EU AI Act: What Applies to SMEs From 2 August 2026

On August 2, 2026, the EU AI Act reaches its next stage. From that day, the EU can enforce the rules for AI models with fines, and the transparency obligations for AI systems become applicable. For business owners in the SME sector, this raises a very practical question: What affects my company, and what needs to be done by then? The good news first: most SMEs are users of AI, not providers, and for them the list is manageable and achievable.

What exactly happens on August 2, 2026?

On August 2, 2026, two things go live: the enforcement and fining powers against providers of general-purpose AI (GPAI) models, and the transparency obligations under Article 50. From this date, the EU AI Office can request documentation, test models itself, demand corrections, and, in serious cases, remove a model from the European market.

At the same time, the fine provisions become applicable. Violations of the prohibited practices cost up to 35 million euros or 7 percent of global annual turnover, whichever is higher. For most other obligations, the range is up to 15 million euros or 3 percent (Article 99 of the AI Act). The figures are already set; they simply become enforceable from the deadline.

Am I affected as an SME at all?

The vast majority of SMEs are deployers of AI, not its manufacturers, so for them three things matter above all: AI literacy, transparency, and avoiding prohibited practices. The heavy GPAI obligations that take effect on August 2 lie with model providers such as OpenAI, Google, or Anthropic, not with the bakery using ChatGPT for quote texts. Whether your specific use case still counts as high-risk depends on the area of application. Our article provides an initial assessment of whether your company is affected.

Which obligations have already applied for a while?

Two obligations have already applied since February 2, 2025, and often get lost in the noise around the new deadlines: the ban on certain AI practices and the obligation to ensure AI literacy among staff under Article 4.

• Prohibited practices: This includes social scoring, targeted manipulation, and the untargeted scraping of facial images from the internet. For a typical business this is rarely relevant, but it's still worth checking once.
• AI literacy (Article 4): Anyone using AI in their company must ensure that the people working with it understand it in principle. The Digital Omnibus softened this obligation from “ensure” to “promote” at the end of 2025, but it has not been abolished.

What has been postponed, and what you shouldn't rely on

The so-called Digital Omnibus from November 2025 pushed back the strict obligations for high-risk AI postponed: to December 2, 2027 for standalone systems and August 2, 2028 for AI embedded in regulated products. For smaller companies, individual relief measures were also extended to the new Small Mid-Cap category.

Two things should not be confused here. First: it is the high-risk obligations that were postponed, not the transparency obligations and not GPAI enforcement. Both remain tied to August 2, 2026. Second: the Omnibus is still going through the legislative process. Plan around the official dates, not around headlines about ever-new delays.

What should a business owner have done by the deadline?

By August 2, 2026, four things should be done: an inventory, implemented transparency notices, brief training, and a designated point of responsibility.

• Inventory: Write down which AI tools are actually used in-house, from Microsoft Copilot to ChatGPT to chatbots and automations. Without this list, no obligation can be properly assigned.
• Implement transparency: Chatbots and voicebots must make it recognizable that a human is talking to an AI. AI-generated texts, images, and voices must be labeled accordingly.
• Build AI literacy: A short, documented training session for employees who use AI satisfies Article 4 and helps prevent everyday mistakes.
• Designate responsibility: One person who keeps an overview is entirely sufficient for most SMEs.

In our automation and AI agent projects, the transparency notice has become standard practice: every voicebot and every website chat we deliver states on its own that an AI is responding here. That's not a big effort, but it needs to be considered from the very beginning.

The European Commission makes clear in its guidelines for GPAI providers that the deadline makes existing obligations enforceable and does not create new ones. For deployers, that means: those who put things in order now won't have to rush anything on August 2.

Frequently asked questions about the EU AI Act from August 2, 2026

Does the EU AI Act also apply to small businesses?

Yes. The AI Act applies regardless of company size, but tiers the obligations by role and risk. Most SMEs are deployers and must primarily ensure AI literacy and transparency. Only a few applications fall into the strict high-risk class.

What exactly happens on August 2, 2026?

On this day, the enforcement and fining powers against providers of general-purpose AI models become applicable, and the transparency obligations under Article 50 take effect. The high-risk obligations are not affected.

Do I have to label my website chatbot?

Yes. Article 50 requires that users be able to recognize that they are talking to an AI and not a human. A clear notice in the chat window is usually sufficient.

How high are the fines?

For prohibited practices, up to 35 million euros or 7 percent of global annual turnover; for most other violations, up to 15 million euros or 3 percent. For small and medium-sized enterprises, the lower of the two amounts applies as the cap.

Were the high-risk rules really postponed?

Yes. The Digital Omnibus from late 2025 postponed the high-risk obligations to December 2, 2027 for standalone systems and August 2, 2028 for embedded systems. The transparency and GPAI rules for August 2, 2026 remain unaffected.