EU AI Act for SMEs: what applies from when?

The EU AI Act – the European regulation on artificial intelligence, in force since 2024 – in principle also applies to small and medium-sized enterprises (SMEs), but its obligations take effect in stages and mainly affect providers of AI systems, not their users. For most SME applications, such as chatbots or internal document AI, only transparency requirements apply, plus the obligation to take measures to promote AI literacy in the team. If you keep an inventory of your AI tools, draw up a short policy and train your team, you have the building blocks that businesses start with in practice.

In brief

• The AI Act sorts AI systems into risk classes: prohibited practices, high risk, limited risk, minimal risk.
• The obligations apply in stages: prohibitions since February 2025, rules for general-purpose AI models since August 2025, transparency obligations since August 2026; the AI Omnibus (Regulation (EU) 2026/1744) has postponed the high-risk obligations to December 2027 and August 2028 respectively.
• Most internal SME applications – document search, writing assistance, simple chatbots – are minimal or limited risk.
• Watch out for HR applications: AI that has a say in decisions on applications or promotions can count as a high-risk system.
• Art. 4 already applies and affects every business that uses AI: since 27 July 2026, measures to promote AI literacy have been required – documented training is the pragmatic route.

How does the AI Act’s risk class logic work?

The AI Act does not regulate “AI” across the board, but according to the risk of the specific application. The higher the risk to people’s health, safety or fundamental rights, the stricter the obligations. Four levels are to be distinguished:

Risk class	What falls under it (examples)	What applies
Prohibited practices	Manipulative techniques, social scoring, certain biometric mass surveillance	Use prohibited
High risk	AI in recruitment and employee assessment, creditworthiness assessment, critical infrastructure, medical devices	Extensive obligations: risk management, documentation, human oversight, registration
Limited risk	Chatbots with customer contact, AI-generated content	Transparency obligations: people must be able to recognise that they are interacting with AI or that content is AI-generated
Minimal risk	Internal document search, spell checkers, spam filters, writing assistance	No special obligations arising from the risk class; general obligations such as AI literacy still apply

The distinction between roles is also important: the AI Act distinguishes between providers (who develop AI systems and place them on the market) and deployers (who use them professionally). The heavy packages of obligations – for example for high-risk systems – lie predominantly with the provider. An SME that uses a finished AI tool is usually a deployer and has considerably leaner obligations.

What applies from when? The timeline at a glance

The AI Act entered into force in 2024, but its obligations deliberately apply in stages so that companies and authorities can prepare:

Date	What applies
Since 2024	Regulation in force; transition periods running
Since February 2025	Prohibitions of certain AI practices; AI literacy (Art. 4, worded since 27 July 2026 as an obligation to take promotional measures)
Since August 2025	Rules for general-purpose AI models (GPAI, e.g. large language models)
Since 2 August 2026	Transparency obligations (Art. 50); for systems that were already on the market before, the labelling of AI-generated content (Art. 50(2)) applies from 2 December 2026
From 2 December 2027	High-risk systems under Annex III (such as recruitment, creditworthiness) – postponed by Regulation (EU) 2026/1744
From 2 August 2028	High-risk AI in products under Annex I

For planning in the business, this means: the obligations most relevant to SMEs – AI literacy, prohibitions and transparency – already apply. The high-risk requirements are coming step by step and only affect those who actually provide or deploy high-risk systems. The full text of the regulation can be found via the Austrian federal legal information system RIS (ris.bka.gv.at); the Austrian Economic Chamber offers prepared overviews for businesses (wko.at).

Which risk class do typical SME applications fall into?

Most AI applications in everyday SME work are uncritical – with one important exception in the HR area:

• Internal document AI and knowledge bases: An AI that searches the company’s own documents and answers questions about them is typically a minimal-risk system. It does not make decisions about people, but finds information. What still needs to be observed is the GDPR (for personal data in the documents) and internal transparency that an AI system is in use.
• Chatbots with customer contact: Limited risk. The central obligation is transparency – customers must be able to recognise that they are communicating with an AI. A clear notice in the chat window fulfils this.
• Writing assistance and translation: Minimal risk. Internal quality and data protection rules are what mainly apply here.
• HR tools – the case to watch: AI systems that pre-sort applications, assess candidates or influence decisions on promotion and dismissal can count as high-risk systems. Anyone using such tools should ask the provider about its AI Act compliance, ensure that a human makes the final decision and document the use. If in doubt: seek professional advice before introducing them.

How do SMEs implement AI literacy under Art. 4 pragmatically?

Since it was amended by Regulation (EU) 2026/1744 (in force since 27 July 2026), Art. 4 of the AI Act obliges providers and deployers of AI systems to take measures to promote the “AI literacy” of their staff – that is, of everyone who operates AI systems or works with their results. A specific level of literacy does not have to be guaranteed for each individual. The regulation does not prescribe a particular format; what matters is that the measures suit the employees’ role and the system used.

For a typical business, a lean package is enough:

1. Short training session (one to two hours): What can the AI tools in use do, and what can they not do? Why can AI answers be wrong, and why must they be checked? Which data may be entered, and which may not?
2. Short written policy: The most important rules on one or two pages, accessible to everyone.
3. Documentation: Record who was trained and when. If questions arise, this is the proof that the business has taken measures.
4. Refresher when things change: New tools or new purposes mean a short follow-up training session.

The effort is manageable – and the training pays off twice, because at the same time it prevents the most common data protection mistakes (such as customer data in public chatbots).

What should SMEs do now in concrete terms?

Panic is not called for, but neither is doing nothing. Four steps bring a business to a solid position:

• Create an AI inventory: List all AI tools used in the business – including the unofficial ones (chatbots that employees use privately are included). No overview, no assessment.
• Roughly classify the risk class: For each tool, clarify: does it make decisions about people (watch out, possibly high risk)? Does it interact with customers (transparency obligation)? Or does it only work internally with documents (usually uncritical)?
• Implement an AI policy and training: As described in the previous section – these are the steps with which businesses usually tackle the literacy requirement.
• Ask providers questions: Ask every AI provider how it complies with the AI Act, where the data is processed, whether it is used for training and whether a data processing agreement (DPA, the agreement required under Art. 28 GDPR when data is processed on your behalf) is in place. Reputable providers answer this in writing; what a structured introduction process can look like is shown, as an example, on the AI knowledge base’s Process page.

As the AI Act and the GDPR apply side by side, it is worth looking at both sets of rules together: the data protection basics for using AI – from the division of roles to the provider checklist – are covered in detail in the article AI and GDPR in Austria.

Why is the AI Act no cause for concern for most businesses?

The basic architecture of the regulation works for SMEs, not against them: what is strictly regulated is what can seriously harm people – automated personnel decisions, lending, critical infrastructure. The everyday productivity applications of small businesses, above all the internal search and evaluation of their own documents, deliberately remain in the lowest risk classes. The AI Act also explicitly provides for simplifications and support for small companies.

If you keep an AI inventory today, can prove that you train your team and, when choosing a provider, pay attention to EU location, exclusion from training and a DPA, you have done the groundwork on which a legal review can build. Infringements, for example of prohibitions or transparency obligations, can lead to substantial fines; for an SME’s typical deployer obligations, the risk can be managed with simple means. This article provides a general overview and does not replace legal advice in individual cases – if you suspect a high-risk use or have special questions, legal support is recommended.