EU AI Act: What SMEs Actually Need to Do Now

Updated October 2026: The Digital Omnibus (Regulation (EU) 2026/1744) postponed the high-risk deadlines. See the EU AI Act guide for the current state and all sources.

Which Deadlines Apply Now

After the Digital Omnibus, obligations for Annex III high-risk AI systems apply from 2 December 2027, and for Annex I systems from 2 August 2028. In Germany, the Bundesnetzagentur is the central supervisory authority under the KI-MIG. Breaches of deployer obligations can be fined up to €15 million or 3% of global annual turnover — whichever is higher.

The good news: most SMEs don't operate high-risk AI under Annex III. The bad news: many don't know that — and risk either unnecessary anxiety or real compliance gaps where they genuinely exist.

Which of Your AI Systems Are Affected

The EU AI Act defines four risk classes: prohibited systems, high-risk systems (Annex III), limited-risk systems, and minimal-risk systems. For SMEs, three Annex III categories are most relevant:

• HR systems with AI scoring: Recruitment screening, performance evaluation, "cultural fit" algorithms. Automated personnel decisions trigger high-risk classification.
• Credit and creditworthiness assessment: AI-driven credit decisions, supplier risk scoring, automated payment default predictions.
• Critical infrastructure: AI in energy, water, or essential services — typically not relevant for most SMEs.

Risk classification depends on intended purpose, deployment context and affected persons. Content creation, marketing automation, process automation and knowledge systems therefore need individual assessment rather than a blanket category.

The 5 Obligations as an AI Deployer

Deployers are organisations that use an AI system built by someone else — which means practically every SME using AI software. For high-risk systems, these obligations apply once the deadline starts:

• 1. AI literacy (Art. 4): Since February 2025, organisations take measures that support the AI literacy of staff who use AI or evaluate its outputs. Documented training is the simplest evidence.
• 2. Risk management: Documented system to identify, assess, and control risks of the deployed AI system.
• 3. Human oversight: For high-risk decisions, a designated human must retain control and be able to intervene. Fully automated decisions without the ability to intervene are not compatible with this.
• 4. Record-keeping: Automated logs of all AI activity, retained for at least 6 months, available to regulators on request.
• 5. Transparency to those affected: Individuals subject to AI decisions (applicants, borrowers) must be informed.

8-Week Roadmap for SMEs

The postponed deadlines are breathing room, not a free pass. Eight weeks are enough for the foundations — if you start now.

• Weeks 1–2: Inventory. List all AI systems in use: which tools, which vendors, what decisions are supported or made? HR and CRM platforms often contain AI features that aren't immediately obvious.
• Week 3: Risk classification. For each system, assess intended purpose, deployment context and whether Annex III applies. Do not classify by product label alone.
• Weeks 4–5: High-risk measures. For identified high-risk systems: build risk documentation, formalise human oversight, ensure logging.
• Week 6: AI literacy documentation. Document training measures — structured self-study with a signed acknowledgement is sufficient as a starting point.
• Weeks 7–8: Finalise documentation. Everything in writing, dated, with named responsible persons. In an audit, only what is documented counts.

What This Means for Your Choice of AI Platform

SMEs introducing an AI platform now should treat compliance not as an add-on, but assess hosting, logging, and data processing for their specific use case.

AIPE provides organisation-scoped access controls. Providers, data flows, and regulatory requirements must be configured and reviewed for each customer context.