EU AI Act: what actually applies to your SME in 2026

The timeline has changed

The EU regulation on artificial intelligence (Regulation (EU) 2024/1689, the "AI Act") entered into force on 1 August 2024 and applies in stages. On 27 July 2026, Regulation (EU) 2026/1744, known as the "Digital Omnibus", amended it: some deadlines were postponed and the AI literacy duty was softened.

Here is where the timeline stands in October 2026:

• 2 February 2025: ban on unacceptable AI practices; Article 4 (AI literacy) applies.
• 2 August 2025: obligations for providers of general-purpose AI (GPAI) models, governance and the penalty regime.
• 2 August 2026: transparency obligations (Article 50). Providers of generative systems already on the market have until 2 December 2026 to mark generated content.
• 2 December 2027: obligations for high-risk systems listed in Annex III (recruitment, credit, education…), originally due on 2 August 2026.
• 2 August 2028: high-risk systems built into regulated products (Annex I, such as medical devices or machinery).

As with GDPR, the task for a Belgian SME is not to do everything overnight. It is to know which uses are covered, and from when.

What changes for you

The AI Act sorts uses of AI by risk level.

What is prohibited (since February 2025): social scoring, emotion recognition in the workplace and in education (except for medical or safety reasons), manipulative techniques that cause harm, and real-time remote biometric identification in public spaces for law enforcement, with exceptions. The Digital Omnibus adds two bans: non-consensual intimate deepfakes and AI-generated child sexual abuse material. If a tool you use does any of this, stop using it.

What is heavily regulated (high risk): automated CV screening, creditworthiness assessment of individuals, assessment of students. For these Annex III systems, obligations apply from 2 December 2027: documentation, human oversight, logging, and informing the people affected. Financial fraud detection is excluded from the "credit" category.

What requires transparency (since 2 August 2026): chatbots must disclose that people are talking to an AI, and deepfakes must be labelled as such.

What remains unrestricted: spam filters, content recommendations, ChatGPT or Copilot for drafting emails. No specific obligation beyond AI literacy, plus GDPR if you process personal data.

Not sure about your risk level? Our EU AI Act training helps you map your uses and obligations.

Penalties: know them, don't panic

Article 99 provides for fines of up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other obligations, and up to €7.5 million or 1% for supplying incorrect information to authorities. For SMEs, the lower of the two amounts applies. The Digital Omnibus extends this to "small mid-cap enterprises".

For an SME using off-the-shelf tools without any prohibited practice, the main risk is not the maximum fine. It is unknowingly using a high-risk system, or being unable to show what you have put in place.

Good news if you are already GDPR-compliant: part of the method (records, risk analysis, governance) carries over directly.

Need an AI charter for your company? Our AI Governance consultancy can help.

Take action

1. Take inventory. List every AI tool used in your company, including AI built into your software. Everything else builds on this.
2. Classify your uses. Spot anything high-risk (HR, credit, education) and prepare for 2 December 2027.
3. Support AI literacy. An EU AI Act training as a lunch & learn or half-day is often enough to lay the groundwork and document your measures.
4. Assess your exposure. Our free AI diagnostic measures your maturity and risks in a few minutes.