AI Act: what it really requires of an SMB using AI

The AI Act is the European regulation on artificial intelligence ⁶. For an SMB that uses off-the-shelf tools, the obligations are few: train the people who use AI, be transparent with customers and readers, and watch out for a handful of defined high-risk uses.

The law distinguishes between whoever provides an AI system, meaning whoever develops it or puts it on the market under their own name, and whoever uses it in their business. Most SMBs are in the second group, and this guide is written for them.

This is not legal advice: it is a map to help you see where to look.

The dates that matter

The dates come from the European Commission's page ¹:

• 1 August 2024: the regulation enters into force ¹.
• 2 February 2025: the prohibitions and the AI literacy obligation apply ¹.
• 2 August 2025: the rules on general-purpose models, the ones from the big producers, apply ¹.
• 2 August 2026: the transparency obligations apply ¹.
• 2 December 2027: the obligations for high-risk systems listed in Annex III apply, such as those used for work or education ¹.
• 2 August 2028: the obligations for AI inside products that are already regulated, such as lifts and toys, apply ¹.

The last two dates are the result of the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026 ⁴. Before it, the high-risk obligations would all have started in August 2026 ¹.

Training the people who use AI

The AI literacy obligation has applied since 2 February 2025 ¹. For an SMB, it means that anyone who uses AI tools for work must know what they do, where they get things wrong and what should not be pasted into them. A training session and a written rule are the reasonable minimum.

Saying when an AI is involved

Article 50 sets the transparency obligations, in force from 2 August 2026 ^{2, 5}:

• Chatbots: people talking to an AI system must be told so, unless it is obvious ². The obligation lies with the provider of the system, but if you put a chatbot on your website under your company's name, have it introduce itself as an AI assistant from the first message.
• Deepfakes: whoever uses generated or manipulated images, audio or video that look real must disclose it ².
• Texts on matters of public interest: if you publish AI-generated texts to inform the public, you must disclose it, unless a person has reviewed them and takes editorial responsibility for them ².

The information must be given at the latest at the first interaction or exposure ².

For generative systems already on the market before 2 August 2026, the technical marking of content, the kind machines can read, has until 2 December 2026 ⁵. That is an obligation for providers, not for you.

When you become "high risk"

The heavy obligations (documentation, human oversight, controls) concern the uses listed in Annex III of the regulation ^{1, 6}. For an SMB the most common case is staff: a system that screens CVs or assesses employees.

If you use AI to write emails, summarise documents or answer questions about opening hours, you are not in this box. If you use it to decide who to hire, you are, and from 2 December 2027 ¹.

Penalties

There are three tiers of maximum fines ³:

• up to €35 million or 7% of worldwide turnover for prohibited practices ³;
• up to €15 million or 3% for the other obligations, including transparency ³;
• up to €7.5 million or 1% for false information given to the authorities ³.

For SMBs the lower of the amount and the percentage applies ³. In Italy, penalties are also defined by national legislation, covered in the guide to Law 132/2025 (the Italian AI law).

What to do now

• List the AI tools used in your company and what for.
• Mark the ones that touch staff: selection, appraisal, shifts. They are the candidates for high risk.
• Have the chatbot introduce itself as an AI from the first message.
• Write a couple of lines of rules for the people who use AI and run a training session. Keep a record of both.
• If you publish generated texts or images, decide who reviews them before they go out.