EU AI Act 2026: The Complete Compliance Guide for SMEs and Nonprofits
The EU AI Act, Regulation 2024/1689, applies to your SME or nonprofit as soon as you use an AI tool, even a simple ChatGPT subscription. Since February 2025 you have been required to train your teams; on 2 August 2026 the transparency obligations and the penalty regime take effect. This guide covers the real timeline, updated after the digital omnibus package adopted in June 2026, and a 6 step roadmap to get compliant without overspending.
Much of what was published in 2024 and 2025 announced that the "high risk" obligations would fully apply on 2 August 2026. That is no longer accurate: the digital omnibus package voted by the European Parliament and approved by the Council in late June 2026 shifted part of the timeline. What remains true, and what too many companies ignore: several obligations are already in force today, including the duty to train your teams in AI, and the penalty regime does activate on 2 August 2026.
The AI Act in a nutshell: who is covered, and for what
Any organisation that develops, sells or simply uses an AI system in the European Union falls within the scope of the AI Act, whatever its size: SME, micro-business, nonprofit or large group. Regulation 2024/1689, published in the Official Journal of the EU on 12 July 2024 and in force since 1 August 2024, is the world's first comprehensive legal framework for artificial intelligence. Contrary to a persistent misconception, it does not target software vendors only.
The text distinguishes several roles, and yours determines your obligations:
- The provider develops an AI system or places it on the market under its own name. If your SME commissioned a custom chatbot or a scoring tool, you are probably a provider.
- The deployer uses an AI system under its own authority in a professional context. That covers nearly every SME and nonprofit: using ChatGPT, Claude, Copilot or an AI module built into your CRM makes you a deployer.
- The importer and the distributor make systems designed elsewhere available on the European market.
For a typical SME, the most common scenario is simple: you are a deployer of mainstream generative AI systems. Your obligations are then limited but real: train your teams, inform the people who interact with the AI, and check that none of your uses falls into the prohibited or high risk categories. A nonprofit that uses AI to screen volunteer applications or support vulnerable people has more questions to ask itself than a firm drafting meeting notes with an LLM.
The regulation also applies to organisations established outside the EU whenever the output produced by the AI system is used within the Union. A Swiss or British service provider serving French clients is therefore covered.
The real AI Act timeline after the June 2026 omnibus
The original AI Act timeline was amended in June 2026 by the digital omnibus package: the "high risk" obligations are postponed to late 2027 and 2028, but everything else applies as planned. This is the single largest source of confusion, including in the trade press. Here are the deadlines as they stand in July 2026:
- 1 August 2024: Regulation 2024/1689 enters into force.
- 2 February 2025: prohibited practices (Article 5) and the AI literacy obligation for staff (Article 4) start to apply. These two blocks have been in force for 18 months: they already concern your organisation.
- 2 August 2025: rules on general purpose AI models (GPAI) apply and the European governance structure, including the AI Office, is set up.
- 2 August 2026: general application of the regulation, notably the transparency obligations of Article 50 (telling people they are talking to an AI, marking generated content) and the activation of the penalty regime by national authorities.
- 2 December 2027: new obligations for high risk systems under Annex III (recruitment, scoring, education, access to essential services), initially planned for 2 August 2026 and postponed by the omnibus.
- 2 August 2028: obligations for high risk systems under Annex I, meaning AI embedded in already regulated products (medical devices, machinery, toys).
In practice, for an SME that uses AI, two dates matter: today (Articles 4 and 5, already applicable) and 2 August 2026 (transparency and penalties). The postponement of high risk to December 2027 is breathing room for the companies concerned, not an exemption: high risk compliance projects take time, and 17 months go by quickly.
One caveat: this timeline results from a text adopted in late June 2026. If your last briefing predates the summer, have it refreshed before setting your compliance budget.
The 4 risk levels: where your tools sit
The AI Act places every AI use into one of four risk levels, and your obligations flow directly from that classification, not from the size of your company. The same tool can sit at different levels depending on use: an LLM drafting your newsletters is minimal risk; the same LLM used to shortlist CVs becomes high risk.
| Risk level | Concrete examples | Your obligations | Deadline |
|---|---|---|---|
| Unacceptable (prohibited) | Social scoring, manipulation exploiting vulnerability, emotion recognition at work | Stop the practice, no exceptions | Already in force (2 February 2025) |
| High risk | CV screening, credit scoring, algorithmic task allocation, assessing learners | Risk management, human oversight, logs, documentation | 2 December 2027 (Annex III) |
| Transparency risk | Customer chatbots, generated content (text, images, deepfakes), conversational agents | Inform people, mark generated content | 2 August 2026 |
| Minimal risk | Writing assistance, translation, spam filters, proofreading, brainstorming | Nothing specific beyond Article 4 | Not applicable |
In our AI audit work with SMEs around Paris, the split is almost always the same: 80 to 90 percent of uses are minimal risk, a few fall under transparency (a website chatbot, generated visuals for social media), and one or two HR uses deserve a proper high risk analysis. The classic trap: the candidate "matching" module switched on by default in an HR tool, which nobody had identified as AI.
What is already in force since 2025: staff training and prohibited practices
Since 2 February 2025, your organisation must ensure a sufficient level of AI literacy for anyone using AI systems on its behalf: that is Article 4, and the omnibus neither postponed nor softened it. This AI literacy duty applies to providers and deployers alike, so to the 12 person SME where three people use ChatGPT as much as to an industrial group.
The text does not impose a single format: the training level must fit the technical context, the teams' experience and the actual uses. For a team using generative AI for office work, a structured one day awareness programme covers the essentials: how models work and where they fail, hallucinations and output checking, confidential data, internal usage rules. We covered the topic in detail in our article on Article 4 and the training obligation, and the practical side in what the August 2026 deadline changes for SMEs.
An often overlooked point: evidence. In a dispute or an inspection, the burden is on you to show your teams were trained. Keep the programmes, attendance sheets and training certificates. Training delivered by a Qualiopi certified provider has a double advantage here: the documentary evidence comes built in, and in France the cost can be covered by your OPCO, as explained in our guide to OPCO funding.
Article 5 outright prohibits certain practices since the same date: social scoring, exploiting the vulnerabilities of fragile groups, inferring emotions in the workplace or in education (outside medical or safety reasons), and certain forms of biometric identification. Most SMEs are not concerned, but check the side features of your tools: a video conferencing product that claims to analyse participants' "emotional engagement" in meetings would take you into prohibited territory.
What changes on 2 August 2026: transparency and penalties
From 2 August 2026, you must clearly inform anyone who interacts with an AI or views AI generated content, and national authorities can impose penalties. That is the real shift of summer 2026 for SMEs and nonprofits.
Article 50 sets four main transparency obligations:
- Chatbots and conversational agents: people must know they are talking to a machine, unless it is obvious from the context. A clear notice at the start of the conversation is enough.
- Generated or manipulated content: AI generated text, images, audio and video must be identifiable as such, with machine readable marking where technically feasible.
- Deepfakes: any generated image, audio or video depicting real people, places or events must be explicitly flagged as artificial.
- Public interest text: AI generated text published to inform the public on matters of general interest must disclose its artificial origin, unless it went through human review with assumed editorial responsibility.
That last point deserves attention from any organisation that publishes content: genuine human review, with an identified editorial owner, places you within the exception. A fully automated blog with no human control does not.
On penalties, Article 99 sets three ceilings: up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices; up to 15 million euros or 3 percent for most other breaches; up to 7.5 million euros or 1 percent for supplying incorrect information to authorities. For SMEs and startups, the regulation explicitly retains the lower of the two ceilings, and authorities must take the company's size and economic viability into account. We covered the mechanics in our article on what non compliant companies risk.
Neither drama nor complacency is warranted. Nobody will shut down your SME on 3 August 2026. The real risk sits elsewhere: a dismissed employee invoking a non compliant AI assisted decision before an employment tribunal, a lost tender because you could not document compliance, a large client demanding contractual guarantees. AI Act compliance is becoming a supplier selection criterion, just as the GDPR did after 2018.
High risk systems: postponed to late 2027, but worth preparing now
If you use AI to recruit, assess, score or assign people, you probably fall under the high risk category of Annex III, whose obligations will apply on 2 December 2027. The postponement decided in June 2026 buys you time; it does not change the scope.
The most frequent high risk cases in SMEs and nonprofits:
- Recruitment and HR: automated CV screening, candidate matching, performance evaluation tools, algorithmic allocation of tasks or shifts.
- Access to essential services: credit scoring, pricing of certain insurance products, prioritising access to social benefits (a genuine point of vigilance for nonprofits in the social sector).
- Education and training: automated grading of learners, exam proctoring.
For these uses, the deployer will notably have to ensure effective human oversight (the AI proposes, a human decides and can override), use relevant input data, keep the system logs, inform the people concerned and report serious incidents to the provider. Providers carry most of the load: documented risk management, data governance, technical documentation, registration in the European database.
Our practical recommendation: do not launch a theoretical high risk programme. Start by mapping your actual uses (most SMEs discover 2 to 3 times more AI uses than they expected), classify each use across the four levels, and focus the effort on the few genuinely high risk ones. If an HR module tips you into high risk for marginal benefit, the most rational decision is sometimes to switch it off.
Your 6 step compliance roadmap
An SME or nonprofit can reach solid compliance in 4 to 8 weeks of distributed work, without hiring or blowing up its budget. Here is the sequence we apply with our clients:
- Map your AI uses (week 1). List every tool: official subscriptions (ChatGPT, Claude, Copilot), AI features embedded in your business software, unofficial team habits. Ask every department, not just management.
- Classify each use by risk level (week 2). Prohibited, high risk, transparency, minimal. For 90 percent of uses the classification takes minutes. Document the reasoning for borderline cases.
- Train your teams (weeks 2 to 4). This is the obligation already in force, and the best return on investment: a trained team makes fewer mistakes, uses the tools better and applies the transparency rules naturally. In France, OPCO funded training covers the Article 4 obligation, often with zero out of pocket cost for SMEs under 50 employees.
- Fix transparency (before 2 August 2026). A notice on your chatbot, a disclosure on generated content published without review, flags on artificial visuals depicting real people. One working day covers most cases.
- Write your internal AI policy. A 2 to 4 page document: authorised tools, data that must never be entered, content validation flow, a named AI lead. This document is also your evidence of diligence in an inspection.
- Handle high risk uses (by December 2027). For each confirmed high risk use: contact the provider for documentation, organise human oversight, keep a decision log. Schedule this for the first half of 2027 to keep a margin.
For nonprofits the approach is identical but the funding differs: see our dedicated article on AI training for nonprofits. And for a condensed overview, our AI Act compliance checklist for SMEs turns these steps into an actionable list.
Frequently asked questions
My SME only uses ChatGPT: am I really covered by the AI Act?
Yes, as a deployer. Your obligations remain light: train the users (Article 4, already in force), respect transparency if you publish generated content without human review, and check that no use falls under the prohibited practices. No technical file or European registration for this profile.
Is the AI Act postponed or not?
Partially. The digital omnibus adopted in June 2026 postpones the high risk obligations of Annex III to 2 December 2027 and those of Annex I to 2 August 2028. Everything else follows the original timeline: Articles 4 and 5 have applied since February 2025, and Article 50 transparency plus the penalty regime apply from 2 August 2026.
What penalties does an SME actually risk?
Ceilings go up to 35 million euros or 7 percent of worldwide turnover for prohibited practices, and 15 million euros or 3 percent for other breaches. For SMEs the regulation retains the lower of the two amounts and requires authorities to consider economic viability. The most likely short term risk is indirect: employment litigation, lost tenders, contractual demands from large clients.
Who enforces the AI Act?
National market surveillance authorities designated by each member state, coordinated at European level by the Commission's AI Office. In France the setup relies on existing sector regulators, with the CNIL remaining competent whenever personal data is processed. These authorities can impose penalties from 2 August 2026.
What is the difference between the AI Act and the GDPR?
The GDPR protects personal data; the AI Act regulates AI systems themselves, including when no personal data is processed. The two stack: an HR tool analysing CVs must comply with the GDPR for candidate data and with the AI Act for the algorithmic logic. A shared governance (single register, common lead) avoids doing the work twice.
Is training my teams enough to be compliant?
No, but it is the foundation. Training covers Article 4 and enables the rest: trained teams apply transparency, spot risky uses and feed your mapping. You still need the transparency fixes, an internal AI policy and, where relevant, the high risk workstream.
Are nonprofits treated differently from companies?
Not in substance: the regulation targets organisations, not legal forms. A nonprofit employer has the same obligations as an SME. Two specifics though: social sector uses (supporting vulnerable people, prioritising aid) can qualify as high risk, and in France training funding goes through Uniformation rather than a standard OPCO.
How GrowthPerf can help
GrowthPerf is a Qualiopi certified training provider specialised in AI, no-code and automation for SMEs and nonprofits. On the AI Act, our approach is deliberately pragmatic:
- Article 4 training, ready to run. Our AI awareness and operational AI for SMEs programmes cover the AI literacy baseline required by the regulation, with named certificates as evidence. OPCO funding assembled with you, at no extra cost.
- Mapping and classification of your uses. In half a day we list your actual AI uses and classify them by risk level, with a prioritised action plan.
- Transparency fixes. Notices, disclosures, content marking: we handle the 2 August 2026 obligations with you, on your real assets.
Want to know where you stand? Book a free 30 minute AI Act compliance audit: we review your uses, identify the top 2 or 3 actions and the right funding setup. No commitment, no 40 page report, just a clear assessment.
Going further: all our AI Act articles
This guide sets the general framework. Each point below is covered in depth in a dedicated article.
Scope and timeline
- Who the AI Act applies to, and in which capacity, provider or deployer.
- The full timeline of application dates, from 2024 to 2030.
- The AI Act for small businesses: the practical guide.
- The AI Act for a startup building or integrating AI.
- The AI Act and open source: where the line actually sits.
Key provisions
- Article 4 and the AI literacy obligation for your teams.
- The 8 prohibited AI practices under Article 5.
- High-risk systems under Article 6 and their obligations.
- The penalties that apply in 2026 and how they scale.
- How the AI Act differs from GDPR for an SME.
Getting compliant
- Mapping your AI systems: method and template.
- Running the conformity assessment step by step.
- Writing your internal AI policy from a template.
- Writing an AI information notice and knowing when it is required.
- Appointing an AI officer in your organisation.
Tools and concrete situations
- Using ChatGPT compliantly at work.
- Microsoft Copilot 365 compliance in practice.
- Workplace rules for consumer generative AI used by staff.
- Handling employee data where the AI Act meets GDPR.
- Informing your customers and what changes in the relationship.
Written by Romain Bellaïche, founder of GrowthPerf, a Qualiopi certified training provider specialised in AI, no-code and automation for SMEs and nonprofits. Official sources: EU Regulation 2024/1689 on artificial intelligence (AI Act), in particular Articles 4, 5, 50 and 99 and Annex III; the digital omnibus package adopted by the European Parliament and the Council in June 2026; European Commission (AI Office).