EU AI Act for SMEs: what you must and must not do

In short

• If you use AI tools such as ChatGPT, Claude or Copilot, you are a deployer. You have three duties: let your team build AI knowledge, avoid prohibited uses and label AI content where the law requires it.
• The heavier rules for high-risk AI, for example when selecting job applicants, apply only from 2 December 2027.
• You do not need a certificate. You do need an overview of the AI you use and a record of what you have done to support your team.

If you use AI tools rather than build them, the EU AI Act asks less of your small or mid-sized business than the headlines suggest. For you, three duties matter: AI literacy, no prohibited uses, and transparency about AI content. The rest applies to companies that build AI systems, or to high-risk uses that have been postponed for now.

Many business owners do not know this yet. In a Dutch Chamber of Commerce (KVK) survey of 651 entrepreneurs in June 2025, about half said they did not know the AI Act, and 4 in 10 did not know whether it applied to them (KVK, 2025, in Dutch).

This article is not legal advice. It is our translation of the rules into the practice of small and mid-sized businesses. If you are unsure about your own situation, ask a lawyer.

What is the EU AI Act in one paragraph?

The AI Act is the European law on artificial intelligence, and it applies in phases. It sorts AI by risk: prohibited uses, high-risk uses, uses that require transparency, and everything else. On 27 July 2026 the Digital Omnibus entered into force, a package of changes that mainly postpones the high-risk rules (European Commission, 2026). What that changes is covered in EU AI Act 2026: a delay for high risk, not for transparency.

Which role does your company have under the AI Act?

Your role decides which rules apply to you. The Dutch government distinguishes two roles: a provider makes an AI system or has one made, and a deployer uses an existing system (Ondernemersplein, in Dutch).

If you put your name on a high-risk system or substantially modify it, you become the provider yourself (AI Act, Article 25). That is a different set of obligations from using a tool. In that case, have a lawyer look at it.

What does your SME need to do now for the AI Act?

1. Make sure your team can build enough AI knowledge (Article 4). This applies to providers and deployers, including contractors and freelancers who work with AI on your behalf. Since the Digital Omnibus you no longer have to guarantee a specific level, but you do have to support the development.

You do not need a certificate; an internal record of training and other initiatives is enough (European Commission, 2026). Supervision lies with national market surveillance authorities and has run since 2 August 2026. How to approach it is in AI literacy in your organisation.

2. Do not use prohibited applications. Certain uses have been banned since 2 February 2025 (Rijksoverheid, 2025, in Dutch). For an employer, emotion recognition in the workplace matters most: software that infers how employees feel from their face or voice is banned, except for medical or safety reasons. Social scoring and misleading manipulation are also banned. From 2 December 2026 two more bans apply: AI that creates intimate images of identifiable people without their consent, and child sexual abuse material (AI Act, Article 5).

3. Be transparent about AI content (Article 50). Four rules have applied since 2 August 2026:

• A chatbot or AI assistant must make clear that it is AI. This duty lies with the provider, so also with you if you have a chatbot built and deploy it.
• A deepfake, meaning image, audio or video that resembles existing people or events and falsely appears real, must be labelled when you publish it.
• AI-generated text that informs the public on matters of public interest must be labelled, unless a person reviews it and takes editorial responsibility. Having only the spelling and grammar checked does not count.
• If you use emotion recognition or biometric categorisation somewhere it is not prohibited, you inform the people exposed to it.

Content created before 2 August 2026 does not have to be labelled retroactively (European Commission, 2026). When to label what is covered in our article on labelling AI content.

What do you not need to do?

• No certificate or quality mark for AI literacy. According to the Commission it is not required.
• No heavy high-risk rules, if you do not use AI for those purposes. These cover areas such as biometrics, employment and personnel management, education and essential services (Ondernemersplein, in Dutch). A team writing copy with ChatGPT is not in scope.
• No watermarking of AI output yourself. Marking generated content in a machine-readable way is a duty of the tool's provider, not the user.
• No labelling of everything. A label is needed for deepfakes and for AI text on matters of public interest without editorial review. A product description or a newsletter about your offer is usually not about politics, public health, the environment or safety, the examples the Commission gives.
• Fines are capped. The maximum fine for most obligations is €15 million or 3% of worldwide annual turnover. For small and medium-sized businesses the lower of the two applies (AI Act, Article 99). For Article 4, the Commission says sanctions must be proportionate, with attention to the nature and seriousness of the breach.

What are the AI Act deadlines?

So the first two dates are no longer in the future. If you have not arranged anything yet, start now with Article 4 and Article 50.

Sources: Article 113 and the Commission FAQ on Article 50. Be careful with older sources: some government pages still give 2 August 2026 or 2 August 2027 for high risk. That is outdated because of the Digital Omnibus.

In the Netherlands, supervision is not yet settled. On 20 April 2026 the Dutch government put a draft implementing act out for consultation, under which existing regulators supervise AI in their own domain, with the Dutch Data Protection Authority and the digital infrastructure inspectorate (RDI) coordinating (Rijksoverheid, 2026, in Dutch). Check the current status before you build on it.

What can you do tomorrow?

1. List the AI you use. Tool, purpose, data and who works with it. Ask teams that switched on their own tools as well.
2. Check for prohibited uses. Is there software that infers employees' emotions or scores people on behaviour?
3. Agree when you label AI content and who reviews AI text. One sentence in your guidelines is a good start.
4. Decide who owns the topic. With an owner, it does not rest on one enthusiastic colleague.
5. Plan how your team learns. Start with a basic session for everyone and go deeper by role.

How do our workshops help?

In our workshops your team learns to work with AI tools such as ChatGPT, Copilot, Gemini or Claude. We tailor the exercises to the tool you use. A good starting point is Getting started with AI; for the management team there is the session Introducing AI in your organisation.

Every participant receives a confirmation of participation, and you receive a participant list. Together with the date and content of the session, that forms part of your internal record, as the Commission describes it. It is not a certificate the law requires, and on its own it does not prove that you meet Article 4: what also counts is which AI you use, who needs which knowledge and what you agree. How to build that file is in AI literacy in your organisation.

Want your team to be able to do this? See the AI literacy training.

Sources

• European Commission (27 July 2026), AI Omnibus enters into force
• European Commission, AI Literacy: Questions & Answers
• European Commission (updated 24 July 2026), Transparency obligations under Article 50 of the AI Act
• Regulation (EU) 2024/1689 as amended by the Digital Omnibus, via the AI Act Service Desk: Article 5, Article 25, Article 99, Article 113
• Ondernemersplein (Dutch government business portal), Regels voor het werken met veilige AI (Dutch)
• Rijksoverheid (3 February 2025), Europese verboden op ongewenste AI-toepassingen ingegaan (Dutch)
• Rijksoverheid (20 April 2026), Kabinet zet stap met toezicht op Europese AI-regels (Dutch)
• KVK (11 September 2025), KVK onderzoek: ondernemers zetten nauwelijks stappen rond Europese AI-wetgeving (Dutch)