Knowledge · As of 2026-09-07
EU AI Act: which obligations apply to SMEs?
The deadlines
The regulation phases in. Four dates matter in practice:
| Since | Obligation |
|---|---|
| 02 Feb 2025 | Prohibited practices and Article 4: AI literacy for all companies using AI |
| 02 Aug 2025 | Obligations for GPAI model providers, governance and penalties |
| 02 Aug 2026 | General applicability incl. transparency (Article 50): label AI chatbots, disclose deepfakes |
| 02 Aug 2027 | High-risk obligations for AI in regulated products |
What this means for a typical SME
Most mid-sized companies run limited- or minimal-risk AI: chatbots, assistants, generative tools. For those: label AI interaction and ensure documented AI literacy in the team - in many cases, that is it. It gets serious with high-risk applications under Annex III (recruiting, credit scoring, critical infrastructure): risk management, data quality, documentation, and human oversight then apply.
Fines reach €35 million or 7% of global turnover for prohibited practices, €15 million or 3% otherwise. The pragmatic roadmap: inventory your AI systems, classify them, establish the Article 4 proof (an AZAV-certified training is fundable in Germany), write an AI policy, review yearly.
Frequently asked questions
Does the AI Act apply if we only use ChatGPT?
Yes. Pure users must ensure AI literacy in the team since 02/2025 (Article 4). Provider obligations do not apply to you as a user.
Do we have to label our website chatbot?
Yes - since 02 Aug 2026, Article 50 requires that users can recognize AI interaction unless it is obvious. One sentence in the chat window usually suffices.
Read next
KI-COMPLIANCE: our services →Article 4 trainings (fundable) →
Factual summary, as of 09/2026 - not legal advice. Deadlines may shift through ongoing EU legislation.