Article

EU AI Act for SMEs: what applies now and what to do?

An honest explanation of the EU AI Act: which obligations already apply, who they apply to, and how to comply without the hassle.

Written by Loek Delahaye, founder, Delahaye Solutions · ex-CTO with 10+ years in software and AIPublished:
Short answer
  • AI literacy (Article 4 of the EU AI Act) already applies to every business using AI tools — including ChatGPT and Copilot. The obligation has been in force since 2 February 2025.
  • Most businesses that use AI have not yet taken action, despite the obligations already being in force.
  • Compliance takes three steps: carry out an AI inventory, record it in an AI register, and provide documented role-based AI literacy training.
  • Delahaye Solutions' AI Act Scan handles all three in about a week for a fixed price: €750 for freelancers and small teams; €1,500 for 10-50 employees.

Article 4 already applies — including to you

Many business owners know the EU AI Act is coming but assume it only kicks in during 2026 or later. That is partly true: the enforcement regime starts on 2 August 2026, when national supervisory authorities receive their powers. But the AI literacy duty — Article 4 of the Act — has already applied since 2 February 2025. If your team uses ChatGPT, Copilot or AI features inside your software, you are already a deployer under the EU AI Act. And that comes with obligations you were already supposed to be meeting.

What the Act requires from you

Four things you need to know

The EU AI Act distinguishes between who builds AI and who uses AI. For most SMEs, the role of deployer is the most relevant.

Are you a 'deployer'?

If you use AI tools in your business — even if you buy them in rather than build them yourself — you fall into the category of deployers. That applies to ChatGPT for customer communication, Copilot for text, AI features in your accounting software, or an automation that uses AI. Do you build AI systems yourself and bring them to market? Then you are a provider, with stricter obligations. For most SMEs, the deployer role is the relevant one.

What Article 4 concretely requires from you

Article 4 requires you to ensure that employees who use AI have adequate 'AI literacy': they need to understand how the AI tools they use work, where the opportunities are and what risks come with them. The Act does not prescribe exactly how you meet this, but it must be documented and matched to each employee's role. In practice this means: an overview of which AI tools you use, who uses them, and evidence of training per role.

What changes on 2 August 2026

On 2 August 2026 the national supervisory authorities receive their powers and enforcement can begin. The AI Act itself entered into force on 1 August 2024; the AI literacy duty has applied since February 2025. 2026 is not the start date — it is the point at which enforcement starts in practice. For high-risk AI (such as personnel selection or credit scoring), stricter rules are planned. The EU is working via the 'Digital Omnibus' (November 2025) on a possible shift of those obligations; that proposal is not yet definitively adopted. The AI literacy duty is separate from this and already applies today.

How high are the fines?

We don't do scare tactics. The Act sets a band of up to €15 million or 3% of worldwide annual turnover for this type of obligation, whichever is higher. For SMEs, the lower of the two amounts applies. In practice, oversight usually starts with questions and remediation requests, not the maximum. The real reason to act now: you want this in order before anyone asks — whether that is a supervisor, a client, or a procurement party.

Three concrete steps

How to become compliant with Article 4

Compliance with the AI literacy obligation does not require a large project. It comes down to three steps: (1) Carry out an AI inventory — map out which AI tools your team uses and for what. Think of ChatGPT, Copilot, AI in your CRM or accounting software, or custom automations that use AI. (2) Record this in an AI register — who uses which tool, for what purpose, and who is responsible for it? One clear document is enough. (3) Provide AI literacy training per role — not one generic course, but tailored to what employees actually encounter in their work. Document that you did this. Together these three steps form the core of what Article 4 asks. Everything beyond this (policy documents, dossier building) strengthens your position, but the foundation is achievable for any SME.

Frequently asked questions

Frequently asked questions about the EU AI Act and SME compliance

Does the EU AI Act apply to small businesses and freelancers too?
Yes. The AI literacy obligation (Article 4) applies to every organisation that uses AI tools, regardless of size. There are no exemptions for sole traders or micro-businesses. If you use ChatGPT or another AI tool in your work, you fall under it. For SMEs, the lower of the two fine amounts in the Act's band applies.
What exactly is AI literacy and how do I prove I am doing it?
AI literacy means that employees who use AI tools understand how those tools work, what their limitations are and what risks come with them. The Act does not prescribe a specific form. In practice, a combination of an AI register (who uses what?), an AI policy (how may AI be used?) and documented training per role shows that you take it seriously. A list of signatures or e-learning certificates is already a strong indication.
Do I need to act now, or can I wait until 2026?
Now. Article 4 (AI literacy) has applied since 2 February 2025. On 2 August 2026 the supervisory authorities' powers start — that is the moment when inspection becomes possible, not the moment the obligation kicks in. Waiting until 2026 means being in breach for well over a year by the time the enforcement regime starts.
What are the risks if I do nothing?
The direct risk is an inspection where you have to demonstrate that your employees are adequately trained on the AI tools they use. If the outcome is negative, the supervisor can impose a remediation period, followed by fines (up to €15 million or 3% of worldwide annual turnover, whichever is higher; the lower amount for SMEs). There are also indirect risks in practice: clients in government and large corporates are increasingly asking about AI compliance from their suppliers.
How quickly can I become compliant?
With Delahaye Solutions' AI Act Scan you can be compliant in about a week: we carry out the inventory, the register, the policy and the training for you and deliver an audit-ready dossier. The fixed price is €750 for freelancers and small teams; €1,500 for businesses with 10-50 employees. After that you only need to update the dossier when something changes in how you use AI.
Read more

Want to be compliant quickly?

Book a free intake for the AI Act Scan. We look together at where you stand now, what you need and what it costs — no commitment.

Book a free AI Act intake →

Free and without obligation · Reply within one business day · Fixed price up front, no surprises