The EU AI Act's biggest deadlines just got pushed back by 16 months. That doesn't mean you're off the hook — it means most of what actually applies to small businesses is quieter, cheaper, and easier to get right than the headlines suggest. We help founder-led businesses find the handful of obligations that genuinely apply to them, and fix them properly.
2026 has been a confusing year for AI regulation headlines. In May, the EU agreed to delay the AI Act's toughest obligations — for high-risk systems like hiring tools and credit scoring — from August 2026 to December 2027. A lot of businesses read that as "the AI Act got pushed back," took a breath, and moved on.
AI literacy obligations have applied since February 2025. Article 50 transparency and disclosure rules have been in force since 2 August 2026. The expensive, document-heavy obligations remain focused on high-risk systems most SMEs never use.
If your team uses ChatGPT, Gemini, or Claude for client work, or you run a customer-facing chatbot, you have real (if modest) obligations under the Act — whether or not you built the AI yourself.
Unless you're building or deploying AI for hiring decisions, credit scoring, or similarly regulated domains, you're very unlikely to face the heavy compliance machinery — conformity assessments, technical documentation files, notified body audits.
Non-compliance isn't really about a single catastrophic fine landing out of nowhere — for most small businesses, it's about not being able to show you took reasonable, documented steps when something else goes wrong.
EU AI Act fines are tiered, with the highest penalties reserved for prohibited practices and specified compliance failures. For SMEs and startups, the lower applicable ceiling applies. Importantly, Article 4 AI literacy is not expressly tied to the widely quoted €15 million or 3% maximum; enforcement and any penalties depend on national rules.
Public trust is fragile. A single compliance failure — exposed in the media — can permanently erode customer confidence and brand equity.
Regulators can mandate the suspension of AI systems. Sudden operational halts cost far more than proactive compliance investment.
If an untrained employee causes harm using an AI tool — a data leak, a flawed decision sent to a client — the absence of a documented AI usage policy or training record makes that much harder to defend, regardless of whether a regulator ever gets involved.
We provide an end-to-end AI compliance report — from initial risk assessment through to certification readiness and continuous monitoring. Here's what we deliver:
We inventory every AI tool genuinely in use across your business (including the ones nobody officially approved), build a usage policy your team can actually follow, and deliver documented training that satisfies Article 4 — already a legal requirement, regardless of your size.
We check where Article 50 actually applies to you — chatbots, AI-generated content, synthetic media — and fix the gaps with the lightest possible touch. For most businesses, this is a one-line chatbot notice, not a redesign.
We map your AI use against the Act's four risk tiers and tell you plainly whether anything you're doing strays into high-risk territory (hiring, credit, education) — and if it doesn't, we say so, instead of finding reasons to sell you more.
EU guidance and codes of practice are still being finalised through 2027, and the high-risk systems list can expand. We keep your compliance posture current as the rules solidify, instead of leaving you with a one-time PDF.
This information is for general guidance only and does not constitute legal advice.
