October 16, 2026
A company of thirty people can use artificial intelligence in four different places: drafting client proposals with an assistant; ranking job candidates in the recruitment platform; setting up the customer chatbot by an agency on the main website; processing incoming invoices with an automated feature that appeared inside the accounting software.
All these integrations accumulate organically.
A demand for clarity related to these integrations may also come from the outside: a compliance questionnaire from a corporate client, a mandatory requirement in a public tender, a due diligence checklist from a partner, or a direct inquiry from an auditor. For most small businesses, answering it means working out which of these systems the law treats as what, and who carries each obligation.
The Rules Do Not Scale with Company Size
Regulation (EU) 2024/1689 establishes statutory duties based on system capabilities and organizational roles. Capability and role determine the requirement. A fourteen-person business developing a high-risk application carries core obligations identical to those of a multinational technology provider.
The Irish Government’s SME Test for the AI Act (February 2025) restates the Commission’s own finding: SMEs building high-risk applications bear costs similar to those of large companies. It also concludes that many SMEs will see no, or minimal, impact, given the lower risk of the systems they use.
Resource constraints dictate how easily an organization absorbs these technical costs. Recognizing this financial imbalance, European legislators adjusted the implementation schedule.
What Changed in 2026: The Digital Omnibus
The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) amended Regulation (EU) 2024/1689 (and Regulations (EU) 2018/1139 and 2023/1230), shifting several major compliance deadlines:
- Annex III Stand-Alone High-Risk Systems: The enforcement date moved from August 2, 2026, to December 2, 2027.
- Annex I Embedded High-Risk Systems: Safety components in regulated hardware moved from August 2, 2027, to August 2, 2028.
- Public Authority Deployments: The August 2, 2030 deadline for high-risk systems intended for use by public authorities was already in the original text (Article 111(2)) and remains in place. The Omnibus reworded the paragraph and clarified how the grace period applies to systems placed on the market before the high-risk rules start to apply.
- National Regulatory Sandboxes: The deadline for Member States to establish operational sandboxes moved from August 2, 2026, to August 2, 2027.
Sixteen additional months for Annex III systems allow small businesses to audit internal systems, secure vendor documentation, and build operational guardrails before full enforcement begins.
Other statutory deadlines remain active.
What Applies Right Now
1. Transparency Obligations (Article 50)
Since August 2, 2026, individuals interacting with artificial intelligence must be informed that they are doing so, except where this is obvious to a reasonably well-informed person. The obligation for systems that interact directly with people sits with the provider, while Article 50 places further transparency duties on deployers.
A business purchasing a third-party chatbot operates as a Deployer, requiring its vendor to supply compliant systems. An enterprise building a custom agent acts as a Provider, bearing the obligation directly. For providers of systems generating synthetic audio, image, video or text that were placed on the market before August 2, 2026, the machine-readable marking obligation in Article 50(2) has an extended deadline ending December 2, 2026. This grace period covers Article 50(2) only.
2. AI Literacy (Article 4)
Active since February 2, 2025, Article 4 reaches organizations across all risk tiers. The Digital Omnibus softened its wording: the original text required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff. The amended text requires measures to support the development of AI literacy, without any obligation to guarantee a specific level, and additionally tasks the Commission and the Member States with supporting and facilitating these efforts, in particular for SMEs. Anyone relying on this provision should read the current wording rather than the 2024 one.
3. Prohibited Practices (Article 5)
Applicable since February 2, 2025, with penalties applicable from August 2, 2025. One prohibition reaches ordinary workplaces directly: emotion recognition in the workplace (and in educational institutions, except for medical or safety reasons), a capability that appears inside some commercial HR and meeting tools.
4. The Two Categories That Catch Small Companies Unprepared
Most administrative tools used by small teams fall under minimal risk or basic transparency rules. Two specific provisions within Annex III frequently affect small organizations.
Employment and Worker Management (Annex III, Point 4)
Systems built for recruiting or selecting job applicants fall into the high-risk category, including software for placing targeted employment ads, screening resumes and evaluating candidates. Point 4(b) adds decisions affecting the work relationship (promotion, termination, task allocation and performance monitoring), where those decisions rest on individual behaviour or personal traits.
Recruitment platforms that score CVs automatically operate inside this legal definition.
Creditworthiness Evaluation (Annex III, Point 5(b))
Tools intended to evaluate the creditworthiness of natural persons or establish their credit score fall under high-risk rules, excluding dedicated fraud detection software. Point 5(c) includes life and health insurance risk pricing.
Firms that use a tool intended to assess the creditworthiness of individual consumers, for instance before extending payment terms, fall under these specific legal provisions.
Organizational roles determine legal duties. A business using third-party HR software acts as a Deployer, holding a distinct set of operational duties. A firm modifying or building such software operates as a Provider, carrying full high-risk compliance responsibilities.
What It Costs
Compliance cost projections vary widely across industry reports.
A study by the Centre for European Policy Studies (CEPS, with ICF and Wavestone), commissioned in support of the European Commission’s impact assessment, estimates the setup cost of an entirely new quality management system at between €193,000 and €330,000, with an additional €71,400 per year for maintenance. These costs are fully incurred only by a company that has no quality management system in the first place, and they fall on providers of high-risk systems.
A different figure, up to €400,000 for one high-risk AI product, circulated widely in commentary and in the press. It comes from a Center for Data Innovation paper. CEPS noted that it probably simply added its €330,000 and €71,400 figures, presenting the sum as the cost of a single product.
Reading the primary source before budgeting produces a figure that matches the obligation it is meant to cover.
What the Regulation Puts on the Scales
Specific statutory provisions address the operational challenges faced by smaller firms:
- Lower fine ceiling (Article 99(6)): fines are capped at the fixed amount or the percentage of turnover, whichever is higher for large companies; for SMEs and start-ups, whichever is lower. Small mid-caps get the same rule for fines under Article 99(4)–(5) (Article 99(6a)).
- Simplified technical documentation (Article 11(1)): the Commission establishes a simplified form for SMEs, including start-ups, and small mid-caps; notified bodies must accept it.
- Simplified quality management (Article 63(1)): SMEs without partner or linked enterprises may comply with certain elements of the quality management system in a simplified manner. This does not exempt them from Articles 9–15, 72 and 73.
- Regulatory sandboxes (Articles 57, 58 and 62): access is to be free of charge for SMEs, with priority access for SMEs (Article 62(1)(a)). The exit report is taken positively into account by authorities (Article 57(7)), and no administrative fines are imposed on participants who follow the plan and the authority’s guidance in good faith, although liability for damage to third parties remains (Article 57(12)).
- Small mid-caps: the Omnibus extends to them the simplified documentation form, proportionate quality management and the lower fine rule above. Separately, the AI Office may set up a Union-level sandbox with priority access for SMEs and small mid-caps (Article 57(3a)). Simplified quality management (Article 63) and free sandbox access remain limited to SMEs.
Financial caps and sandbox access reduce direct operational expenditures. Simplified technical forms streamline administrative reporting while preserving underlying requirements for technical logging and data auditability.
Who Enforces It, and What That Means in Practice
Member States designate national market surveillance authorities to handle local oversight.
Romania illustrates the gap between European statutory enactment and local administrative enforcement. ANCOM was proposed, through a governmental memorandum of March 12, 2026, as the market surveillance authority and single point of contact. A memorandum does not confer powers of inspection or sanction. As of mid-October 2026 the national law defining its powers and the applicable penalties is still in preparation, according to ANCOM. According to a Romanian press report of a Deloitte Legal analysis updated in July 2026, Romania is among the partial implementers, alongside Austria, Belgium, Bulgaria, Croatia, Estonia and Slovakia.
This administrative timeline yields two operational realities:
- European regulations bind organizations immediately: Statutory provisions covering transparency, prohibited uses and workforce literacy apply across all Member States regardless of local procedural delays.
- Local enforcement infrastructure develops continuously: Organizations preparing their compliance posture position themselves ahead of finalized national inspection frameworks.
What to Do from Now Until December 2027
Building a resilient compliance posture requires four practical steps:
- An AI Systems Register: A complete inventory tracking internal tools, primary operational use cases, assigned risk tiers, and accountable system owners.
- A Functional Usage Policy: Clear guidelines establishing permitted tools, restricted data categories, approval channels for new software, and output validation procedures.
- Designed Human Oversight: Explicit protocols defining where staff members intervene, what authority they hold, and how they override automated decisions.
- Three-Level Evidence of Control: Verifiable proof showing that policy rules exist on paper, operate within technical software configurations, and guide daily worker decisions.
Completing these four steps before late 2027 transforms statutory deadlines into routine administrative checks.
Organizations evaluating their regulatory exposure can complete our structured assessment framework to review current operational readiness.