By Thaddée Leblond · Published · Updated: July 2026
For most SMEs, AI falls under limited risk: an office assistant or a chatbot only triggers a transparency obligation, not the heavy high-risk regime. But one obligation has been active since February 2025: training your teams to use AI competently. The right tool to get organised is not technical — it is an internal AI policy: a few clear rules on uses, data and human validation.
What the AI Act really requires of an SME
The AI Act (Regulation (EU) 2024/1689) applies in phases. Prohibited practices have applied since February 2025; obligations on general-purpose models since August 2025; and most obligations — high-risk systems, transparency — apply from 2 August 2026 (with some high-risk deadlines adjusted by the Digital Omnibus package). The first thing to retain: most SME uses are not high-risk. A reception chatbot or a drafting assistant falls under limited risk, subject only to informing users that they are interacting with an AI.
The obligation many overlook: training your teams
Since February 2025, the AI literacy obligation has been active: any organisation using AI must ensure its users have a sufficient level of competence. This is the most immediate obligation for an SME — and the simplest to start with.
The real daily risk: data
Beyond the AI Act, the most concrete risk is data protection. Pasting customers' personal data, confidential information or strategic material into a consumer AI tool, without a framework, exposes the company. The golden rule: never entrust to an external AI what you would not put in an unsecured email.
The internal AI policy: the governance tool
Rather than a technical investment, start with a short, operational document. An effective AI policy maps authorised and prohibited uses, sets rules on sensitive data, requires human validation on high-stakes content, and organises team training. It is quick to implement and covers most of an SME's real risk.
The right sequence
Map your AI uses, qualify their risk level (as you did for data protection), write a policy, train your teams. A gradual, pragmatic approach that turns a moving regulatory constraint into a framework of trust — for your teams and your customers alike.
The AI Act's timeline and scope are evolving, notably via the Digital Omnibus package. Verify the obligations applicable to your situation against official sources.
Frequently asked questions
As soon as an employee uses an AI tool, yes — at least through the AI literacy obligation (training your teams), active since February 2025. But most SME use cases fall under limited risk: a chatbot or office assistant only triggers a transparency obligation, not the heavy high-risk regime.
No specific obligation for internal office use: the model provider carries the general-purpose AI obligations. However, data protection law applies: pasting customers' personal data into a prompt without a legal basis remains prohibited.
2 August 2026 activates most obligations, notably for high-risk systems and transparency. Some high-risk deadlines have been adjusted by the Digital Omnibus package, distinct from the Omnibus I directive on sustainability. Penalties can reach €35M or 7% of turnover, capped for smaller companies.
A short document that maps authorised uses, sets rules on sensitive data, requires human validation and organises training. It is the most effective governance tool for an SME, well before any technical investment.
Sources
- Regulation (EU) 2024/1689 — AI Act
- European Commission — Digital Omnibus package