EU AI Act timeline for SMEs: what applies when

Why the dates matter more than the headlines

Most coverage of the EU AI Act describes it as one law that arrived at one moment. In practice it is a staged regulation, and the date a duty starts to apply decides what a company has to do now and what it can plan for. For a small or medium-sized company that deploys AI tools built by others, the useful question is not whether the Act is complicated, but which of its stages already apply to the way staff use AI today. This article reads the stages from the European Commission's AI Act page and its AI Service Desk timeline, both opened on the day of writing, 13 October 2026.

A deployer is not a provider

The Act distinguishes between organisations that build or place an AI system on the market and organisations that simply use one in their own business. A company that buys a chatbot, a document assistant or a scoring tool and uses it for its own work is on the deploying side. A company that builds its own system and offers it to others is on the providing side. Many SMEs are both at different times, so it is worth deciding per use case which side you are on. The table below keeps the focus on what a deploying company should expect at each date.

The timeline, date by date

The dates below come from the Commission's own pages. The AI Omnibus, which simplified parts of the Act, is reflected: the Commission states that it entered into force on 27 July 2026 and moved the high-risk dates. Where a row says it depends on your use, the Act's risk-based approach decides, not company size.

What an SME that deploys AI should do first

Two duties already apply and need no further waiting. The first is to stay clear of the prohibited practices, which are a short list of uses the Act bans outright. The second is AI literacy: the Commission's timeline lists it among the obligations that have applied since 2 February 2025. The practical reading is modest. People who operate or supervise AI tools should understand what the tools can and cannot do, what data they should and should not receive, and when to escalate. A short internal briefing, written down and repeated when tools change, is a defensible starting point. The exact wording of the obligation and its current form after the AI Omnibus is a point to confirm with a legal adviser.

Transparency from August 2026

Since 2 August 2026 the transparency rules apply. The Commission describes them as requiring that AI-generated content is identifiable and that certain content, namely deep fakes and text published to inform the public on matters of public interest, is clearly labelled. For a deploying SME this matters when marketing, communications or customer-facing teams publish generated images, video, audio or text. Decide who checks that generated material is labelled before publication, and keep a note of the check. Customer chatbots also deserve a look: people should be able to tell that they are speaking to a machine.

High-risk systems: later, but not never

High-risk rules receive most attention and apply last. The Commission states that the rules for Annex III use cases, which cover certain sensitive areas, were extended to 2 December 2027, and that AI integrated into regulated products has an extended transition period until 2 August 2028. Extra time is a reason to prepare in an orderly way, not a reason to ignore the topic. If a planned use of AI could affect decisions about people, such as recruitment, creditworthiness or access to services, record it as a candidate now, so that its human oversight, logging and data-quality questions are part of the design instead of a later retrofit. Our article on AI governance for European SMEs describes a workable way to do this.

A practical sequence for the next quarter

The sequence below turns the dates into work that a small team can complete without a compliance department. Each step produces a short written record, which is also the evidence you would want to show a customer or an auditor.

1. List every AI tool and AI feature your staff use, including those built into existing software, and name an owner for each.
2. Check each use against the prohibited practices and note the result.
3. Run a short AI literacy briefing for the people who operate or supervise these tools, and record who attended.
4. Add a labelling check before anything AI-generated is published externally, and mark chatbots clearly as machines.
5. Mark uses that might touch decisions about people as high-risk candidates, and put the December 2027 date in the review calendar.
6. Review the list whenever a supplier changes a model or feature, and again at least once a year.

Keep the dates under review

The Act has already been amended once in a way that moved dates, and the Commission's pages are updated as secondary rules and guidance appear. Treat any timeline, including this one, as a snapshot: this article was last reviewed on 13 October 2026. Before relying on a date for a contractual or compliance decision, read the current text of the Regulation and the amending act, and ask a lawyer to confirm how it applies to your specific use.