EU AI Act compliance for SMEs
The AI Act was written with big tech in mind, but applies to your organization as soon as you use or buy AI. The good news: for most SMEs the route is more manageable and cheaper than advisory firms suggest.
The direct answer
Under the AI Act, most SMEs are deployers: you use or buy AI but do not place AI systems on the market. The foundation then comes down to four things: knowing which AI runs in your organization, determining the risk class per system, taking suitable measures that support the development of AI literacy (Article 4, in force since 2 February 2025), and determining per customer-facing use case which Article 50 duty applies from 2 August 2026 and whether you are provider or deployer. Embed AI delivers that foundation at fixed prices without mandatory software licences. Dutch SMEs can additionally have up to 60% of a learning and development project reimbursed through the SLIM scheme.
The four steps for an SME
1. Inventory your AI use
Including shadow AI: the ChatGPT accounts, AI features in existing software and tools departments bought themselves. Without an overview, every next step is guesswork.
2. Classify per system
Most SME applications fall into the lighter categories. But AI in recruitment, employee evaluation or credit decisions is high-risk and requires a heavier route towards 2 December 2027.
3. Arrange AI literacy with evidence
Article 4 asks for suitable measures that support the development of AI literacy, without prescribing a specific individual level. Role-based training and records can make that approach demonstrable.
4. Check customer-facing AI against Article 50
Providers disclose direct AI interaction when it is not obvious and machine-mark synthetic output within paragraph 2. Deployers have separate duties for emotion recognition, biometric categorisation, deepfakes and certain public-interest text.
What does this cost an SME?
Fixed prices, known upfront, excluding VAT. For comparison: large firms almost always bill hourly without a public number, and governance software quickly costs tens of thousands of euros per year. Most SMEs do not need that.
SLIM subsidy: up to 60% reimbursed
For Dutch SMEs, the SLIM scheme reimburses up to 60% of an advisory and implementation project around learning and development, such as an organizational review with an AI literacy training plan or the roll-out of an e-learning approach. The next application window runs from August to September 2026. On request we include a draft activity plan for the application with our proposal.
Frequently asked questions from SMEs
Does the EU AI Act even apply to small companies?
Yes. The obligations apply as soon as you use, buy or offer AI, regardless of company size. The burden for a deployer is much lighter than for a provider, though, and the law accommodates smaller organizations on some points. The core for SMEs: overview, classification, AI literacy and transparency.
We only use ChatGPT and some AI features in our software. Do we need to do anything?
Yes, at least three things: map this use, take suitable AI literacy measures for employees working with it (Article 4, already in force) and set usage rules, for example about customer data in AI tools. The scan and Readiness Sprint translate this into roles, actions and evidence.
What does EU AI Act compliance cost for an SME?
Knowing where you stand is free via the quickscan. A guided governance scan costs EUR 2,950 (creditable once against a follow-up engagement that starts within 60 days), a complete working foundation via the Readiness Sprint EUR 9,900 fixed, and the full engagement including evidence and implementation EUR 21,900 fixed. Dutch SMEs can have up to 60% of a learning and development project reimbursed via the SLIM scheme.
Do we need governance software?
Almost never. For an SME with a handful of AI applications, a well-structured register in existing systems is enough, with an owner and anchoring in procurement and release. Software licences of tens of thousands of euros per year are rarely justified at this scale.
Which deadline is most urgent for us?
Article 4 has applied since 2 February 2025. Article 50 applies from 2 August 2026, but not every chatbot or AI item automatically receives the same duty: actor and use case determine scope. Most standalone Annex III duties moved to 2 December 2027; SMEs using AI in HR or credit can use that runway for classification and evidence.
Can we not simply do this ourselves?
Largely yes, and that is the intention: our approach delivers a set-up your own people maintain afterwards, without vendor lock-in. The value of guidance is speed and certainty: a working foundation with evidence in weeks, instead of months of research next to running the business.
Know where your company stands in 5 minutes
Take the free AI Act quickscan. You immediately see which of the four steps needs attention.