AI Act for SMEs: what applies now and what lands in 2026

Today the AI Act asks two things of your SME: make sure your team knows the basics of AI, and stay away from prohibited uses such as social scoring. What is coming is one hard date, 2 August 2026, when customer-facing AI like a chatbot has to be recognisable as AI. The heavy high-risk obligations behind all the panic articles have since been pushed back. For most SMEs the whole exercise fits on a single A4 page.

What exactly is the AI Act?

The AI Act is the European regulation that sets rules for anyone who builds or uses AI systems, with stricter requirements as the risk goes up. It entered into force in August 2024 and applies in phases. Prohibited practices such as social scoring or manipulation have applied since 2 February 2025, together with the duty to give your staff a basic grounding in AI. The rest follows later, spread over several years.

Which rules already apply to my SME?

Two obligations apply right now, small companies included: your staff has to be able to work with AI, and you may not deploy prohibited practices. Everything after that arrives in later phases. Concretely:

1. AI literacy (Article 4). Anyone who deploys AI has to make sure staff can handle it: know what the tool does, what its limits are and when a human has to step in. The FPS Economy sums it up as "informing and training staff". Good news: that kind of training qualifies for the kmo-portefeuille, the Flemish SME subsidy scheme.
2. No prohibited practices. No systems that manipulate people, hand out social scores or read emotions in the workplace. For an average SME this is a non-issue, unless you were getting creative with HR tooling.

Want it properly documented? A short AI policy on paper shows that you take it seriously.

What changes on 2 August 2026?

From that date the transparency rules of Article 50 apply: put a chatbot or AI assistant in front of customers and you have to make clear that they are dealing with AI. That is the deadline that really matters for most SMEs. The FPS Economy offers a sample label itself: "You are chatting with an AI assistant. The answers are generated automatically." Deepfakes and AI-generated content have to be recognisable too, although the recent EU agreement gives the machine-readable marking of generated content a transition period until 2 December 2026. In short: a label on your chatbot, and clarity towards employees, customers and candidates whenever AI has a hand in a decision.

Has the big high-risk deadline of August 2026 been postponed?

Yes, as good as. On 7 May 2026 the Council and the European Parliament reached a political agreement to delay the obligations for high-risk systems. They move to 2 December 2027 for uses such as recruitment, education and critical infrastructure, and to 2 August 2028 for AI in regulated products such as machinery and medical devices. The legislators want the formal approval wrapped up before 2 August 2026, and until publication in the Official Journal that remains, strictly speaking, the legal date. Watch out if you use AI in hiring: CV screening and candidate assessment sit on the high-risk list. The delay buys you breathing room, not a free pass.

Am I a provider or a deployer?

Buy an off-the-shelf tool or ChatGPT licences and you are a deployer. Have something built for you and it depends on what you agree. That role decides your obligations. A provider develops an AI system (or has it developed under its own name) and answers for its safety and quality. A deployer puts an AI system to work under its own responsibility, within the purpose the provider set. If you have a custom AI solution built, the arrangements decide: once the system goes to market under your name, you can become the provider yourself. Settle that at the start of a project, so nobody is surprised afterwards about who carries which duty.

What should an SME actually do?

Start small: list your AI tools, decide your role for each one and train your team. That already covers the bulk of the law. The full exercise for an average SME:

1. Take stock of the AI tools running in your company, the unofficial ones included (that one colleague with a personal ChatGPT subscription counts). A structured approach to introducing AI helps here.
2. Decide your role per tool: deployer or provider.
3. Train your team and document it. Half a day of training is often enough as a starting point.
4. Label customer-facing AI by 2 August 2026: chatbots, generated emails, AI that assesses candidates or customers.
5. Check your suppliers: ask who the provider is and whether the tool falls into a high-risk category.
6. Keep logs of what your AI does. The FPS Economy recommends at least six months.

What do you risk if you get it wrong?

Maximum fines run up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other infringements. SMEs get one important softener: the lower of the two amounts forms the cap, instead of the higher one. Belgium is putting the finishing touches to the designation of its supervisory authorities, with BIPT taking the central coordinating role.

The AI Act keeps moving: this article describes the state of play on 10 June 2026, before the formal vote on the delay. The guide from the FPS Economy tracks the current position.

---

Build a custom AI solution with us and the role split (provider or deployer), the transparency label and the logging come with it. Unsure about a tool you already use? Just ask and we will look at it together.