual turnover. Most other breaches carry up to €15 million or 3%, and supplying incorrect information to authorities up to €7.5 million or 1%. For SMEs and start-ups, the lower of the two figures applies.
What do deployers of high-risk AI have to do?
Deployers must use the system according to the provider's instructions, assign competent people to human oversight, ensure input data is relevant, monitor operation, and keep logs for at least six months. They must inform workers before using high-risk AI in the workplace. Some deployers must also carry out a fundamental rights impact assessment, including public bodies and those doing credit scoring or life and health insurance pricing.
Want this working in your business?
D3X Solutions LABS builds AI agents and automation that pay back fast. Book an EU AI Act readiness review
Get in touch
