EU AI Act in August 2026: the minimum checklist for an SMB
On 2 August the core obligations kick in. This is the practical checklist to avoid being caught off guard — without €500/hour consultants.
On 2 August 2026 the core obligations of the EU AI Act come into force. Fines go up to €35 million or 7% of global turnover. No, this isn’t only a concern for large enterprises — most obligations apply to SMBs, even if the Digital Omnibus promised a 35% reduction in administrative burden for this segment.
Here’s the checklist I use with clients who haven’t started yet.
1. Inventory every AI system in use
That includes AI-powered SaaS (meeting assistant, site chatbot, writing assist), internal agents, and any custom models. No inventory, no compliance.
2. Classify each system by risk
Four categories in the EU AI Act:
- Unacceptable risk — banned (e.g. subliminal manipulation, social scoring).
- High risk — substantial obligations (e.g. candidate screening, credit decisions).
- Limited risk — transparency obligations (chatbots, content generation).
- Minimal risk — no specific obligations.
Most SMB tools fall into limited risk. HR and financial decisioning tools often fall into high risk — in those cases, prepare for real work.
3. Comply with Article 4: AI literacy
In force since 2 February 2025, it requires all staff using AI to have "sufficient literacy" to use it responsibly. In practice: documented training for the whole team. It doesn’t have to be expensive — it has to exist and be recorded.
4. User transparency
If the customer is interacting with AI, they must know. A simple "You’re talking to an automated assistant — would you like to speak to a person?" solves most cases.
5. Technical documentation and human oversight
For high-risk systems: full technical documentation, activity logging, effective human oversight, robustness and cybersecurity, and post-market monitoring. Full autonomy without a human in the loop stops being acceptable in many cases.
What you don’t need to do tomorrow
- Hire €500/hour consultants before you have the inventory.
- Ditch useful tools out of fear of "not being compliant" — most are limited risk.
- Rewrite everything from scratch. Annex III obligations (autonomous high-risk systems) were postponed to December 2027. There’s space to work in an orderly way.
The real checklist fits on one page. The resistance is habit, not the legal text.