EU AI Act for SMEs: what applies to small businesses in 2026

Short answer: if your business only uses AI, the EU AI Act calls you a deployer, and most of what applies to you is manageable. It comes down to AI literacy for your staff, telling people when they are talking to a bot, and care in the few areas the regulation treats as high-risk, recruitment being the one most SMEs touch. The heavier high-risk rules, after the 2026 amendments, only start to apply in December 2027.

Regulation (EU) 2024/1689, the AI Act, entered into force on 1 August 2024 and applies in stages. In July 2026 the Digital Omnibus on AI amended it, moving some deadlines and softening the AI literacy duty. Below is what that means for a small or medium business, and where a private model on your own server makes sense. Facts were checked on 5 October 2026 against the European Commission and the AI Act Service Desk; sources are listed at the end.

I run Flisko, a Slovenian consultancy that sets up AI for SMEs in Slovenia, Croatia and Austria. This is the briefing I give clients who ask what the AI Act means for them.

Deployer or provider: which role is yours

The regulation separates two main roles:

• A provider develops an AI system or model (or has one developed) and places it on the market or puts it into service under its own name or trademark.
• A deployer uses an AI system under its authority. The only exception is use in the course of a purely personal, non-professional activity.

An accounting firm drafting summaries with AI, a law firm searching its case files and a manufacturer answering questions about its manuals are all deployers. That holds whether you use ChatGPT or Claude in the browser or run a model on your own server.

The line blurs when a business builds a system itself and offers it to others under its own name, for example as a customer-facing chatbot. You may then be acting as a provider, with extra obligations. For an internal tool used only by your own staff, you remain a deployer.

What a deployer has to do today

AI literacy (Article 4)

This has applied since 2 February 2025. Providers and deployers must take measures to support the AI literacy of their staff and of other people who operate AI systems on their behalf. In July 2026 the omnibus added that this does not require guaranteeing any specific level of literacy for an individual. It is a duty of effort, and you need a record that you made it.

In practice:

1. A list of the AI systems used in the business and who uses them.
2. Short training matched to each role: what the model is good at, where it gets things wrong, which data never goes in.
3. Written usage rules and a record of who completed the training.

For a team of up to 20 people that is a few hours of work.

Transparency when people talk to a bot (Article 50)

Transparency obligations have applied since 2 August 2026. People who interact directly with an AI system must be informed of it, unless it is obvious. Formally this duty sits with the provider of the system, but if you put a bot on your own website, labelling it clearly is the safe choice.

Article 50 sets two more duties for deployers that rarely affect SMEs: informing people exposed to emotion recognition or biometric categorisation systems, and disclosing deepfakes. AI-generated text published to inform the public must also be disclosed, unless it has gone through human review and someone holds editorial responsibility for it.

What counts as high-risk, and why most SME uses do not

The Commission sorts AI systems into four risk levels: unacceptable (banned), high, transparency risk, and minimal or no risk. High-risk uses are defined in Annex III, which lists eight areas:

Searching internal documents, summarising contracts, answering questions about manuals and drafting e-mails are not on that list. The justice area covers systems used by a judicial authority or on its behalf, so a tool a law firm uses to search its own files does not normally fall under it. Take care with HR: if AI ranks candidates or suggests promotion decisions, you are in high-risk territory.

For deployers of high-risk systems, Article 26 requires, among other things, use in line with the instructions for use, human oversight by people with the necessary competence and authority, keeping automatically generated logs for at least six months, and informing workers' representatives and affected workers before the system is used at the workplace.

Timeline

GDPR and the AI Act: two laws, one data flow

The AI Act states explicitly that it does not affect the GDPR. Once personal data goes into an AI system, you have to meet both at once. The AI Act governs what the system is and how you use it. The GDPR governs what you may do with the data that passes through it: legal basis, purpose, retention period and transfers outside the EU.

With general cloud services, the questions usually get stuck right here: where is the data processed, who is the processor, does anything go to a third country, and how long does the provider keep the prompts. Every deployer has to be able to answer them, whatever model it uses.

When a private model on your own server helps

A private LLM running on your own server makes some of those answers easier, because the data never leaves your network:

• Data residency. Documents, questions and answers stay on hardware you control. There is no third-country transfer.
• Contractual control. No outside provider processes your prompts under its own terms, so the list of processors is shorter.
• Audit trail. You decide what is logged, who can read the logs and how long they are kept. That also helps if you ever become a deployer of a high-risk system, where log retention is mandatory.
• Access rights. Document search can respect the same permissions as your SharePoint or file server, so nobody gets an answer drawn from a document they cannot open.

That is why a local model makes most sense for professions bound by legal confidentiality, such as law firms, and businesses that want an internal knowledge base for HR rules and technical documentation.

When it does not

Running the model locally does not answer the legal questions for you. You still need a legal basis for processing personal data, you may only use the data for the purpose it was collected for, and you should not keep it longer than necessary. AI literacy and telling people they are talking to a bot also stay your job. If you use AI to screen candidates, the system is high-risk wherever it runs.

A local model is a good tool for control over data. Compliance still depends on the processes the business runs itself.

A short checklist for SMEs

1. List the AI systems the business uses and note for each whether you are a deployer or a provider.
2. Run AI literacy training and keep a record of it.
3. Adopt internal rules on which data may go into which tool.
4. Label every bot that customers or staff talk to.
5. Check whether any use falls under Annex III, especially in HR.
6. For every system that processes personal data, check the legal basis, purpose, retention period and where processing happens.
7. Where documents are confidential, consider whether the model should run on your own server.

This is not legal advice. For a specific assessment, especially anything high-risk, talk to a lawyer who knows both regulations.

If you want to see whether a private model fits your documents, the quickest route is a pilot on one document set: it costs from 2,900 € and takes 2–3 weeks. Prices are final; the provider is not VAT-registered. More on Private AI for business.

Sources

• European Commission: AI Act, regulatory framework for AI: risk levels, timeline, the Digital Omnibus on AI, transparency for chatbots.
• AI Act Service Desk: Timeline for the implementation of the EU AI Act: application dates after the omnibus amendments.
• AI Act Service Desk: Article 3, Article 4, Article 26, Article 50 and Annex III: consolidated text.
• EUR-Lex: Regulation (EU) 2024/1689: official text in the Official Journal of the EU.

---

Related reading:

• ChatGPT ads in 2026: how sponsored answers work and what they cost.
• Private AI for law firms: searching case files without sending documents to a foreign cloud.
• EU AI Act check in 8 questions: answer yes or no and get your open items with the articles and dates.