Most AI Act advice is written for organisations with a compliance department. For a company of 40 people, where the operations director also handles the privacy questions, that advice is not wrong but it is unusable. It assumes roles that do not exist and budgets that do not fit.
This piece is about what AI governance actually asks of an organisation with 20 to 250 staff: in money, in lead time and above all in sequence. That last one decides whether the effort succeeds.
What SMEs do and do not face
Start with what does not apply. The heavy obligations around high-risk Annex III systems apply from 2 December 2027, and many smaller organisations have no such systems at all. If you do not shortlist job applicants with AI, do not prepare credit decisions and do not determine access to essential services, you fall outside them.
What does apply is narrower and more concrete. The Article 50 transparency duties have applied since 2 August 2026 and touch anyone with a chatbot or with AI-generated content in their communications. The Article 4 duty to take measures supporting AI literacy has applied since February 2025 and touches anyone whose staff use AI. And if you purchase AI, you have a supplier question to answer.
That scoping is the first saving. Organisations that get swept into a full AI management system pay for obligations that do not rest on them.
The realistic sequence
The order matters more than the pace, because each step produces the input for the next.
Inventory first. Which AI is running, who uses it, and are you the provider or the deployer. Without that view you cannot prioritise anything. Expect two to four weeks of lead time, most of it waiting for answers from within the organisation.
Then classify and scope. Determine which duties apply per system. For most smaller organisations this ends with a short list: a few systems under Article 50, the rest under the baseline regime. That is a pleasant outcome and a good reason not to skip this step.
Then implement what applies today. Article 50 is the only obligation with active enforcement right now, so it goes first. AI literacy runs alongside, because that is a continuing duty rather than a project.
Only then policy and documentation. Many engagements start here, with an AI policy as the first deliverable. That is the wrong order: policy not based on your actual AI use describes an organisation that does not exist.
What it costs
Honest figures, not a range from ten to a hundred thousand euro.
An organisation doing it entirely in-house mainly spends time. Expect 40 to 80 internal hours for inventory, role determination and classification, spread across several people. That is achievable if someone genuinely owns it and the board gives a mandate. It goes wrong when it is added on top of a full schedule.
With external support, our engagements start with the AI governance scan at 2,950 euro, creditable against a follow-up engagement. It delivers the register, the role determination, the classification and the priorities. For many smaller organisations that is enough to continue independently.
If you also want the implementation, meaning policy, documentation and a working structure that keeps running after delivery, the AI Act Readiness Sprint at 9,900 euro is the route. Combined with the AI literacy evidence file, that becomes the bundle at 21,900 euro.
Where SME budget usually does not need to go: an AI management system to ISO 42001, unless a client or tender explicitly asks for it. Certification does not create a legal presumption of conformity with the AI Act. It is a good backbone for those heading there for other reasons, but it is not a route to AI Act compliance.
Still weighing a licence against expert support? Compare AI Act software with a consultant before committing budget to tooling.
What to do yourself and what to outsource
Well suited to doing yourself: the inventory. Nobody knows your tools better than your own people, and outsourcing this step is expensive and slower.
Harder to do yourself: role determination for systems you have modified, and classification in borderline cases. That is where a wrong call costs the most later, because every following step is built on it.
Not worth doing yourself: the reasoning that convinces a supervisor. Not because it is secret knowledge, but because writing a defensible assessment is a skill you rarely need and therefore do not develop.
The trap of waiting
The move of the high-risk obligations to 2 December 2027 has calmed many organisations down. For SMEs that is partly justified, because those obligations often do not apply. But it has also led to postponing the things that do.
The next date is 2 December 2026, when the transitional period for machine-readable marking ends and the new prohibitions on deepfakes and non-consensual intimate content start to apply. After that comes 2 December 2027. Anyone starting their inventory in 2027 has no time left for the steps that follow it.
Closing
AI governance for an SME is not a small version of the large programme. It is a different programme, with a shorter list of obligations and a sharper order. The organisations that do this well are not the ones that spend the most. They are the ones that first worked out what actually rests on them.
The legal background to the obligations sits on the Praxikon. For your team's AI literacy, LearnWize provides role-based training with a record per employee.
