EU AI Act: What Applies to SMEs From 2 August 2026
On August 2, 2026, the EU AI Act becomes enforceable. Which obligations now apply to SMEs, and what business owners should have done by then.
From 2 August 2026, AI chatbots and voice agents must disclose that they are AI. What Article 50 requires, who is liable, and what 2 December means.

Anyone who runs a chatbot on their website or has calls answered by an AI phone assistant will face a new obligation from 2 August 2026: the person they are talking to must learn that they are talking to a machine. This is set out in Article 50 of the EU AI Act, and it is not a recommendation but applicable law backed by the threat of fines. The good news up front: for most businesses, this is a one-hour configuration matter, not a project.
Article 50 obliges providers of AI systems that interact directly with natural persons to inform the persons concerned that they are interacting with an AI system, unless this is already obvious. The information must be provided in a clear and distinguishable manner, at the latest at the time of the first interaction. For a chatbot, this means: it says so before the user asks the first question. For a voice agent: it says so in the greeting, not at some point during the conversation.
There is also a second obligation under paragraph 2: anyone who offers an AI system that generates synthetic audio, image, video or text content must mark these outputs as artificially generated in a machine-readable format. This means watermarks or metadata that a machine can read out. According to the regulation, the solution must be effective, interoperable, robust and reliable, as far as technically feasible.
Important for classification: a booking bot that reads out your calendar data does not generate synthetic media content within the meaning of paragraph 2. It is generally subject only to the disclosure obligation under paragraph 1. Anyone who, on the other hand, publicly plays out AI-generated texts or voices should take paragraph 2 seriously.
Article 50 applies from 2 August 2026. This follows from Article 113 of the regulation and is the date that matters for SMEs. A second date is circulating and is often quoted incorrectly: 2 December 2026. This is not a second deadline for everyone, but a transitional arrangement.
Following the provisional agreement on the so-called AI Omnibus of 7 May 2026, generative AI systems that were already on the market before 2 August 2026 will have until 2 December 2026 to implement the machine-readable labelling under Article 50 paragraph 2. The European Parliament approved the agreement on 16 June 2026; formal confirmation by the Council is still pending. As long as this is the case, the postponement is a reasonable expectation, but not yet final law. Do not plan on it solving your problem.
The European Commission published a Code of Practice on the Transparency of AI-Generated Content on 10 June 2026. It is voluntary and mainly sets out details for paragraph 2 and paragraph 4. For a business with a booking bot it is not mandatory reading, but providers of generative AI should take a look.
This distinction determines who is subject to the obligation, and in practice it is the point most often overlooked. Provider is whoever develops the AI system and places it on the market. Deployer is whoever uses it under their own responsibility. If you buy a chatbot from a service provider and embed it on your website, you are generally the deployer, not the provider.
This does not remove the obligation from you, though, it merely shifts it. The disclosure must reach the end user, and the end user arrives at your website and on your phone. So clarify contractually who delivers what: who ensures the notice is given, who documents it, who is liable if it is missing. A provider who cannot give you a solid answer to this question is a risk, not a partner. The same applies to the question of where your data is processed, see GDPR-compliant AI.
Breaches of the transparency obligations are governed by Article 99 paragraph 4 letter g and carry fines of up to 15 million euros or 3 percent of worldwide annual turnover, whichever amount is higher. This figure makes headlines and unnecessarily alarms SMEs.
Because for small and medium-sized enterprises, Article 99 paragraph 6 reverses the logic: for SMEs and start-ups, the lower of the two values applies. For a business with 40 employees and a few million in turnover, that does not mean 15 million euros, but 3 percent of its own turnover. That is still unpleasant, but it is not an existential risk. Knowing this leads to calmer decisions.
The effort is manageable if you tackle it now. Five steps are enough for most businesses:
In the voice agents we build at NordFlux, the notice has been part of the greeting from the outset, and the agent hands over to a human as soon as it reaches its limits. Not because of Article 50, but because a caller who feels deceived does not come back. The regulation here simply codifies what is already better practice. How we implement this is described on our pages on AI telephony and on AI chatbot for the website.
If you want to know more fundamentally whether and how the EU AI Act affects you at all, start here: EU AI Act: Is my company affected?.
Yes, unless it is already obvious. Article 50 paragraph 1 requires that the person concerned be informed in a clear and distinguishable manner, at the latest at the time of the first interaction. A notice in the terms and conditions or the legal notice is not sufficient for this; the information belongs at the start of the interaction.
Yes. A voice agent is an AI system that interacts directly with a natural person. It is therefore subject to the same disclosure obligation as a chatbot. In practice, this means a notice in the greeting, before the caller states their request.
This is not a general deadline. Under the provisional Omnibus agreement, generative AI systems that were already on the market before 2 August 2026 are to be given until 2 December 2026 for the machine-readable labelling. Formal confirmation by the Council is still pending. Anyone starting out newly cannot rely on this.
For large companies, yes; for SMEs, no. Article 99 paragraph 4 letter g provides for fines of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher. For SMEs and start-ups, however, paragraph 6 provides for the lower of the two values, which in practice means the percentage cap on their own turnover.
Only partly. Anyone who buys and deploys a system is generally the deployer, not the provider. However, the disclosure must reach the end user, and the end user encounters your company, not your service provider. Set out in the contract who delivers the notice, who documents it and who is liable if it is missing.
This article provides an overview of the legal situation and does not replace legal advice. For an assessment of your specific case, consult your lawyer or data protection officer.
Founder of NordFlux. Spent four years automating processes at enterprise scale at Dräger, and now brings that depth to the mid-market — pragmatic and with full data sovereignty.
Certifications
On August 2, 2026, the EU AI Act becomes enforceable. Which obligations now apply to SMEs, and what business owners should have done by then.
Update: As of August 2, 2026, only AI transparency requirements apply. High-risk obligations shift to 2027/2028.
Article 4 of the EU AI Act requires AI competence within the team, but no certificates and no fines. What actually applies and what sensible training looks like.
Since 2 August 2026, chatbots and voice agents must identify themselves as AI, and whether you count as a provider or deployer determines your specific obligations. NordFlux checks your AI-powered customer touchpoints for the labelling requirement and implements the necessary technical adjustments before a violation becomes costly. In an initial conversation, we clarify your status and the concrete next steps.