AI Act for SMEs and Micro-Businesses: A Practical 2026 Guide
Since 2 August 2026, the AI Act has applied in full to transparency and enforcement, but the heavy obligations covering high-risk systems have been pushed back to December 2027. For a small business using ChatGPT, a chatbot or a no-code tool, the real work amounts to half a day.
The confusion comes from the pile of content published before summer 2026, which still dates high-risk obligations to 2 August 2026 and sells a hard training requirement backed by a 15 million euro fine. The Digital Omnibus on AI, in force since 27 July 2026, changed both. This article separates what binds you today from what can wait. For the full framework, including non-profits, the AI Act compliance guide for SMEs and non-profits is the starting point.
What actually applies to your business today
Only three blocks are applicable and enforceable in September 2026: prohibited practices, Article 50 transparency, and the rules on general-purpose AI models. Everything else either has a future date or targets operators you probably are not.
Here is the consolidated timeline published by the European Commission on its AI Act Service Desk portal, as amended by the Digital Omnibus on AI:
| Date | What applies | Relevant if |
|---|---|---|
| 2 February 2025 | Prohibited practices (Article 5), definitions, AI literacy (Article 4) | Always |
| 2 August 2025 | General-purpose AI models, national governance | You train or distribute a model |
| 2 August 2026 | Transparency (Article 50), enforcement and penalties begin | You expose AI to customers, staff or visitors |
| 2 December 2026 | New prohibitions (non-consensual sexual deepfakes, child sexual abuse material) and end of the grace period on machine marking of generated content | You supply a generative system placed on the market before August 2026 |
| 2 December 2027 | Stand-alone high-risk systems, Annex III | Recruitment, credit scoring, education, critical infrastructure |
| 2 August 2028 | High-risk AI embedded in regulated products, Annex I | Medical devices, machinery, toys |
The article-by-article breakdown is covered in the complete AI Act timeline from 2024 to 2030. The takeaway: if your company runs AI-assisted recruitment, your deadline is 2 December 2027, not summer 2026. That changes the order of priorities, not the direction of travel.
Deployer or provider: the question that changes everything
In nearly every case a small or mid-sized business is a deployer, not a provider, and the heavy obligations sit with its vendor. A deployer uses an AI system under its own authority in a professional context. A provider develops the system and places it on the market under its own name.
The trap lies elsewhere: a deployer becomes a provider in four specific situations. It puts its own brand on the system, it substantially modifies it, it changes the intended purpose, or it plugs an existing system into a high-risk use case.
This is where no-code projects create exposure. A company that assembles a CV screening AI agent on top of an off-the-shelf LLM, with its own scoring rules and its own commercial name, is no longer treated by the regulation as a simple API user. It ticks two of the four boxes: modified purpose and Annex III use. From December 2027 it will owe technical documentation, a conformity assessment and registration in the EU database.
The sorting rule we apply during audits: as long as you use a SaaS tool as-is, with its original parameters, you remain a deployer. The moment you build something you sell or present as your own, ask the provider question. The detailed scope of the regulation walks through each case.
The four risk levels applied to real SME tools
The vast majority of small-business AI usage falls under limited or minimal risk, where the only real constraint is disclosure. Classifying your tools takes an hour if you start from your software subscription list.
- Unacceptable risk, banned since February 2025: social scoring of employees, emotion recognition at work outside safety and health, untargeted scraping of facial images. Rare in small businesses, but emotion recognition inside a call centre tool or a video interview platform is not a theoretical case. The list of eight prohibited AI practices is worth a quick read.
- High risk, applicable 2 December 2027: CV screening, performance evaluation, decisions on access to training, credit scoring. The criteria are set out in the article on high-risk AI systems.
- Limited risk, applicable since 2 August 2026: an AI chatbot on your site, visuals and copy produced by generative AI, synthetic voice. Obligation: disclose.
- Minimal risk: spell checkers, spam filters, suggested replies in your inbox, internal assisted writing. No specific obligation.
One common case is often misjudged: ChatGPT used internally to draft a quote or rewrite an email is minimal risk. The same content published on your site, or sent to a client as a generated image, moves into Article 50 territory.
Article 50 transparency: what to display, in practice
Article 50 requires you to inform people that they are interacting with an AI, or that content was AI-generated, unless it is obvious to a reasonably well-informed observer. This is the only obligation that genuinely reaches every small business since 2 August 2026.
Three situations come up constantly:
- A chatbot or assistant on your site. The disclosure has to appear in the interface itself, on the first message, not only in the legal notices. One sentence is enough: "You are chatting with an automated assistant. A human advisor can take over."
- Generated visuals or video. If the content depicts real people, places or events in a way that could mislead, it must be flagged as artificially generated. An abstract banner illustration does not raise this issue.
- Published text on matters of public interest. The obligation targets publishing information to the public, not your commercial newsletter reviewed by a human.
On top of this sits the machine-marking obligation, which falls on the model provider rather than the deployer, with a transitional deadline of 2 December 2026 for systems already on the market before August 2026. You do not have to implement that marking yourself. Drafting your disclosures is covered step by step in the article on the AI information notice.
AI training: what the Omnibus actually changed
Article 4 on AI literacy still exists, but the AI Omnibus turned the "sufficient level" requirement on companies into a non-binding incentive, with the Commission and Member States taking the lead on promotion. In other words, there is no dedicated fine for a training gap.
This is a point where we deliberately break with the dominant line in our own industry. Many training providers still sell the AI Act as a hard obligation backed by a 15 million euro fine. That was already debatable before the Omnibus; it has been wrong since July 2026.
Two caveats still hold. First, a training obligation survives for deployers of high-risk systems, through Article 26 and its requirement of effective human oversight: you cannot meaningfully supervise a system you do not understand. Second, supervision by national market surveillance authorities started on 2 August 2026, under a proportionate regime.
Our position: train because teams produce mediocre output and take confidentiality risks without a framework, not because a regulator is waving a stick. The full analysis is in AI Act Article 4: is AI training mandatory.
What you actually risk: the inverted cap for SMEs
For an SME or start-up, the fine is capped at the lower of the turnover percentage and the fixed amount, whereas the rule is the opposite for large companies. That is Article 99(6), and it is probably the least reported provision in the whole regulation.
| Breach | General cap | SME cap |
|---|---|---|
| Prohibited practice (Article 5) | EUR 35M or 7% of global turnover, whichever is higher | Whichever is lower |
| Other operator obligations | EUR 15M or 3% of global turnover, whichever is higher | Whichever is lower |
| Inaccurate information to authorities | EUR 7.5M or 1% of global turnover, whichever is higher | Whichever is lower |
For a company with EUR 2 million in turnover, a breach of operator obligations is therefore capped at EUR 60,000, not EUR 15 million. The amount is still a deterrent, but the headline figure quoted in most articles does not match your situation. The full penalty schedule is covered in the article on AI Act penalties in 2026.
The SME package nobody talks about
The regulation includes a set of measures aimed specifically at SMEs and start-ups that most guides skip entirely. They do not remove obligations; they cut the cost of meeting them.
Article 62 requires Member States to give SMEs established in the Union priority access to regulatory sandboxes, to run awareness and training activities tailored to their needs, and to open dedicated advisory channels. It also provides that conformity assessment fees be reduced proportionately to company size. Each Member State should have at least one sandbox operational by 2 August 2027.
SMEs may also supply the Annex IV technical documentation in simplified form, using a template the Commission must produce for small and micro-enterprises, a template notified bodies are required to accept. Article 63 adds derogations on the quality management system for micro-enterprises.
These provisions only matter once you become a provider of a high-risk system. They are worth knowing before abandoning a project over compliance cost.
A four-step method, in half a day
For a company under 250 employees running no high-risk system, compliance is half a day of work, not a quarterly project.
- Inventory. List every tool that embeds AI, including features that arrived through an update to your CRM or office suite. The method and a template are in the article on mapping your AI systems.
- Classify. Assign a risk level to each use case. Note for each whether you are deployer or provider.
- Disclose. Fix the missing notices on public-facing interfaces. This is the most urgent and the most visible action in an inspection.
- Frame. Write a one to two page note on what is allowed, with which tools and which data. A company AI policy template is available to download.
Two limits worth keeping in mind. This method is not enough if you use AI in recruitment, employee evaluation or financial scoring: the December 2027 deadline then requires a real conformity assessment, which takes months to prepare. And it does not address personal data, governed by the GDPR, which applies alongside the AI Act rather than instead of it: the topic is covered in AI Act vs GDPR.
Frequently asked questions
Is a five-person business using ChatGPT covered by the AI Act? Yes, but only lightly. Internal use of ChatGPT to draft or rewrite is minimal risk and carries no specific obligation. Obligations appear as soon as AI output is exposed to third parties, for instance through a chatbot or a published generated image.
Do I have to declare my AI systems to a national authority? No, except for providers of high-risk systems, who will have to register in the EU database from December 2027. A deployer has no prior declaration to make.
Has the obligation to train teams on AI disappeared? It has been softened. The AI Omnibus, in force since 27 July 2026, replaced the binding Article 4 requirement with an incentive. Training remains required in practice for deployers of high-risk systems, under the human oversight duty in Article 26.
My vendor built a custom AI tool for me: who is responsible? It depends on the name the tool operates under and the degree of customisation. If it carries your brand or you changed its purpose, you risk being classified as a provider. This should be settled contractually, ideally before development starts.
What budget should a small business plan for AI Act compliance? For a company with no high-risk use case, the cost is mostly internal time, in the range of half a day to a day. The expensive items appear later: conformity assessment if you become a provider of a high-risk system, and technical documentation. The regulation does provide for conformity assessment fees to be reduced proportionately for SMEs.
Do non-profits face the same rules? Yes. The regulation reasons by role, provider or deployer, not by legal status. A non-profit deploying a chatbot on its website has the same transparency obligations as a commercial company.
What happens if I do nothing before an inspection? National market surveillance authorities have been exercising their powers since 2 August 2026, under a graduated regime that favours formal notice before penalties. A missing chatbot disclosure takes minutes to fix; a complete absence of mapping is much harder to correct under deadline.
How GrowthPerf supports small businesses on the AI Act
We are neither lawyers nor a compliance firm. We work on what compliance implies on the tools side and the people side: mapping actual AI usage, including what management does not know about, fixing transparency notices on interfaces, and training teams to work within a defined frame.
Our AI onboarding programme for companies includes a regulatory framing module, and the Operational AI for SMEs course covers confidentiality and traceability through concrete cases. GrowthPerf is Qualiopi-certified, which unlocks French OPCO funding.
If you want to know where you stand first, the free 30-minute audit sorts what binds you today from what can wait until December 2027. The AI Act compliance guide for SMEs and non-profits remains the reference for going deeper on any point raised here.