What does the AI Act require of an SME?
Most SMEs are users of AI, not developers. The impact is then manageable, but not zero. We translate legislation and standards into a workable approach, without unnecessary complexity.
Governance does not have to be heavy. It has to fit how you use AI.Our starting point
Four things to have in place
For a typical SME using Copilot, ChatGPT or its own agent.
01
Know which AI you use
A simple overview of tools and applications, with owner and purpose.
02
Support AI literacy
Make sure employees know what AI can do, where it goes wrong and which data does not belong in it.
03
Be transparent
Do you use a customer-facing chatbot or AI-generated images? Make that clear.
04
Recognise high risk
AI in recruitment, selection or employee assessment falls under stricter rules. Look at this carefully.
The AI Act step by step
Following the 2026 amendment (AI Omnibus). Status as of September 2026.
This information is a summary and not legal advice. Rules and deadlines may change.
Set up governance →- 1 August 2024The AI Act enters into force.
- 2 February 2025Prohibited AI practices apply. The AI literacy provision (Article 4) takes effect.
- 2 August 2025Rules for providers of general-purpose AI models, such as the models behind ChatGPT and Copilot.
- 24 July 2026The amendment of the AI Act (AI Omnibus) is published. Among other things: AI literacy becomes an obligation to support, and deadlines for high-risk AI move back.
- 2 August 2026Transparency obligations apply, for example that people must know they are interacting with an AI system.
- 2 December 2026Marking AI-generated content (Article 50(2)) takes effect.
- 2 December 2027Obligations for high-risk AI under Annex III, such as AI in recruitment or employee assessment.
- 2 August 2028Obligations for high-risk AI in products covered by existing product legislation (Annex I).
Frameworks we use in practice
We use standards as tools, not as goals. You get what your phase requires.
AI management system
ISO/IEC 42001
A structure for policy, roles, risks and improvement cycles around AI. For SMEs mainly useful as a framework; certification is rarely needed.
AI risk management
ISO/IEC 23894
Guidance for assessing AI risks in a structured way and choosing suitable measures. We use it for the risk classes in your AI register.
Information security
ISO/IEC 27001
Good security is a precondition for trustworthy AI: who has access to which data, and how is that arranged?
Quality management for the AI Act
NEN-EN 18286
European standard for the quality management system the AI Act requires from providers of high-risk AI. Relevant if you develop such systems yourself.
Data protection
GDPR
Personal data in AI applications requires a legal basis, data minimisation and sometimes a DPIA. We include this in every pilot.
What does this mean for you?
We are happy to discuss how these frameworks relate to your use of AI.
Get in touch