The EU AI Act for small companies: what it actually requires in 2026
Updated 10 September 2026, after the AI Digital Omnibus came into force (Regulation (EU) 2026/1744, applicable from 27 July 2026), which changed the EU AI Act timetable. If you have read a guide written before the summer, the dates it gave you are no longer correct.
The 30-second summary
- If your company uses AI tools (ChatGPT, Copilot, a chatbot, an invoice reader), you are a deployer, not a provider. Your obligations are few and manageable.
- Three things already apply to you today: the prohibited practices, the AI literacy duty in Article 4 and, since 2 August 2026, the transparency duty in Article 50.
- The heavy part, high-risk systems, has been pushed back to 2 December 2027. And it most likely does not concern you.
- There is no official EU AI Act compliance certificate for small companies. Anyone selling you one is selling you smoke.
First things first: almost no small company is an AI provider
The regulation assigns obligations according to the role you play, not your size. The distinction worth understanding is this one:
- Provider: whoever develops an AI system and puts it on the market under their own name. That is OpenAI, Google, Microsoft, or a software company selling its own AI.
- Deployer (that is the word the regulation uses, odd as it sounds): whoever uses an AI system under their own authority. That is practically every small company and sole trader.
This matters because 90% of the EU AI Act's obligations — the ones that sound frightening in headlines — fall on the provider. If your company uses ChatGPT to draft emails, or an assistant that reads your invoices, you are a deployer and the list of duties is short.
One exception to watch: if you take someone else's tool, put your brand on it and sell it as your own, or if you substantially modify it, you become a provider. It is uncommon in a small company, but it happens.
What applies today and what has been postponed
The EU AI Act did not come into force all at once: it applies in stages. This is the real timetable after the Digital Omnibus:
| Date | What starts to apply | Does it affect you if you use AI at work? |
|---|---|---|
| 2 Feb 2025 | Prohibited practices (Art. 5) and AI literacy (Art. 4) | Yes |
| 2 Aug 2025 | General-purpose models, governance and the penalty regime | Indirectly |
| 27 Jul 2026 | The AI Digital Omnibus comes into force | Yes: it changes the timetable and softens Art. 4 |
| 2 Aug 2026 | The rest of the regulation, including Art. 50 transparency, and market surveillance | Yes |
| 2 Dec 2026 | New prohibitions on non-consensual intimate content and CSAM | Rarely |
| 2 Dec 2027 | High-risk systems under Annex III | Only in some cases (see below) |
| 2 Aug 2028 | High-risk embedded in regulated products (Annex I) | Only if you manufacture products |
The important news of summer 2026 is the postponement: the Annex III high-risk obligations, originally due on 2 August 2026, have moved to 2 December 2027. Many guides still circulating online do not reflect this.
The four risk levels, in plain terms
The regulation classifies uses, not tools. The same technology can be minimal risk or high risk depending on what you use it for.
| Level | Examples | What it means |
|---|---|---|
| Unacceptable | Social scoring, emotion recognition at work, untargeted scraping of facial images from the internet | Banned since February 2025 |
| High risk | Automated CV screening, promotion or dismissal decisions, creditworthiness assessment, admission to education | Heavy obligations from December 2027 |
| Limited risk | Customer service chatbots, text or image generation | Duty to disclose (Art. 50) |
| Minimal risk | Spam filters, writing suggestions, email categorisation | No specific obligations |
Notice one thing that often slips past small companies: if you use AI to screen job applications, that is high risk. Not because it is dangerous in the abstract, but because it decides a person's access to work. It is the case where a small company finds itself with serious obligations without having gone looking for them.
The three obligations that do affect an ordinary small company
1. AI literacy (Article 4)
This is the one almost nobody has done. Article 4 requires providers and deployers to make sure their people know what they are handling. The Digital Omnibus softened it on a point worth knowing: the law now says you must take measures to foster the development of AI literacy, and expressly clarifies that it does not require guaranteeing a specific level in each individual.
Translated: it is an obligation of means, not of result. Nobody is going to examine your staff. What you can be asked for is evidence that you have done something, and that something has to be proportionate to your size and to what you use. For a ten-person company using ChatGPT, a short training session and some written internal rules already do the job. That is exactly what the AI literacy material I put together covers, and I explain it in detail in the article on the Article 4 training duty.
2. Transparency (Article 50), applicable since August 2026
If you have a chatbot, the person must know they are talking to a machine. If you publish AI-generated text, images, audio or video, it must be identifiable as such. And if you use AI to generate informative content aimed at the public, you have to say so.
It is the cheapest obligation to meet and the one most often missed through sheer inattention: one sentence is enough. It is also the friendly face of a real problem — not knowing whether what you are looking at is authentic; I wrote about that in the article on fake video calls.
3. Not using prohibited practices
They have been banned since February 2025 and some are less exotic than they sound. The most relevant one for a company: emotion recognition of workers in the workplace. If somebody offers you software that analyses your team's tone of voice or faces to measure engagement, that is prohibited, with narrow exceptions for safety or health.
A concrete example: a twelve-person accountancy practice
Picture a tax and accountancy practice with twelve staff. It uses ChatGPT to draft documents, an automatic invoice reader, and a chatbot on the website for booking appointments.
- Role: deployer in all three cases.
- Risk level: minimal for the first, limited for the chatbot, minimal for the invoice reader.
- What it must do: train the team and document it (Art. 4), disclose on the chatbot that it is a bot (Art. 50), and have internal rules on which data may and may not be pasted into an AI tool.
- What it does NOT have to do: conformity assessments, CE marking, registration in the European database or external audits. None of that applies.
In total: an afternoon of careful work, not a six-month consultancy project. That gap between the fear and the actual obligation is, in fact, one of the most common mistakes when starting with AI.
And if I do not comply? The penalties
- Prohibited practices: up to €35 million or 7% of annual worldwide turnover.
- Breaching the other obligations: up to €15 million or 3%.
- Giving incorrect information to the authorities: up to €7.5 million or 1%.
Before your heart skips: the regulation expressly provides that for small companies and start-ups the fine is the lower of the two figures, not the higher. And since 2 August 2026 supervision sits with the national market surveillance authorities. In Catalonia and in Spain that machinery is still being set up, so today the realistic risk for a small company is not a multimillion-euro fine: it is being caught out when a large client contractually asks you to evidence that you comply.
Checklist: six steps for a small company
- Take an inventory. List every AI tool in use in the company, including the ones somebody brought in on their own initiative. It usually turns out to be double what you expected.
- Assign the role. For each tool, are you a provider or a deployer? Almost always the latter.
- Classify the use. Minimal, limited or high risk? Pay particular attention to any use affecting people: hiring, promotion, assessment.
- Train the team and write it down. Who, when, what content, and keep the evidence. Without a record, in practical terms you have not done it.
- Write the internal rules. What may and may not be pasted into an AI, what must always be reviewed before sending, and who gets told if something goes wrong. Two pages is plenty.
- Add the transparency notices. On the chatbot and on any AI-generated content you publish.
Frequently asked questions
Does the EU AI Act apply to sole traders too?
Yes. The regulation grants no exemption by size: it applies to anyone placing AI systems on the market or using them in the European Union. What it does do is scale the requirement, because measures must be proportionate to the context, and cap the amount of the fines for small companies.
Do I need an official compliance certificate?
No such thing exists. The EU AI Act creates no official approval or training certification for small companies. What you need is to be able to evidence what you have done: a training record, written rules and an inventory. Be wary of anyone selling you an official EU AI Act seal.
I use ChatGPT at work. Does that make me an AI provider?
No. The provider is OpenAI. You are a deployer, with the obligations we have seen: training, transparency if you publish generated content, and not using it for prohibited practices.
Do I have to register my AI systems anywhere?
The European database is for high-risk systems, and the registration duty falls on providers and on deployers that are public authorities. A small company using minimal or limited risk tools registers nothing.
My software vendor says it already complies. Is that enough?
Only partly. The vendor meeting its own obligations does not release you from yours: training your team and how you use the tool remain your responsibility. Ask them in writing exactly what they comply with, and keep it.
This article is general information, not legal advice. For a specific decision with legal consequences, consult a qualified lawyer.
About this article
iaetica.cat is a space for public writing: I publish here what I am learning about artificial intelligence, its ethics and its law.
— Laura Graells