EU AI Act for SMEs: What Business Leaders in the DACH Region Need to Know in 2026

The EU AI Act has been in force since August 2024, but it applies in stages. This creates a misconception I keep hearing from business owners: “2026 is still far away.” It is not. Two obligations have been in effect since February 2025, and one of them applies to virtually every company using AI.

Let me sort this out.

The timeline

The AI Act does not kick in all at once. It rolls out in stages:

August 2024: The regulation enters into force.
February 2025: Prohibited practices (Art. 5) and the AI literacy obligation (Art. 4) apply.
August 2025: Obligations for providers of general-purpose AI models (GPAI), governance structures, sanctions rules.
August 2026: Most obligations, including requirements for high-risk systems under Annex III.
August 2027: High-risk systems falling under existing product safety legislation (Annex I).

For most SMEs, two dates matter: February 2025 (already past) and August 2026.

Who is affected?

The AI Act distinguishes between providers, who develop or place AI systems on the market, and deployers, who use them. Most SMEs are deployers. They do not build their own models; they use tools: an AI-powered CRM, automated invoice processing, a chatbot in customer service. As a deployer, you have fewer obligations than a provider, but not none.

What already applies: Art. 4 and the prohibitions

This is the point almost everyone misses. Two things have been enforceable since February 2025.

First, the prohibited practices under Art. 5: social scoring, subliminal manipulation, real-time remote biometric identification in public spaces. Rarely relevant for ordinary SMEs in day-to-day operations, but worth knowing that this line is non-negotiable.

Second, and this very likely affects you, the AI literacy obligation under Art. 4. Anyone deploying AI in their organisation must ensure that staff working with it have sufficient AI competence, proportionate to their role and the context of use. There is no certification requirement and no prescribed form. But it is your responsibility: a documented briefing, clear usage rules, demonstrated basic understanding. If your company uses ChatGPT, Copilot, or a comparable tool and has no rules in place, you are technically already non-compliant.

The risk categories

The AI Act works with four tiers:

Prohibited practices: see above. Typically irrelevant for SMEs.
High risk: AI in employment (recruitment, performance evaluation), creditworthiness, education, critical infrastructure. This is where the real compliance effort lies, if it applies to you.
Limited risk: Transparency obligations. A chatbot must be identifiable as AI, AI-generated content must be labelled.
Minimal risk: everything else. No special obligations beyond Art. 4.

The honest assessment: the majority of SME use cases fall into limited or minimal risk. High risk becomes relevant where AI co-decides about people, above all in recruitment.

Three steps for 2026

1. Inventory

Create a list of all AI-powered tools in your company. Not just the obvious ones like ChatGPT integrations, but also embedded AI: suggestions in your ERP, filters in your email solution, image recognition in quality control. For each system: who is the provider, what data goes in, what decisions come out, are people affected?

2. Risk assessment

Assign each system to a category. The decisive question: are you using AI in recruitment, credit scoring, or safety-critical processes? If yes, the high-risk requirements apply (risk management, data governance, technical documentation, human oversight, robustness). If not, your obligations are essentially limited to transparency and Art. 4.

3. Documentation and responsibility

Record which systems you deploy, who is internally responsible, and what usage rules apply. This is not an end in itself. If a system makes a flawed decision, you want to know who is in charge and what process kicks in.

The reliefs that hardly anyone mentions

The AI Act deliberately mentions SMEs dozens of times and provides targeted relief (including Art. 62):

Priority, free-of-charge access to regulatory sandboxes (protected testing environments).
Reduced fees for conformity assessments.
Simplified technical documentation; the European Commission is providing templates.
For fines, SMEs are subject to the lower of the applicable caps. Proportionality is built in.

In Austria, there are concrete contact points: the RTR AI Service Centre as an information hub (including an AI Act chatbot) and the WKO AI guide. Both free, both tailored to SMEs.

What you do not need to do

Certify your own AI models. You are a deployer, not a provider. Certification is the provider’s responsibility.
Declare every automation as AI. Rule-based logic typically does not fall under the AI Act definition.
Hire an AI officer immediately. A designated responsible person is sufficient for now.

Where to start

Two things, both doable this week. First: check whether you meet Art. 4. Does your team use AI, and is there a documented briefing and usage policy? If not, that is the first gap. Second: start the inventory. A spreadsheet with columns for System, Provider, Purpose, Affected persons, Risk category is enough to begin with. On that basis, you can decide whether you need external advice or whether the effort is smaller than feared.

Transparency: This post was created with AI assistance. I reviewed it and take responsibility for the content. More under AI Transparency.