Does the EU AI Act apply to small businesses?

Yes, it can. Obligations attach to deployers and users of AI systems placed on the EU market, not only to large model providers. Most SMEs fall into limited or minimal risk tiers with lighter transparency-focused duties, but some use cases (hiring, credit scoring, biometrics) are high-risk.

When are the EU AI Act deadlines?

The Act phases in through 2026. Prohibited-practice bans and AI-literacy duties applied first, with core obligations for general-purpose AI and other requirements following through August 2026 and beyond. Check the current phase for your system class.

What happens if we fine-tune an open model - are we a provider?

Potentially yes. Substantially modifying or fine-tuning a model and putting it into service can shift you from deployer to provider, which carries additional obligations. Confirm your role before you ship.

AI Governance

EU AI Act for SMEs: A 7-Step Compliance Checklist

Published July 28, 2026 · by Moses Yebei

The EU AI Act is the world's first comprehensive AI law, and its obligations are rolling in through 2026. The common myth is that it only targets Big Tech. It does not - if you deploy or use AI in the EU market, obligations can attach to you, even when the model was built by someone else. Here is a practical, non-legal checklist to get an SME oriented.

1. Build an AI system inventory

You cannot govern what you have not listed. Catalogue every AI system you build, buy, or embed - including features inside SaaS tools. For each, note purpose, data used, and who is affected.

2. Classify each system by risk

The Act is risk-tiered: prohibited, high-risk, limited-risk (transparency obligations), and minimal-risk. Most SME use cases fall into limited or minimal risk - but the ones touching hiring, credit, or biometrics can be high-risk and carry real obligations.

3. Confirm your role: provider vs deployer

Obligations differ if you are the provider (you put the system on the market) versus a deployer (you use it). Fine-tuning or substantially modifying a model can make you a provider - a detail many teams miss.

4. Meet transparency duties

Users must generally be told when they are interacting with AI, and AI-generated content (including deepfakes) must be labelled. For most SMEs this is the single most common obligation to action.

5. Ensure human oversight

Design a human in the loop for consequential decisions. Document who can review, override, and shut down each system.

6. Document data & keep records

Track training/reference data provenance, known limitations, and testing. Even where full technical documentation is not mandated for your tier, lightweight records make audits and incidents survivable.

7. Assign ownership and review regularly

Name an accountable owner, set a review cadence, and re-run this checklist whenever you add a system or change how one is used. Governance is a habit, not a one-off project.

This article is general information, not legal advice. For your specific obligations, combine this with qualified legal counsel.

Need an EU AI Act-ready governance baseline?

I help SMEs build the inventory, risk classification, and oversight the Act expects - without enterprise overhead.

See AI governance consulting

← Back to all articles