EU AI Act compliance for SMEs: obligations, key dates and what to do now.

Yes. Companies that deploy AI systems built by others — known as "deployers" — have obligations under the EU AI Act. These include taking measures to support AI literacy among staff (Article 4, in force from 2 August 2026), informing users when they interact with AI systems (Article 50, in force from 2 August 2026), and preparing for the Annex III high-risk deployer obligations under Article 26, which apply from 2 December 2027. The scope of obligations depends on which AI tools you use and for what purpose.

High-risk AI systems are those listed in Annex III of the Act. They include AI used in recruitment and HR decisions (such as CV screening), critical infrastructure management, education and vocational training assessments, access to essential services (credit, insurance), law enforcement, and biometric identification. The full compliance obligations for Annex III systems — including conformity assessment, EU database registration, and the Article 26 deployer duties — apply from 2 December 2027. This date was amended from the original 2 August 2026 by Regulation (EU) 2026/1744.

The Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Key dates: Article 5 prohibited practices applied from 2 February 2025 (and remain in force). General-purpose AI model provider obligations applied from 2 August 2025. Article 4 (AI literacy measures) and Article 50 (transparency) apply from 2 August 2026. Two new Article 5 prohibitions added by Regulation (EU) 2026/1744 apply from 2 December 2026. The full Annex III high-risk system obligations (Chapter III) apply from 2 December 2027 — amended by Regulation (EU) 2026/1744 from the original August 2026 date. Annex I regulated-product high-risk systems apply from 2 August 2028.

Article 4 (as amended by Regulation (EU) 2026/1744) requires providers and deployers to take measures to support the development of sufficient AI literacy skills among their staff and others dealing with AI on their behalf. The obligation is proportionate — the level of literacy support required scales with the role and the risk level of the AI systems involved. No specific training certification, course duration, or minimum qualification level is mandated. Documented guidance, training records, and staff briefings are practical ways to demonstrate compliance. This obligation applies from 2 August 2026.

Article 5 prohibits certain AI uses entirely. Original prohibitions (in force 2 February 2025) include: AI that manipulates behaviour through subliminal or deceptive techniques; exploitation of vulnerabilities of specific groups; real-time remote biometric identification in public spaces (with narrow law-enforcement exceptions); social scoring by public authorities; emotion recognition in workplaces or educational institutions (with limited exceptions); and AI that infers protected characteristics from biometric data. Regulation (EU) 2026/1744 added two new prohibitions applying from 2 December 2026: Article 5(1)(ba) prohibiting AI that generates non-consensual intimate synthetic imagery of real individuals, and Article 5(1)(bb) prohibiting AI that generates child sexual abuse material. This assessment screens for certain Article 5 risks but does not constitute exhaustive legal clearance for every prohibition.

Article 50 requires deployers to disclose to users when they are interacting with an AI system (Article 50(1)) — for example via chatbots or virtual assistants — unless this is obvious from context. AI-generated or significantly AI-modified images, audio, and video must be labelled as such in a machine-readable format (Article 50(4)). These obligations apply from 2 August 2026. Pre-existing systems in use before that date should have reached compliance promptly. There is a limited transitional accommodation for certain pre-existing synthetic content systems under the amended regulation.