EU AI Act: what businesses must do, and when

For most SMEs, the AI Act currently comes down to three tasks: train the teams that use AI, label agents and chatbots as AI, and check that no use falls into a high-risk category. Everything else depends on what your systems do.

The Commission proposed the Digital Omnibus on AI on 19 November 2025. The European Parliament voted for it on 16 June 2026 and the Council gave final approval on 29 June. It was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. It is now binding law.

What it means for a business:

• High-risk rules postponed. Annex III moves from 2 August 2026 to 2 December 2027, and Annex I from 2 August 2027 to 2 August 2028.
• AI literacy softened. Article 4 used to require a sufficient level of AI literacy; it now requires measures to support it.
• Wider relief. Simplifications that used to be reserved for SMEs now also cover small mid-cap companies.
• Two new bans from 2 December 2026, covering sexual content generated without consent and child sexual abuse material.
• Simpler impact assessment. The fundamental rights impact assessment can build on the GDPR data protection impact assessment.

The postponement leaves the rules already in force untouched. It gives sixteen more months to prepare high-risk uses, including recruitment: our comparison of AI agencies for HR explains what this means for tools that screen job applications.

Prohibited practices (Article 5), since 2 February 2025. These include social scoring, manipulation that exploits vulnerabilities, and emotion recognition in the workplace or in education, except for medical or safety reasons. An HR tool that analyses candidates' emotions during video interviews falls under this ban.

AI literacy (Article 4), since 2 February 2025. Businesses that use AI systems must take measures so that their staff, and the people who use these systems on their behalf, understand the tools. In its FAQ, the Commission states that no certification is required, that there is no one-size-fits-all approach, and that keeping an internal record of training is useful. It suggests four steps: a general understanding of AI, the role of the business, the risks of the systems in use, and then training suited to each person's level.

Transparency (Article 50), since 2 August 2026. People must be told they are dealing with an AI, at the latest during the first interaction, unless it is obvious. Deepfakes must be labelled. Our guide to the transparency obligation for AI agents explains who must do what between the tool vendor and the business that deploys it.

A system is classified by its purpose, and its sector alone settles nothing. Under Article 6(2), a system is high-risk when it is used for one of the purposes listed in Annex III.

Article 6(3) sets out an exception. A system listed in Annex III does not count as high-risk if it only performs a narrow procedural task, improves the result of a human activity already completed, detects patterns without replacing human assessment, or performs a preparatory task. This exception never applies to a system that profiles natural persons. A provider relying on it must document its assessment.

The Commission is preparing guidelines on this classification; the final version is expected by the end of 2026.

For concrete use cases by profession, see our guides on human resources, real estate, legal and healthcare.

The AI Act separates the provider, who develops an AI system or has it developed and places it on the market under its own name, from the deployer, who uses a system under its authority in a professional context. An SME using an AI tool it has bought is a deployer. It can become a provider if it sells a system under its own brand, substantially modifies it, or changes its purpose to the point of making it high-risk.

For a high-risk system, Article 26 requires the deployer, from 2 December 2027, to:

1. use the system in line with the provider's instructions for use;
2. assign human oversight to people with the necessary competence, training and authority;
3. make sure the input data it controls is relevant;
4. monitor how the system works and report risks and serious incidents to the provider and the authority;
5. keep automatically generated logs for at least six months;
6. inform workers' representatives and affected employees before using the system in the workplace;
7. tell people when a high-risk system is involved in a decision about them.

Article 27 adds a fundamental rights impact assessment for some deployers: public bodies, private entities providing public services, and businesses that use AI to assess people's creditworthiness or price life or health insurance.

When you commission a custom agent, the split of roles should be written into the contract. Our design principles are set out in our guide to AI agent security.

For SMEs and start-ups, Article 99(6) uses the lower of the two amounts. These figures are caps: the national authority sets the fine based on the seriousness and duration of the breach and the size of the business.

As of 13 September 2026, France has not yet passed the law designating its competent authorities. The provisions sit in a bill adapting French law to EU law, approved by the Senate on 18 February 2026 and still under discussion at the Assemblée nationale.

The bill gives coordination and the single point of contact role to the DGCCRF (French consumer protection authority), and a central role to the CNIL (French data protection authority) for high-risk systems, in particular those related to employment and biometrics. The ACPR would oversee credit and insurance, the ANSM medical devices, and Arcom synthetic content. These roles still need to be confirmed by the final vote.

In its Q&A page updated on 17 August 2026, the CNIL points out that it remains fully competent to apply the GDPR, and that the AI Act adds to the GDPR without replacing it.

1. List your AI uses, including tools you have bought, AI features built into your software and individual use by your teams.
2. Classify each use: prohibited, high-risk under Annex III, transparency, or minimal. Record your role, deployer or provider.
3. Stop anything prohibited, starting with any emotion analysis at work.
4. Put transparency in place for public-facing chatbots, agents and generated content.
5. Train and document: an AI literacy action suited to each role, with a written record.
6. Prepare for high-risk rules before December 2027: ask providers for their documentation, name the people responsible for human oversight, organise log retention and plan how employees will be informed.

This work is part of our AI consulting and of every project we deliver in a regulated sector. If your use relies on an AI API, data hosting is also a question: see our guide to Claude API pricing and hosting.