AI Act and SMEs: What Really Applies, and What a Local AI Changes
Updated: November 2026
AI Act: What does an SME need to do?
Less than you might think, but not nothing.
For most SMEs, the AI Act currently requires three things: training teams, avoiding prohibited uses, and reporting certain content. The heavy rules target high-risk uses, such as CV screening, and are postponed until December 2, 2027.
A local AI does not exempt you from the AI Act. The regulation targets how you use AI, not where it runs. However, it simplifies a good deal of the work, especially regarding data. Here is the latest update following the Digital Omnibus published in July 2026.
The timeline following the July 2026 Omnibus
Regulation (EU) 2026/1744 was published in the Official Journal on July 24, 2026, and entered into force on July 27. It postpones high-risk requirements, with fixed dates. It does not affect existing prohibitions or transparency requirements.
Prohibited practices and staff AI literacy. Already in force.
General-purpose AI model provider obligations. These do not target companies that use a model.
Article 50 transparency. Already in force. National authorities can also monitor AI literacy.
New prohibitions on non-consensual intimate content and child sexual abuse material. The grace period for generative system providers already on the market to implement watermarking ends.
Annex III high-risk systems: employment, credit, education, biometrics.
High-risk systems integrated into regulated products (Annex I).
You are almost always a "deployer"
The AI Act distinguishes two roles. The provider develops a system and places it on the market. The deployer uses it in their business. An SME that uses ChatGPT, Copilot, or an open-source model on its own machine is a deployer.
Installing the model on your own machine does not make you a provider. However, be careful if you resell an AI tool under your own name, or if you change its intended use: you may then incur provider obligations. This is a point to check with a legal professional.
Your use: where does it fall?
| Use | Level | What it entails |
|---|---|---|
| Summarizing documents, writing, translating, searching your files | Minimal risk | No specific obligations, except for staff AI literacy. |
| Chat assistant on your website | Transparency | The person must know they are talking to an AI. This obligation falls on the system provider. If the tool is made for you, check that it displays this. |
| Publishing a realistic deepfake image or video | Transparency | You must disclose that the content is generated or manipulated. |
| Publishing AI-generated text of public interest | Transparency | Must be disclosed, unless it has undergone editorial review under the responsibility of an identified person. |
| CV screening, promotion decisions, performance monitoring | High risk | Deployer obligations as of December 2, 2027, including prior notification to employees and their representatives. |
| A person's creditworthiness, life or health insurance rates | High risk | Same deadlines. Fraud detection is not covered for credit. |
| Deducing an employee's emotions at work | Prohibited | Prohibited since February 2, 2025, except for medical or security reasons. |
What you must already do
Support your teams' AI literacy
Article 4 has been relaxed. You must take measures to ensure your employees understand the tool, without having to guarantee a specific level for each person. We are moving from an obligation of result to an obligation of means. A short training session and written, dated instructions are a good start.
Avoid prohibited uses
Manipulation, social scoring, inferring emotions at work, sensitive biometric categorization. An SME almost never touches these, but check the functions of the HR tools you buy.
Disclose what must be disclosed
Realistic deepfakes and unreviewed texts of public interest. Add the disclosure to your publishing procedures.
Sanctions and the rule for SMEs
| Violation | General cap | For an SME |
|---|---|---|
| Prohibited practices | €35M or 7% of worldwide turnover, whichever is higher | The lower of the two |
| Deployer obligations, transparency | €15M or 3%, whichever is higher | The lower of the two |
| Inaccurate information to authorities | €7.5M or 1%, whichever is higher | The lower of the two |
The Omnibus did not change these caps. It added relief for SMEs and small and medium-sized enterprises, particularly on the supplier side: simplified technical documentation and proportionate quality management. In France, designation of supervisory authorities was not complete at our last check, in October 2026.
What local AI changes, and what it does not change
| Topic | With an online service | With local AI |
|---|---|---|
| Risk level of use | Depends on use | Same: depends on use |
| AI control by staff | To be done | To be done |
| Personal data (GDPR) | Subcontractor, transfers to verify | It stays with you, less subcontracting to manage |
| Usage logs | Depending on the provider's offer | With you, for the duration you set |
| Model change | The provider can change it | It only changes if you decide |
The five-step plan
1. List your uses
Each AI tool, who uses it, on what data. Including personal ChatGPT accounts used at work.
2. Classify them
With the table above. Isolate everything related to recruitment, employees, credit, and insurance.
3. Give written instructions
What is allowed, what is not, what data to never paste into an online service.
4. Train, and keep a record
Date, content, participants. This is your proof of means for Article 4.
5. Get sensitive data out of the cloud
For client, patient, or employee files, run the AI locally. See how much a local AI costs in a company.
Put your AI on your machine
We install the AI at your location and develop the tools you need, hardware and software. Free quote, no commitment.
Frequently Asked Questions
Does the AI Act apply to an SME?
Yes, as soon as it uses an AI system in its business. But for most SMEs, the obligations are light: support staff AI literacy, avoid prohibited practices, and disclose certain content.
When do the high-risk rules apply?
December 2, 2027 for Annex III systems, such as recruitment, credit, or education. August 2, 2028 for AI integrated into regulated products. These dates come from Regulation (EU) 2026/1744, which entered into force on July 27, 2026.
Does a local AI escape the AI Act?
No. The regulation targets the use, not the place of execution. A local AI used to screen CVs remains high-risk. However, it simplifies the processing of personal data and the documentation of the model used.
Does using an open-source model make me a provider?
Generally, no: you remain a deployer. You may incur provider obligations if you place a system on the market under your name or if you change its intended use. Have this case reviewed by a legal professional.
What fine does an SME face?
The caps range from €7.5 million or 1% of turnover to €35 million or 7%. For an SME, the lower of the two amounts applies.
Should all employees be trained?
You must take appropriate measures for the people who use AI. Since the Omnibus, the text does not require guaranteeing a specific level for each person. A short training session, written instructions, and a dated record are a reasonable basis.
Sources: Regulation (EU) 2026/1744, consolidated text; ActuIA, obligations in force and postponements; Orrick, eight Omnibus changes; Personal data, new timeline. Summary updated in November 2026, without legal advice value.
