AI Act: what obligations does an SME really have
AI Act obligations for SMEs: literacy rules rewritten by the Omnibus, transparency from 2 August 2026, high-risk rules from 2027 and planned simplifications.
Reading time: 12 min
The question all small Italian companies ask themselves is: "Does the AI Act force me to do anything?". The honest answer is that it depends mainly on the role you have with respect to the system, and that in most cases the answer is "little, with precise dates".
The Regulation does not grade substantive obligations according to turnover or number of employees: it ranks them according to What the system does and if you provide it or use it. Size matters for simplifications and penalties. An SME that develops and sells scoring software has far more obligations than a medium business that uses assistants to write emails.
In 2026 the picture was also lightened. The Digital Omnibus on AI, Regulation (EU) 2026/1744, re-written the literacy requirement, postponed the high risk to 2 December 2027 and extended some simplifications to small mid-caps. Transparency to those who talk to a chatbot is valid from August 2, 2026 (Art. 50 and Art. 113 of the AI Act).
In summary
- Obligations depend on role (provider or user) and by risk band, not from the corporate dimension.
- Those who use generic AI tools for internal work are at minimal risk: the only obligation is to support the literacy of staff, as required by Article 4 rewritten by the Omnibus from 27 July 2026.
- Anyone who has a chatbot or agent talking to customers must declare it from 2 August 2026, at the latest at the first interaction (Art. 50).
- Those who use AI to decide on persons enter into the high risk: real obligations, applicable from 2 December 2027 for Annex III (Reg. (EU) 2026/1744).
- Reselling a third-party solution with its own brand transforms the company into a supplier.
- For SMEs and small mid-caps there are document simplifications and lower penalties, not substantial exemptions.
Role matters more than size
The AI Act distinguishes different subjects along the chain. The two that affect almost all companies are the supplier and the user (in the text, ‘deployer’).
| Supplier | User | |
|---|---|---|
| Who is it? | Develop the system or market it under your own name | He employs it in his own business |
| Obligations on high risk | Risk management, technical documentation, data quality, conformity assessment, marking | Use according to instructions, human surveillance, information to data subjects, log retention |
| Weight | High, structured, continuous | Content but substantial |
| Typical SME case | Software house selling an AI module | Company buying and using that module |
Most Italian SMEs are user. It is the most comfortable position: heavy technical obligations remain upstream, and what remains is to use the system with criterion.
The obligations, band by band
Crossing role and risk band (explained in the four levels of risk) you get the map you really need.
Minimal risk. No specific obligation, except for the literacy measures of Article 4 which apply to all and which you find below. It is the case of assistants for writing, summaries, data organization, internal automations that do not decide on people. The rules on models for general purposes, applicable from August 2, 2025, concern who those models develop them, not the company that uses the assistant (Article 113(b)). Here the serious focus is on data, not the AI Act.
Limited risk. An obligation, from 2 August 2026: transparency (Art. 50). People need to know that they are interacting with an automatic system, and realistic content generated with AI needs to be declared.
- A line visible when opening the chat: «automatic assistant»
- An honest answer if the user asks if he talks to a person
- A statement when publishing deep fake, i.e. images, audio or video generated with AI that look authentic
High risk. Here the register changes, but with a date: for Annex III systems the obligations start from 2 December 2027; for those who produce goods in which the AI acts as a safety component (Annex I: for example lifts, pressure equipment, medical devices) from 2 August 2028 (Reg. (EU) 2026/1744). If you are a user you must ensure that the system is used as intended, that human surveillance is entrusted to people who can understand and overturn it, that the persons concerned are informed and that the logs are kept for at least six months (Art. 26). If you are a supplier, the obligations are the entire compliance package.
Literacy: what Article 4 asks after the Omnibus
It is the only obligation of the AI Act that affects any company using AI systems, regardless of the band. It applies from 2 February 2025 (Article 113(a)) and on 27 July 2026, with the entry into force of the Omnibus, its text has been replaced.
Original text
- Measures to ensure ‘as far as possible a sufficient level’ of literacy
- A level of expertise as a goal to be achieved
Text after the Omnibus
- "Measures to support the development" of literacy of staff and collaborators
- No ‘specific level’ to guarantee for any person
- Commission and Member States support SMEs; Commission publishes practical examples
In practice, for an SME: a basic training proportionate to who uses what (who writes emails with an assistant does not need the path of who configures an agent), clear rules in the internal policy and a trace of what you have done. The track doesn't ask for the standard to the letter, but it's what allows you to prove it. How to set up training is explained in training the team on AI.
Simplifications for SMEs, after Omnibus
The regulation recognises that a small company does not have the apparatus of a multinational, and the Omnibus has expanded some measures to small mid-cap businesses, i.e. companies exceeding the thresholds of SMEs, as defined by Recommendation (EU) 2025/1099. SMEs remain those of Recommendation 2003/361/EC (new Article 3, points 14 bis and 14 ter).
| Measure | Who it is for | Source |
|---|---|---|
| Simplified technical documentation module for high risk systems | SMEs, start-ups and, after the Omnibus, small mid-cap companies | Art. 11(1) |
| Some elements of the quality management system in simplified form | All SMEs without associated or related enterprises; first only micro-enterprises | Art. 63(1) |
| Quality system proportionate to size | SME suppliers, start-ups and small mid-caps | Art. 17(2) |
| Priority access to testing spaces, training and dedicated channels | SMEs and start-ups | Art. 62(1) |
| Reduced rates for conformity assessment | Provider SMEs | Art. 62(2) |
| Maximum sanction equal to the lowest amount between fixed figure and percentage | SMEs and start-ups for all groups; small mid-caps for those in paragraphs 4 and 5 | Art. 99(6) and paragraph 6 bis |
Four SMEs, four different situations
Installation company with 12 employees. Use an assistant to prepare quotes and respond to emails. Minimal risk, user role: from the AI Act comes only the literacy of those who use the tool. The more sensible thing to do is an internal policy that says which data should not be pasted into external tools, see How to Write a Business Policy on AI.
Consulting firm that put an assistant on the site. Limited risk, user role. From August 2, 2026 visitors must know that they speak with an automatic assistant (Art. 50); if the product is of a third party, verify that the message is already foreseen and clearly visible. If an intellectual profession is exercised in the firm, the law 132/2025, art. 13 It also asks to inform customers about AI systems used for performance.
40-person company that introduced a CV screening tool. High risk, user role, with obligations applicable from 2 December 2027 (Omnibus). Technical obligations are with the software provider, but the company will have to ensure real human surveillance, inform the persons concerned and retain the logs. It must also be verified that the ordering criterion does not produce indirect discrimination: it is the part that suppliers cannot guarantee for you, because it depends on how you use it. On the Italian front, the Art. 11 of Law 132/2025 already recalls the obligation to inform workers about automated decision-making systems in the cases of Article 1-bis of Legislative Decree 152/1997.
Web agency that sells a chatbot with its own brand to customers. Role: supplier. This is the situation where a small business finds itself with obligations that it did not expect, and the cause is only the brand.
What to ask the supplier before signing
If you are a user, much of your peace of mind depends on what the person selling you the system provides. before of the purchase, when you still have negotiating power.
- In what risk group do you classify your system, and with what motivation?
- The system already informs the user that he is talking to an AI, as requested by the Art. 50 from August 2, 2026?
- Do you provide written instructions for use, as intended for high-risk systems?
- The system produces searchable logs, and for how long do they remain available?
- Where is the data hosted, and are they used to train models?
- Do you make the agreement on the processing of personal data available?
- What happens to compliance if you update the underlying model?
The last is the one that no one poses and is the most insidious. Many AI services change the underlying model without notice: the behavior of the system can vary from day to day, and with it its reliability on your use case. If you've built on it a process that touches people, it's a matter of compliance as well as quality.
The contractual point is developed in contract with an AI provider and the criteria of choice in how to choose an AI provider.
The obligation that almost everyone has and hardly anyone respects
For many SMEs the most visible AI Act fulfillment is declare that the assistant on the site is automatic, mandatory from 2 August 2026 (Article 50 of the AI Act). And it is also the one that is disregarded most often, not by resistance but by distraction.
The reason is that transparency is treated as a legal issue and ends up in the conditions of use, where no one reads it. On the other hand, the rule requires that the information arrive in a clear and distinguishable way, at the latest at the first interaction (Article 50(5)). Formally the obligation to design the system so is the supplier's (paragraph 1): if the assistant had it developed and put it into service with your brand, the supplier is you; if you use a third-party product, check that it does.
What's really enough:
- A line visible at the opening of the conversation, with normal words.
- Consistency in behavior: If the user asks "are you a human?", the answer must be honest.
- An obvious way to ask to speak to a person. The AI Act does not impose it, but it is the difference between a customer served and a complaint.
The second point is the one that distinguishes a configuration made well from one made for pretend, and depends on how the assistant is set: theme covered in AI chatbots: what they are and in assistant, chatbot and agent: the differences.
The typical mistakes of SMEs with the AI Act
- To think that "small enterprise" means "exempt". Regulation scales by risk and role, not by size.
- Forgetting literacy. It is the only requirement that applies to anyone using AI, even in the lighter version introduced by the Omnibus.
- Don't realize you're a supplier. The mark is the most underrated passage.
- Treating human oversight as a signature. If the approver cannot understand or overturn, the obligation is not met.
- Putting transparency in the conditions of use. It goes where the user reads it, not where no one looks.
- Buying compliance before classifying. In most cases it turns out that it was not needed.
The route for an SME, in an afternoon
The path for an SME is short and it is done internally:
- It lists the AI systems in use, including the informal habits of collaborators.
- For each it marks the role: Do you use it or resell it by your name?
- For each it marks the Headband: decide about people, talk to people, or neither?
- Fix the transparency where it is needed. It is the most frequent and the fastest fulfillment.
- Organize basic training for those who use AI and write an internal policy of a few pages.
- Review the table when you introduce a new system or change the use of an existing one.
The typical result for an Italian SME: all systems at minimum risk except the site chatbot, a line of transparency to add, a basic training and an internal policy to write. An afternoon's work, not a compliance project. The reference dates, for each obligation, are in the AI Act schedule.
Since these are rules with evolving implementing acts, verify official sources when the classification has contractual or legal consequences.
Few obligations, but with precise dates
For an SME, the AI Act is much lighter than commercial communication around the topic suggests. Serious obligations lie where AI decides on people or where the company sells systems to others, and for Annex III they start from 2 December 2027 (Regulation (EU) 2026/1744). Everything else resolves with basic training, internal clarity and an honest line on the site.
The thing that is better to do really is not to buy fulfillments: it is to know what is used. From there on the answer comes by itself.
If the assistant on your site needs to be reviewed for transparency, or you want an agent who is already born with the right message and the transition to an intended operator, we design it this way: see AI Agents for Companies. The complete picture is in AI Act: The Business Guide.
Giallo Studio guides: methodology and sources
How we apply it in the company
Related resources
FAQ
Does an SME that only uses ChatGPT have AI Act obligations?
Only a few. Using a generic assistant for internal tasks, such as writing, summarising, and organising, falls into the minimal-risk category. The AI literacy obligation under Article 4 remains: from 27 July 2026, the Digital Omnibus on AI (Regulation (EU) 2026/1744) requires measures that support the skills of people using AI, without guaranteeing a specific level. Obligations under other laws still apply, first and foremost the GDPR if the content contains personal data.
Does the AI training requirement apply to me too?
Yes. Article 4 has applied to all providers and deployers of AI systems since 2 February 2025. Until 26 July 2026, it required them to ensure, "as far as possible, a sufficient level" of AI literacy; from 27 July 2026, the Omnibus replaced this with an obligation to take measures that support its development, specifying that no particular level has to be guaranteed for any person. In practice, basic training proportionate to who uses which tools is sufficient, and it is worth keeping a record of it.
What obligations does the deployer of a high-risk system have?
Use the system according to the provider’s instructions, assign human oversight to competent people, inform the people affected by the decision, retain the logs generated by the system for at least six months, and suspend its use if risks emerge (Article 26 of the AI Act). For Annex III systems, such as CV screening, these obligations apply from 2 December 2027 following the postponement introduced by Regulation (EU) 2026/1744.
If I customise a third-party system, do I become a provider?
It depends on the extent of the modification. Configuring a system for your own use case does not change your role. Substantially modifying it by changing its purpose, or placing it on the market under your own name or brand, does: in that case, you take on the provider’s obligations.
Do I need to appoint an AI manager in the company?
The regulation does not require every business to appoint a role equivalent to the GDPR’s DPO. That said, having someone who knows which AI systems are in use and who authorised them is useful regardless of the law, and is the cheapest way to prevent unregistered tools from entering the business through the back door.
Do micro-enterprises have a lighter regime?
There are simplifications, not exemptions. After the Omnibus, all SMEs, no longer just microenterprises, can adopt some elements of the quality management system in a simplified form (Article 63), and the simplified technical documentation form also applies to small mid-cap companies (Article 11). For SME penalties, the lower of the fixed amount and the percentage applies (Article 99, paragraph 6). However, a high-risk system remains high-risk even in a small business.
What should I write on the site if I have a chatbot?
Since 2 August 2026, users must receive clear, distinguishable information, at the latest during their first interaction, stating that they are dealing with an automated assistant (Article 50, paragraphs 1 and 5, of the AI Act). A legal document is not needed: users need to understand this without having to search for it. Hiding the disclosure in the terms of use does not meet the transparency obligation.