AI Act: What Changes for Companies and What the Obligations Are

The AI Act is the European regulation on artificial intelligence, Regulation (EU) 2024/1689, and it also applies to companies that only use AI without developing it. For an SME that uses ChatGPT, a chatbot on its website or software with AI features, the AI Act today mainly asks for three things: train the people who use these tools, stay away from prohibited practices and meet the transparency obligations. The heaviest obligations, those on high-risk systems, have been postponed to 2 December 2027 and 2 August 2028.

This article sets out the timeline as updated in September 2026, explains which role an SME usually has and shows what to do in practice. We report dates and articles as they appear in the official texts; this is not legal advice, and specific cases need a professional opinion.

Update, 29 October 2026: after this article was published, Italy issued Legislative Decree no. 179 of 7 October 2026 (in Italian, Official Gazette no. 234 of 8 October 2026). It aligns Italian law with the AI Act on the powers of national authorities and on the use of AI in training. The EU deadlines below are unchanged.

The AI Act in brief

The regulation entered into force on 1 August 2024 and is directly applicable in all Member States, with no need for national transposing legislation. It classifies uses of artificial intelligence by risk:

• some practices are banned outright;
• some systems are classified as high risk and must meet strict requirements;
• other systems, such as chatbots and content generators, are subject to transparency obligations;
• everything else carries no specific obligations, except staff AI literacy.

There are also separate rules for general-purpose AI models, meaning the large models that tools such as ChatGPT are built on. Those rules concern whoever develops the models, not the company that uses them.

The AI Act timeline after the Digital Omnibus

The original timeline had almost everything applying from 2 August 2026. On 19 November 2025 the Commission proposed a simplification package, the so-called Digital Omnibus on AI. Parliament and Council reached political agreement on 7 May 2026 and the text became Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal of the EU on 24 July and in force since 27 July 2026. The postponement is therefore no longer a proposal: it is law.

The high-risk dates used to be 2 August 2026 for Annex III and 2 August 2027 for Annex I. The Commission justified the postponement by the need to have technical standards and support tools for companies in place first, as explained on the official page on the AI regulatory framework.

One thing the Omnibus did not move: literacy and bans have applied since 2 February 2025, and from August 2026 national authorities can supervise these too.

AI Act and companies: provider or deployer?

The obligations vary a lot depending on your role. The regulation defines several, but for an SME two matter most.

The provider is whoever develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. OpenAI for ChatGPT, the software house selling an ERP with AI features, but also the company that commissions a custom system and uses it under its own brand.

The deployer is whoever uses an AI system under its own authority in the course of a professional activity. The distributor that has a generative model write product descriptions, the repair shop using an assistant for quotes, the firm summarising documents with AI: they are all deployers.

Most SMEs are deployers. There are, however, cases where a deployer becomes a provider, and Article 25 lists them for high-risk systems: if you put your name or trademark on a high-risk system already on the market, if you modify it substantially, or if you change the purpose of a system that is not high risk so that it becomes one. An example to assess carefully: taking a general model and using it to filter CVs automatically can mean changing its purpose into an area that Annex III treats as high risk.

If you have custom software with AI features developed, as happens in the projects we run, agree in writing with the supplier who holds which role and who prepares which documentation.

AI Act: obligations for companies that use AI

This is the part that matters to most SMEs.

AI literacy (Art. 4)

Since 2 February 2025 providers and deployers have had to take measures for the AI literacy of their staff and of other people using the systems on their behalf. The original text spoke of ensuring "to their best extent, a sufficient level" of literacy. The Omnibus rewrote Article 4: the obligation remains, but it consists of taking measures to support skills development, taking into account technical knowledge, experience and the context of use, and it does not require a specific level to be guaranteed for each person. The Commission's questions and answers on AI literacy make clear that enforcement lies with national market surveillance authorities from 2 August 2026.

In practice: anyone using AI tools must know what they do, where they go wrong, which data must not be entered and whom to call when in doubt. It is worth keeping a record of what you have done (dates, content, participants).

Prohibited practices (Art. 5)

These have been banned since 2 February 2025. Most concern cases far removed from SME life, such as real-time biometric identification by law enforcement. Some, though, can affect a company:

• systems that infer people's emotions in the workplace, except for medical or safety reasons;
• manipulative or deceptive techniques that distort people's behaviour and cause significant harm;
• exploiting vulnerabilities linked to age, disability or economic situation;
• social scoring that leads to unjustified unfavourable treatment;
• biometric categorisation to infer sensitive data such as political opinions or sexual orientation.

If a supplier offers to "measure employee engagement" by analysing faces or voices during meetings, stop and get legal advice before signing. From 2 December 2026 the bans introduced by the Omnibus on systems that generate sexual images of real people without consent are added.

High-risk systems

The obligations for Annex III systems apply from 2 December 2027. For an SME the most likely areas are two: employment (candidate selection, decisions on promotion or termination, task allocation based on individual behaviour, performance monitoring) and creditworthiness assessment of natural persons.

If you use such a system as a deployer, Article 26 requires you, among other things, to:

• use it in accordance with the provider's instructions;
• assign human oversight to people with adequate competence, training and authority;
• keep automatically generated logs, where they are under your control, for at least six months;
• inform workers' representatives and the workers concerned before putting it into use in the workplace.

The postponement buys time, but contracts are being signed now. If you are evaluating HR software with automated selection features, ask the supplier how it plans to comply by December 2027.

Transparency (Art. 50)

Transparency obligations apply from 2 August 2026. Providers must design systems that interact with people so that those people know they are dealing with an AI, unless this is obvious. Providers of systems that generate synthetic content must mark it in a machine-readable format; for systems already on the market before 2 August 2026 the deadline is 2 December 2026.

For deployers there are two main obligations. Anyone publishing deepfakes, meaning generated or manipulated images, audio or video that appear authentic, must disclose it. Anyone publishing AI-generated text to inform the public on matters of public interest must disclose it, unless the text has undergone human review with a person holding editorial responsibility.

For an SME this means, for example, that the business chatbot on the website must make clear to customers that they are talking to an automated system, and that a promotional video featuring an AI-generated person must be labelled as such.

The penalties

Article 99 sets the maximums: up to €35 million or 7% of worldwide annual turnover for prohibited practices; up to €15 million or 3% for breaches of other obligations, including those of deployers (Art. 26) and transparency (Art. 50); up to €7.5 million or 1% for supplying incorrect information to authorities. For SMEs the lower of the fixed amount and the percentage applies; the Omnibus extended the same criterion to small mid-caps for breaches other than prohibited practices. The concrete rules on penalties are set by the Member States.

Italy's national AI law

Italy passed Law no. 132 of 23 September 2025, published in the Official Gazette no. 223 of 25 September 2025 and in force since 10 October 2025. This is an Italian law, relevant if your company is based or employs people in Italy. It does not replace the AI Act: it sits alongside it. For companies three articles matter most.

• Article 11 covers employment: the employer must inform workers about the use of artificial intelligence in the cases and in the manner set out in Article 1-bis of Legislative Decree 152/1997, that is when automated decision-making or monitoring systems are used that are relevant to hiring, management of the employment relationship, task allocation or evaluation.
• Article 13 covers the intellectual professions: AI may be used only for instrumental and support activities, and professionals must inform clients about the systems they use, in clear language.
• Article 20 designates the national authorities: AgID for promoting innovation and notifying conformity assessment bodies, ACN for supervision, including inspections and penalties. The powers of Banca d'Italia, CONSOB and IVASS in their respective sectors remain unchanged.

The law also delegates powers to the Government to align national legislation with the AI Act. A first implementing decree, Legislative Decree no. 160 of 9 September 2026, covers the use of AI in police activities and civil and criminal liability; it was published in the Official Gazette on 15 September 2026. More decrees are expected, and it is worth following updates on Normattiva, the Italian legislation portal.

What to do in practice in an SME

For a company of 20 or 50 people the work is manageable, provided it is done in an orderly way. This is the path we suggest to clients who ask us.

1. Take an inventory of AI tools. Ask each department what it really uses, including personal ChatGPT accounts and similar, and AI features inside software you already have (CRM, ERP, recruitment platforms). For each one, note who uses it, for what, with which data and who the supplier is.
2. Classify each use. Most will fall into the band with no specific obligations or the transparency band. Flag separately anything that affects employees and candidates, creditworthiness or product safety: these are the cases to examine with a consultant.
3. Write a one- or two-page usage policy: authorised tools, data that is never entered (personal data of customers and employees, confidential prices, documents covered by confidentiality), the obligation to check outputs before using them, whom to contact.
4. Organise training and document it. One session for people who use the tools every day, a shorter one for everyone else, material to reread. It is the most direct way to comply with Article 4.
5. Check supplier contracts: use of the data entered, where it is stored, each party's role under the AI Act, compliance commitments for any high-risk systems.
6. Inform workers when required, under Article 11 of Italian Law 132/2025 and, for high-risk systems, Article 26 of the AI Act.
7. Review the inventory every six months. Tools change quickly, and guidelines from the Commission and national authorities keep coming.

Much of this work overlaps with what you have already done for the GDPR and for IT security. If you have a record of processing activities and an IT security policy for your SME, start from there. For a broader view of how to introduce AI in your company there is the guide on artificial intelligence for SMEs, while the topic of informing workers ties in with the article will AI replace my employees?.

For the official texts and frequently asked questions, the Commission has opened the AI Act Service Desk, which brings together articles, annexes and compliance checking tools.

If you are looking at tools that act on their own inside your systems, we explain separately what AI agents are and what they really do.

Let's talk

When we design AI automation for companies, we include the risk classification and the roles set out in the AI Act in the initial analysis, together with data permissions and human oversight. If you want to know how to set up an AI project that also holds up from a regulatory point of view, or you need help taking an inventory of the tools you use, book a call with us. For strictly legal matters we will tell you clearly when you need a lawyer.

This article is for information purposes only and does not constitute legal advice. Dates and content have been checked against the official texts available in September 2026.