What the EU AI Act means for SMEs from 2 August 2026

If you run a small or medium business and you have been dreading 2 August 2026 as the day the EU AI Act lands on you, here is the good news first: the part everyone was scared of got postponed. A last-minute change to the law, agreed in late July 2026, pushed the heavy rules for high-risk AI back to the end of 2027 and beyond. What actually starts today is smaller, calmer, and manageable, and this guide walks you through exactly what it is.

The one thing that does apply from today is transparency. In plain terms, if your business uses AI to talk to people or to make content, you now have to be honest about it. That is most of what a normal SME needs to worry about right now, and it is a lot less work than the headlines suggested.

This article explains, in simple language, what the EU AI Act is, what changed on 2 August 2026, what got delayed, whether it even applies to your business, the everyday use cases that trigger a rule, and the short list of things to actually do. It is written for founders, operators, and managers at SMEs who use AI in their business but are not AI companies themselves, and who just want a straight answer.

‍

Key takeaways

The short version, before the detail:

• The EU AI Act is the first big law that sets rules for how AI can be built and used across Europe. It sorts AI by risk, not by hype.

• From 2 August 2026, the transparency rules apply. You must tell people when they are dealing with AI, and label AI-generated content like deepfakes.

• The scary high-risk rules that were due today were postponed. Standalone high-risk AI now applies from 2 December 2027, and AI inside regulated products from 2 August 2028.

• Most SMEs are not building high-risk AI. If you use a chatbot or generate AI content, you fall under the lighter transparency rules, not the heavy ones.

• What most businesses must do now is short: disclose AI chat, label AI content, and make sure staff have basic AI literacy.

• There is real help for small businesses: free regulatory sandboxes, simpler paperwork, and fees scaled to your size.

• Ignoring the rules is expensive. Transparency breaches can cost up to 15 million euros or 3% of global turnover, so it is worth getting the basics right.

‍

What is the EU AI Act?

The EU AI Act is a European law that sets rules for putting AI systems on the market and using them across the 27 EU countries. It is the first law of its kind anywhere, and its goal is simple: make AI in Europe safe and trustworthy without banning it. It came into force on 1 August 2024 and its rules switch on in stages over several years, which is why 2 August 2026 matters.

The clever part of the law is that it does not treat all AI the same. A spam filter and a system that decides who gets a loan are very different things, so the Act sorts AI by how much risk it poses to people. The higher the risk to someone's rights, safety, or money, the more rules apply. Low-risk uses, which is most business AI, carry almost no obligations at all.

This matters for you because it means the first question is never "do I use AI." Almost everyone does. The real question is "what kind of AI, used how," and that decides whether you have a little to do or a lot. For the large majority of SMEs, the honest answer is a little.

‍

The 4 risk levels, explained simply

The Act splits AI into four buckets. Knowing which one your use falls into tells you almost everything about what you have to do.

‍

‍

Unacceptable risk is banned outright. This covers a small set of harmful uses like social scoring of citizens, manipulating vulnerable people, and untargeted scraping of faces to build recognition databases. If your business is normal, you are nowhere near this line.

High risk is the heavy category. It covers AI used for things that can seriously affect someone's life: screening job applicants, credit scoring, medical devices, and certain uses in education, law enforcement, and critical infrastructure. These systems carry the real paperwork, such as risk assessments, quality management, and human oversight. Most SMEs never build or sell one of these, and the rules for them were just delayed, which we cover below.

Limited risk is where most businesses actually sit. This is AI that interacts with people or makes content: chatbots, virtual assistants, and generative tools that write text or create images, audio, and video. The only duty here is transparency, being open that AI is involved. This is the category that switched on today.

Minimal risk is everything else, and it is the bulk of AI in use: spam filters, recommendation engines, AI in your accounting software. The Act asks nothing extra of these. You can keep using them exactly as you do now.

‍

What applies from 2 August 2026

From 2 August 2026, the transparency rules under Article 50 of the AI Act apply. In plain words, you can use AI, but you cannot hide that you are using it, and you cannot let AI content pretend to be real without a label. The European Commission set out the details in its announcement on safer and more transparent AI. There are two duties, and both are easy to understand.

The first is disclosure. When a person interacts with your AI, such as a chatbot or an AI voice assistant, they must be clearly told they are talking to a machine and not a human. You do not need a legal essay, just an honest, visible notice.

The second is labelling AI-generated content. Certain machine-made content has to be marked clearly and in a machine-readable way. This includes deepfakes, meaning AI images, audio, or video that resemble real people, places, or events, and AI-written text published to inform the public on matters of public interest when no human has reviewed it. It also covers telling people when they are subject to emotion recognition or biometric categorization.

That is the whole of what most SMEs face today. It is a communication and honesty requirement, not an engineering project. If you already tell customers your support widget is an AI assistant and you are upfront about AI-made marketing visuals, you are most of the way there.

‍

If you want to check your own systems against the rules quickly, the official EU AI Act compliance checker walks you through a few questions and tells you where you stand. It is a good 10-minute starting point before you change anything.

‍

What got postponed, and why it is a relief

The biggest story for SMEs is what is not happening today. The rules for high-risk AI, the ones with real cost and paperwork, were due to start on 2 August 2026. In late July 2026 the EU agreed a package known as the Digital Omnibus that pushed those deadlines back, and it became law on 27 July 2026, days before they would have hit.

‍

‍

Under the new dates, high-risk AI that works on its own, the systems listed in Annex III such as recruitment screening and credit scoring, now applies from 2 December 2027, a delay of about 16 months. High-risk AI built into regulated physical products, the Annex I category, moves to 2 August 2028. So even the small share of SMEs that do touch high-risk AI have well over a year of extra breathing room.

What did not change is just as important. The transparency duties and the AI literacy duty stayed exactly where they were, so today's obligations are real and in force. The Digital Omnibus also added a new ban, effective 2 December 2026, on AI tools that create non-consensual intimate images and child sexual abuse material. That is a prohibition, not a business burden for legitimate companies.

The practical takeaway: the deadline everyone circled on the calendar mostly moved, except for the transparency piece, which is the manageable part. If a vendor or consultant is telling you that you must complete a full high-risk conformity assessment by today, they are working from the old timeline.

‍

Does the AI Act even apply to my business?

Whether the Act touches you depends on your role, not just on whether you use AI. The law splits businesses mainly into two roles, and the difference decides how much you have to do.

A provider is a company that builds an AI system or has one built under its own name and puts it on the market. A deployer is a company that simply uses an AI system in its work. Most SMEs are deployers. You did not train the model behind your chatbot or your marketing tool, you subscribed to it, which puts far fewer duties on you.

For a typical SME using off-the-shelf AI, the obligations are light and mostly about honesty and awareness. Here is the plain rule of thumb:

• If you only use common AI tools, such as a chatbot, an AI writing assistant, or AI features inside software you pay for, you are a deployer in the limited or minimal risk zone. Your job is transparency plus basic staff AI literacy.

• If you build or rebrand an AI product and sell it, especially for hiring, lending, or another sensitive use, you may be a provider of high-risk AI, and the heavier rules apply to you, though from 2027 rather than today.

• If you operate in a regulated field like healthcare or finance, treat AI classification as part of your existing compliance work and get specific advice.

For most readers of this guide, the answer is reassuring: you are a deployer using limited-risk AI, and the to-do list is short.

‍

Everyday use cases and what each one needs

The rules make more sense against real examples. Here are common ways SMEs use AI and what the Act asks for each one, as things stand from today.

A customer support chatbot on your website is limited risk. The duty is to tell visitors clearly that they are chatting with an AI assistant, not a person. A one-line notice does it.

AI-generated marketing images, video, or voice are limited risk, and if the content is a realistic deepfake of a real person or scene, it must be labelled as AI-generated. Ordinary stylised graphics that no one would mistake for real footage are lower concern, but honesty is the safe default.

An AI writing assistant that drafts your blog posts or emails is minimal to limited risk. Internal drafts are fine. AI-written text published to inform the public on important topics, with no human check, should be marked as AI-generated.

AI that screens or ranks job applicants is the one to watch. This is high risk. The full obligations do not bite until December 2027, but if you use or are considering such a tool, start planning now, because the requirements are substantial and human oversight is non-negotiable.

AI inside tools you already pay for, like spam filtering, accounting automation, or product recommendations, is minimal risk. Nothing extra is required, and you can carry on as normal.

‍

If you want a broader view of putting AI to work in a smaller company without over-engineering it, our guide to AI automation for SMEs covers where the real payback is.

‍

What you need to do now: 5 practical steps

You do not need a compliance department. For most SMEs, getting ready is a short, sensible checklist you can work through in an afternoon and finish over a couple of weeks.

1. Make a simple AI inventory. List every place AI is used in your business, from the website chatbot to the AI features in your software. You cannot manage what you have not written down, and this list is the whole foundation.

2. Add transparency where people meet AI. Put a clear notice on chatbots and AI assistants so users know they are talking to a machine, and label AI-generated content that could pass for real. This is the one duty that is live today.

3. Give staff basic AI literacy. The Act expects the people using AI to have a basic understanding of it. A short internal session on what your tools do, their limits, and how to use them responsibly satisfies the spirit of the rule and prevents mistakes.

4. Write a one-page AI policy. A simple internal document on which tools are approved, what data must never be pasted into them, and who to ask with questions turns good intentions into a repeatable habit. It does not need to be long to be effective.

5. Flag anything high-risk early. If any AI you use or plan to build touches hiring, lending, health, or another sensitive area, mark it and get specific advice. You have until late 2027, but these are the cases where planning ahead pays off.

Work through those five and a normal SME is in good shape for what the AI Act asks in 2026, with a clear head start on what comes later.

‍

The support that exists for small businesses

The Act was written with a genuine effort not to crush small companies, and there are concrete supports worth knowing about. They lower both the cost and the fear.

Regulatory sandboxes are the standout. Every EU country is setting up a free, supervised environment where a business can test an AI system with guidance from the regulator, and following the sandbox plan gives you protection from fines while you learn. Small businesses get priority access, and several countries have already launched theirs.

The paperwork is being scaled down for smaller firms. Technical documentation for high-risk systems comes in a simplified form for small and micro enterprises, any assessment fees must be proportionate to your size, and a new small mid-cap category, companies under 750 staff and 150 million euros in turnover, gets lighter requirements too. The point is that your obligations should fit your scale, not a multinational's.

There is also help to simply understand the rules. Member States are running awareness activities and dedicated channels for SME questions, so you are not expected to decode the law alone. When in doubt, your national authority is a real resource, not just an enforcer.

‍

What happens if you ignore it

The penalties are the reason to treat even the light rules seriously. The AI Act sets fines in tiers based on how serious the breach is, and they are large enough to matter to any business.

Breaking the transparency rules that apply today can cost up to 15 million euros or 3% of worldwide annual turnover, whichever is higher. Using a banned AI practice is worse, up to 35 million euros or 7% of turnover. For an SME, even a fraction of those figures would be painful, and enforcement is handled by national authorities across the EU.

The reassuring flip side is that the duties in force today are cheap to meet. A visible chatbot notice, honest content labels, and a short staff briefing cost you almost nothing, while getting them wrong is expensive. That gap is exactly why the basics are worth doing properly and soon.

‍

How Codelevate helps SMEs build AI that stays compliant

Because we build AI systems for companies every day, compliance is not a separate step we bolt on, it is part of how we design and ship. When we build a chatbot, an automation, or a custom AI feature, transparency notices, sensible data handling, and human oversight are baked in from the start, so the result is useful and on the right side of the rules.

The most common thing we do for SMEs is turn a vague worry into a short, concrete plan: what AI you have, which risk bucket each use sits in, and the handful of changes that make you compliant without slowing the business down. As an AI development company, we would rather build the honest, well-governed version once than watch a client stitch together tools that create risk they cannot see.

The promise is simple: you get AI that actually helps your business and quietly meets the rules that apply to it, instead of a compliance headache or a project that ignores the law until it becomes a problem.

‍

The bottom line

For most SMEs, 2 August 2026 is far less dramatic than it sounded. The heavy high-risk rules were postponed to December 2027 and August 2028, and what applies today is transparency: be open when people are dealing with AI, and label AI-made content. Sort your AI into the right risk bucket, add a few honest notices, brief your team, and write a one-page policy, and you have handled what the law asks of a normal business this year. The companies that do this calmly now will find the later deadlines easy, and they get to keep using AI with confidence instead of worry.

‍

Free download: our SaaS founder's AI blueprint helps you find where AI genuinely pays off in your business before you build. And if you want a straight, plain-English read on what the AI Act means for your specific tools and where you stand, you can book a free call with our team and we will map it out with you, with no obligation.