If you are running a small or medium-sized enterprise in the EU, you might think the AI Act is only for Big Tech. It is not. Any company that deploys or develops AI systems operating within the EU falls under the regulation — and that includes the SaaS tools, chatbots, and predictive models that most modern SMEs rely on daily.
The good news: the EU AI Act includes specific provisions designed to make compliance more accessible for SMEs, including reduced fees, simplified processes, and access to regulatory sandboxes. This checklist gives you a structured, priority-ordered path to compliance — so you know exactly what to do and when.
Who Needs This Checklist?
The EU AI Act applies to you if your company:
- Develops AI systems that are placed on the EU market or used in the EU
- Deploys AI systems within the EU (even if the AI was built by a third party)
- Imports AI systems into the EU market
- Distributes AI systems to EU users
This means if you use AI-powered tools from providers like HubSpot, Salesforce, or any platform with predictive analytics, automated scoring, or chatbot features — you are a deployer under the Act and have specific obligations. If you are unsure, start with our free risk classifier to assess each of your AI systems.
Phase 1: Pre-Compliance Foundation (Start Now)
These are the steps every SME should complete immediately, regardless of risk level:
Complete AI Systems Inventory
List every AI tool and service across your organization. Include third-party SaaS tools with embedded AI features (CRM scoring, chatbots, automated email tools, HR screening, fraud detection). Most SMEs are surprised to find they use 5-15 AI systems they were not aware of.
Classify Each System by Risk Level
Map each AI system to the four-tier risk framework: Unacceptable, High, Limited, or Minimal. Remember: classification is based on use case, not technology. Use our free risk classifier to automate this step.
Conduct Gap Analysis
For each AI system, identify the gap between your current practices and the AI Act requirements for that risk tier. This reveals your compliance workload and helps you prioritize.
Designate an AI Compliance Lead
Appoint someone in your organization to own AI Act compliance. This does not need to be a full-time role — in many SMEs it can be an addition to an existing compliance, legal, or IT leadership role.
Phase 2: High-Risk System Compliance
If any of your AI systems are classified as high risk (per Annex III of the AI Act), you must implement all of the following measures before August 2026:
Risk Management System (Article 9)
Establish an ongoing, iterative process to identify and mitigate risks throughout the AI system's lifecycle. This must be documented and regularly updated.
Data Governance (Article 10)
Ensure training, validation, and testing data is relevant, representative, free of errors, and complete. Implement data quality criteria and bias detection procedures.
Technical Documentation (Article 11)
Produce comprehensive technical documentation covering system design, development process, capabilities, limitations, and intended purpose. Maintain this documentation before the system is placed on the market.
Record-Keeping / Logging (Article 12)
Implement automatic logging of events during operation. Logs must be retained for a period appropriate to the intended purpose and at least 6 months.
Transparency and User Information (Article 13)
Provide clear instructions for use, including system capabilities, limitations, intended purpose, and information about accuracy, robustness, and cybersecurity measures.
Human Oversight (Article 14)
Design systems so humans can effectively oversee operation. Implement mechanisms for human intervention, including the ability to override or stop the system.
Accuracy, Robustness, and Cybersecurity (Article 15)
Ensure consistent performance, resilience against errors and adversarial attacks, and appropriate cybersecurity measures throughout the system's lifecycle.
Conformity Assessment (Article 43)
Before placing the system on the market, complete a conformity assessment. For most high-risk systems, this can be done through internal assessment; certain biometric systems require third-party assessment.
EU Database Registration (Article 49)
Register the high-risk AI system in the EU public database before it is placed on the market or put into service.
Phase 3: Limited-Risk Compliance
If your AI systems are classified as limited risk, your obligations are lighter but still mandatory:
AI Disclosure for Chatbots and Virtual Assistants
Under Article 50(1), users must be informed that they are interacting with an AI system. Add a clear notice at the start of any chatbot or virtual assistant interaction: "You are chatting with an AI assistant."
AI-Generated Content Labeling
Under Article 50(2), AI-generated or manipulated content (text, audio, image, video) must be labeled as such. If your marketing team uses AI to generate content, it must be disclosed.
Deepfake Disclosure
Under Article 50(4), synthetic media that depicts real people or events must be clearly labeled. This includes AI-generated images, voice cloning, and video manipulations.
Document Your Transparency Measures
Keep records of how and where you disclose AI usage. This serves as your compliance evidence if audited.
Timeline: What to Do When
Here is your prioritization roadmap based on the enforcement timeline:
- Already in effect: All prohibited AI practices are banned since February 2025. If you operate any banned systems, discontinue them immediately.
- Now - Q2 2026: Complete your AI inventory, risk classification, and gap analysis. Begin high-risk compliance work. This is your preparation window.
- August 2026: Full enforcement for high-risk AI systems. All compliance measures must be in place. Fines can be imposed from this date.
- August 2027: Remaining provisions take effect, including rules for AI systems embedded in regulated products (medical devices, vehicles, etc.).
Important for SMEs: Do not wait until August 2026. Compliance takes 6-12 months for high-risk systems. If you start now, you have adequate time. If you wait until mid-2026, you will likely miss the deadline.
SME-Specific Advantages Under the AI Act
The EU AI Act includes several provisions specifically designed to support SMEs. Take advantage of these:
Reduced Conformity Assessment Fees
Article 43 mandates that notified bodies must apply reduced fees for SMEs, including startups and micro-enterprises, proportionate to their size and specific interests.
Simplified Documentation
The European Commission will provide simplified technical documentation templates tailored to SME needs. These are expected before the August 2026 deadline.
Regulatory Sandboxes
Under Articles 57-58, EU member states must establish AI regulatory sandboxes. SMEs get priority access to these sandboxes, where you can test your AI systems in a controlled regulatory environment — for free.
Proportionate Penalties
While maximum fines can reach 35 million EUR, penalties for SMEs are calculated as a percentage of turnover, and caps are adjusted proportionally for smaller enterprises.
For a comprehensive walkthrough of all compliance requirements, read our full AI Act compliance guide.
Start Your Compliance Journey Today
Begin with a free risk assessment to understand which of your AI systems need attention. Our diagnostic consultation starts from EUR 200 — a fraction of the cost of non-compliance penalties.
Ready to remove manual work?
Tell us which workflow slows the team down. We will map the automation path and the ROI case.
Book a Strategy CallAlso Read
- AROG AI at Infoshare 2026 in Gdansk: What We Took from the Innovation Stage
- AI Agent Readiness Assessment: A 2026 Scoring Framework for Business Processes
- EU AI Act Article 50 for Chatbots and AI Assistants: 2026 Transparency Checklist
- n8n Consultant: How to Scope, Hire, and Get Real ROI from Workflow Automation
- AI Automation Consulting: What It Includes, What It Costs, and How to Choose a Firm
- AI Automation ROI: How to Calculate and Prove Value to Your Board
- EU AI Act August 2026: Your 90-Day Compliance Action Plan
- The Complete Guide to Business Process Automation with AI
- AI Agents vs Traditional RPA: Which Automation Approach Fits Your Business?
- 5 Free AI Tools to Assess Your Business Automation Potential
- How to Classify Your AI System Under the EU AI Act
- How Much Does AI Act Compliance Cost?
- EU AI Act 2025: What Every Business Needs to Know
- 5 Business Processes You Should Automate With AI Today
- AI Audit vs AI Consultation: Which Does Your Business Need?
