EU AI Act checklist for small businesses (2026, post-Omnibus)

Does the AI Act apply to you?

If your business is established in the EU (or serves EU customers) and anyone in it uses AI (a chatbot, generative tools, AI features inside your CRM), the answer is almost certainly yes. The AI Act's general obligations became enforceable on 2 August 2026.

The good news: the July 2026 Digital Omnibus (Regulation (EU) 2026/1744) softened several duties for small companies and pushed the heaviest high-risk requirements to December 2027 and August 2028.

The five-point checklist

1. Inventory: list every AI system your business uses, and who uses it.

2. AI literacy measures (Article 4): take measures to support staff AI literacy appropriate to their roles, and keep evidence of what you did. No certificate is legally required, but you must be able to show what you considered and did if a market-surveillance authority asks.

3. Chatbot disclosure (Article 50(1)): if customers talk to an AI, tell them it's an AI.

4. Content transparency (Article 50): if you provide a generative AI system, machine-readable output marking is your duty. If you use someone else's system, check the separate deployer duties for deepfakes, emotion-recognition or biometric-categorisation exposure, and AI text published to inform the public on matters of public interest.

5. High-risk check: if you use AI in hiring, employee evaluation, credit or essential services, start preparing now. Full duties apply from 2 December 2027.

What non-compliance actually costs an SME

Article 4 and Article 50 breaches sit in the €15M / 3% fine tier, but SMEs are capped at the LOWER of the two. A company with €2M turnover faces a realistic maximum around €60,000 per infringement, not €15M. Still real money, and the commercial damage of an enforcement action is often worse than the fine.