AI Act: what changes for SMEs and mid-sized companies, and when
Prohibited practices, AI literacy, transparency, high risk: the AI Act timeline and what it concretely requires from an SME or a mid-sized company.
The European regulation on artificial intelligence (the "AI Act") is often feared for the wrong reasons. For an SME or a mid-sized company that uses AI tools, it mainly asks for three things: transparency, skills, and caution about a few uses. Here is the timeline and what it changes, as the law stood on 11 September 2026.
The timeline
| Date | What applies |
|---|---|
| Since February 2025 | Prohibited practices (for example social scoring of people, or emotion recognition in the workplace) and the AI literacy obligation: taking measures so that the people who use AI in the company master it, in proportion to their use. Since 27 July 2026 (Regulation (EU) 2026/1744), it is a best-efforts obligation: no specific level has to be guaranteed for any individual. |
| Since 2 August 2025 | Obligations for providers of general-purpose AI models (they concern software publishers, not users). |
| Since 2 August 2026 | Transparency: telling people they are dealing with an AI, flagging generated content. |
| 2 December 2026 | Technical marking of generated content, for systems already on the market. |
| 2 December 2027 | Obligations for so-called high-risk systems, including those used for recruitment (a deadline postponed by a regulation of July 2026). |
What it changes for an SME or a mid-sized company
- Tell the people you deal with when they are interacting with an AI: on your website, by phone, by email.
- Flag content generated by an AI.
- Build your teams’ skills on the tools they use.
- Do not leave a tool alone to sort applications or assess your employees.
- Know the prohibited practices, so as not to stray into them unknowingly.
The real trigger: a customer
For most companies, the question will not come from an inspection, but from a client who asks, in a tender or a questionnaire, for guarantees about your use of AI. This is already happening with other security regulations.
Penalties exist; for an SME, the lower of the two ceilings applies, a rule extended in 2026 to the smallest mid-sized companies (fewer than 750 employees, below a turnover ceiling), not to all of them. But the concrete challenge is being able to answer your customers: knowing which AI tools are used in your company, under which rules, and proving it.
Where to start
- Take stock of the uses of AI in the company, including those nobody has declared. See Your teams already use AI without saying so.
- Write a usage charter: which tools, which data, who reviews.
- Correct the gaps: informing people, flagging content, records, human approval.
- Build a file of evidence, reusable to answer a customer.
That is exactly the content of the AI Usage Audit, delivered within five working days.
What we build in by default
In everything we deliver that interacts with people, the notice "you are dealing with an AI" is built in by default. No irreversible action is left to an agent alone. The details, updated every six months: AI Act.
Our field is technical compliance. The legal assessment, a certificate of compliance or an opinion on a risk of penalty are matters for your data protection officer or your lawyer.
Sources
- Regulation (EU) 2024/1689 on artificial intelligence, in particular its Articles 4 (AI literacy), 50 (transparency) and 99 (penalties); official text.
- Regulation (EU) 2026/1744, which rewrites Article 4 and postpones some deadlines; official text.
- Regulation (EU) 2026/1744 ("Digital Omnibus"), published in the Official Journal of the EU on 24 July 2026, which postpones certain deadlines.