EU AI Act compliance for SMEs
The AI Act was written with big tech in mind, but applies to your organization as soon as you use or buy AI. The good news: for most SMEs the route is more manageable and cheaper than advisory firms suggest.
The direct answer
Under the AI Act, most SMEs are deployers: you use or buy AI but do not place AI systems on the market. The foundation then comes down to four things: knowing which AI runs in your organization, determining the risk class per system, taking suitable measures that support the development of AI literacy (Article 4, in force since 2 February 2025), and determining per customer-facing use case which Article 50 duty applies from 2 August 2026 and whether you are provider or deployer. Embed AI delivers that foundation at clear terms without mandatory software licences. Dutch SMEs can additionally have up to 60% of a learning and development project reimbursed through the SLIM scheme.
The four steps for an SME
1. Inventory your AI use
Including shadow AI: the ChatGPT accounts, AI features in existing software and tools departments bought themselves. Without an overview, every next step is guesswork.
2. Classify per system
Most SME applications fall into the lighter categories. But AI in recruitment, employee evaluation or credit decisions is high-risk and requires a heavier route towards 2 December 2027.
3. Arrange AI literacy with evidence
Article 4 asks for suitable measures that support the development of AI literacy, without prescribing a specific individual level. Role-based training and records can make that approach demonstrable.
4. Check customer-facing AI against Article 50
Providers disclose direct AI interaction when it is not obvious and machine-mark synthetic output within paragraph 2. Deployers have separate duties for emotion recognition, biometric categorisation, deepfakes and certain public-interest text.
What does this cost an SME?
Terms agreed for your assignment. For comparison: large firms almost always bill hourly without a public number, and governance software quickly costs a recurring investment. Most SMEs do not need that.
SLIM subsidy: up to 60% reimbursed
For Dutch SMEs, the SLIM scheme reimburses up to 60% of an advisory and implementation project around learning and development, such as an organizational review with an AI literacy training plan or the roll-out of an e-learning approach. The next application window runs from August to September 2026. On request we include a draft activity plan for the application with our proposal.
Frequently asked questions from SMEs
Does the EU AI Act even apply to small companies?
Yes. The obligations apply as soon as you use, buy or offer AI, regardless of company size. The burden for a deployer is much lighter than for a provider, though, and the law accommodates smaller organizations on some points. The core for SMEs: overview, classification, AI literacy and transparency.
We only use ChatGPT and some AI features in our software. Do we need to do anything?
Yes, at least three things: map this use, take suitable AI literacy measures for employees working with it (Article 4, already in force) and set usage rules, for example about customer data in AI tools. The scan and Readiness Sprint translate this into roles, actions and evidence.
What does EU AI Act compliance cost for an SME?
We agree the scope and commercial terms after discussing your question, available information and desired support. Share your preferred start date and expected engagement so we can prepare a suitable proposal.
Do we need governance software?
Almost never. For an SME with a handful of AI applications, a well-structured register in existing systems is enough, with an owner and anchoring in procurement and release. Software licences of a recurring investment are rarely justified at this scale.
Which deadline is most urgent for us?
Article 4 has applied since 2 February 2025. Article 50 applies from 2 August 2026, but not every chatbot or AI item automatically receives the same duty: actor and use case determine scope. Most standalone Annex III duties moved to 2 December 2027; SMEs using AI in HR or credit can use that runway for classification and evidence.
Can we not simply do this ourselves?
Largely yes, and that is the intention: our approach delivers a set-up your own people maintain afterwards, without vendor lock-in. The value of guidance is speed and certainty: a working foundation with evidence in weeks, instead of months of research next to running the business.
Know where your company stands in 5 minutes
Take the free AI Act quickscan. You immediately see which of the four steps needs attention.