AI Act & Compliance

Everything about AI Act & Compliance

Understand and apply the EU AI Act: timeline, obligations, penalties and practical compliance roadmaps for SMEs and nonprofits.

Complete guide

EU AI Act 2026: The Complete Compliance Guide for SMEs and Nonprofits

The EU AI Act (Regulation 2024/1689) applies to your SME or nonprofit as soon as you use an AI tool, even a simple ChatGPT subscription. Since February 2025 you must train your teams; on 2 August 2026 the transparency obligations and the penalty regime take effect.

17 min read

September 16, 202611 min read

AI Act and consumer generative AI: usage rules

When your staff use ChatGPT, Gemini or Claude at work, your organisation is the deployer under the AI Act, not them. A free plan changes nothing about that. The actual obligations are narrower than most articles suggest, but they do not sit where people expect.

Ready to accelerate with AI?

Book a free 30-minute audit to discover how AI can transform your business.

Book a free audit

September 15, 202612 min read

AI Act: appointing an AI officer in your company

No, the AI Act does not require you to appoint an AI officer: nothing in Regulation EU 2024/1689 creates an equivalent to the data protection officer. Yet three very real obligations assume someone is accountable by name.

September 14, 202613 min read

AI Act and customer information: what must change in your customer relationship

Since 2 August 2026, a small or mid-sized business using AI in its customer relationship must inform people in three specific situations: a direct exchange with a conversational system, a published deepfake, and a public-interest text published without human review. Outside those cases, no "AI-generated" label is legally required.

September 11, 202616 min read

AI Act and employee data: GDPR interplay

Running AI on employee data puts you under two sets of rules that say different things and start on different dates. GDPR and French labour law already govern your HR processing, today, with no grace period. The AI Act adds a further layer, and its heaviest part, the high-risk regime, will not apply until 2 December 2027. In practice, the immediate risk for a small or mid-sized company almost never comes from the AI Act.

September 10, 202612 min read

AI Act and Microsoft 365 Copilot: compliance in practice

Using Microsoft 365 Copilot is compliant with the AI Act in the vast majority of cases. Your real duties come down to three things: disclosing AI when it is not obvious, keeping control of sensitive uses, and knowing when you stop being a mere user.

September 9, 202612 min read

AI Act and ChatGPT: is your use compliant?

Using ChatGPT at work is still allowed under the AI Act. Since 2 August 2026, your duties come down to three things: disclosing AI when it is not obvious, labelling certain published content, and knowing whether you act as a deployer or a provider.

September 4, 20269 min read

AI Act and Open Source: Where Is the Line?

The AI Act does include an open source exemption, but it protects model providers, not the companies using those models. If your SME runs an open model in-house, that exemption changes almost nothing about your obligations.

September 3, 202611 min read

AI Act for startups: what you need to know in 2026

A startup that uses or resells AI falls under the AI Act, but rarely at the level founders expect. In most cases three obligations come first: train your team, tell your users, and be able to prove your product is not classified as high risk.

September 2, 202613 min read

AI Act for SMEs and Micro-Businesses: A Practical 2026 Guide

Since 2 August 2026, the AI Act has applied in full to transparency and enforcement, but the heavy obligations covering high-risk systems have been pushed back to December 2027. For a small business using ChatGPT, a chatbot or a no-code tool, the real work amounts to half a day.

September 1, 202612 min read

AI Act conformity assessment: the real steps for an SME

A conformity assessment under the AI Act is a formal procedure set out in Article 43, and it only applies to providers of high-risk AI systems. If your company uses ChatGPT, Copilot or a CRM with an AI feature bolted on, you are almost certainly outside its scope. What you do need to run is a compliance self-assessment: establish your role, classify your systems, document your decisions.

August 31, 202613 min read

Mapping your AI systems: method and template for SMEs

Mapping your AI systems means listing, in a single table, every artificial intelligence tool in use across the company, with its vendor, its purpose, the data it processes and the person accountable for it. In a company of 30 to 100 employees, that work takes half a day to two days, not six weeks.

August 25, 202614 min read

AI policy in business: free downloadable template

An AI policy is the internal document that sets out what your teams may do with artificial intelligence: which tools are approved, which data may go into them, who checks what before anything goes out. You will find a complete template below, published in full, ready to copy and adapt. No form, no email required.

August 19, 202612 min read

AI Information Notice: How to Write One and When It Is Required

An AI information notice is the public document explaining how your AI systems process personal data. It answers the GDPR, not Article 50 of the AI Act, which requires disclosure at the moment of interaction. You need both.

August 17, 202610 min read

AI Act vs GDPR: What Are the Differences for Your SME?

The AI Act and the GDPR do not address the same thing: the GDPR protects personal data, while the AI Act governs artificial intelligence systems. Both apply at the same time as soon as your AI touches customer, employee or prospect data. For an SME, the real question is not which one to follow, but how to fit both into a single compliance effort.

August 11, 20269 min read

AI Act Sanctions: What You Risk in 2026

AI Act sanctions can reach 35 million euros or 7 % of worldwide annual turnover for the most serious breaches. But for a small business the rule flips: the fine is capped at the lower of the fixed amount and the percentage, not the higher one. In practice, a compliant small organisation risks almost nothing, and a negligent one is mostly exposed to the middle tier of 15 million euros or 3 %.

August 7, 202610 min read

AI Act Article 6: High-Risk AI Systems

A high-risk AI system is one that Article 6 of Regulation EU 2024/1689 places under the AI Act's heaviest obligations. It opens two classification routes: Annex I products and Annex III use cases, whose obligations apply from 2 December 2027.

August 5, 20268 min read

AI Act Article 5: The 8 Prohibited AI Practices

Since 2 February 2025, eight uses of artificial intelligence have been outright banned across the European Union. Article 5 of Regulation EU 2024/1689 classifies them as unacceptable risk: there is no compliance path, only stopping the use. Here is the exact list and what it means in practice for a small business or a nonprofit.

July 29, 20269 min read

AI Act Article 4: is AI training mandatory?

Since 27 July 2026, Article 4 of the AI Act no longer requires companies to reach a specific level of AI literacy. The Digital Omnibus replaced that binding obligation with simple encouragement. Training your teams is still strongly advised, and it remains required for high-risk uses. Here is what changed, what remains, and what you should actually do.

July 28, 202610 min read

AI Act Timeline: Every Application Date from 2024 to 2030

The AI Act timeline runs from its entry into force on 1 August 2024 through August 2028, with obligations applying in stages rather than all at once. Since the "Digital Omnibus" package was given final approval by the Council of the EU on 29 June 2026, several deadlines have shifted: rules for standalone high-risk systems are now pushed back to 2 December 2027. Here are all the binding dates, what applies at each one, and what changed.

July 27, 202610 min read

AI Act: Who Is Affected? Scope and Obligations

If you use an AI system in your professional activity, even a simple chatbot, the AI Act applies to you. The European regulation on artificial intelligence covers any organisation, business, nonprofit or public body that supplies, imports, distributes or deploys AI within the European Union. So the real question is not whether you are affected, but in what capacity and with which obligations.