The EU AI Act for SMEs: What Should You Do if You Use AI? (2026)

If you use an AI chatbot, AI receptionist, or AI Operating System in your business, the most important AI Act rule for you is: tell people they are communicating with AI. This transparency obligation has been in place since 2 August 2026. The heavy obligations for high-risk AI have been postponed to 2 December 2027 following the Digital Omnibus.

This article is for general information and does not constitute legal advice.

What is the AI Act?

The AI Act is the European law for artificial intelligence. It came into force on 1 August 2024 and is being implemented in phases. The law categorises AI based on risk: the greater the potential harm to people, the stricter the rules.

The four risk levels

Most SME applications fall into the last two categories.

The timeline after the Digital Omnibus

The Digital Omnibus on AI came into force on 27 July 2026. Many online articles still mention August 2026 for high-risk; this is no longer correct.

What should you do as an SME now?

1. Create a list of your AI applications

Note which AI tools you use, for what purpose, and with what data. Also consider AI in software you already have, such as your CRM or accounting package.

2. Declare AI upfront

Do customers talk to a chatbot or AI receptionist? Have it state at the beginning that it is an AI assistant, for example: "You are speaking with the digital assistant of [company]." Also include this in your privacy policy.

3. Check if you are doing anything high-risk

Do you use AI to select job applicants, evaluate employees, or determine creditworthiness? Then prepare for the requirements that apply from December 2027: documentation, human oversight, and risk management.

4. Train your team

Ensure employees know what AI can and cannot do, what data they should not input, and when a human needs to step in. The AI Act pays attention to AI literacy; ask your advisor what specific obligation applies to you following the Omnibus.

5. Combine with the GDPR

The AI Act is in addition to the GDPR, not a replacement for it. If you process personal data with AI, the GDPR rules still apply. Read more about this in AI and privacy: using customer data safely.

How high are the fines?

For prohibited AI, fines can reach up to €35 million or 7% of global annual turnover; for other violations, up to €15 million or 3%. For SMEs, the lower of these two amounts always applies. Supervision in the Netherlands is carried out by, among others, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur).

How Tergem handles this

Our AI receptionist states at the beginning of every conversation that the caller is speaking with an AI assistant, data remains in the EU where possible, and every customer receives a data processing agreement. Want to know more? View our services or ask your question.