The EU AI Act: what an SME really has to do, and when.

The EU AI Act (Regulation (EU) 2024/1689) allocates obligations by role: the provider builds or markets an AI system, the deployer uses it in its business.

An SME that uses generative-AI assistants, the AI features of its software or an engine installed by a provider is a deployer: its obligations are real, but nowhere near those of a model maker.

So the first step is not legal, it is factual: knowing what is already running in your business, on which accounts, with which data. That is the purpose of the AI-usage register.

First block, since 2 February 2025: AI-literacy measures. Article 4 requires, from every company whose teams use these tools, measures suited to its uses, and the ability to demonstrate them. The text does not speak of mandatory training or a qualification: it asks for measures, demonstrable ones.

Second block, from 2 August 2026: transparency. A company that exposes a conversational agent or AI-generated content to the public must flag it as such. A minority of SMEs is concerned, and an inventory establishes whether you are one of them.

Third block, permanent: the prohibited practices, which target uses a management SME does not engage in (manipulation, social scoring, certain biometrics). Knowing them is usually enough to confirm you are clear of them.

The regulation applies in stages, from February 2025 to August 2027. The dates that concern an SME are past or near: literacy already applies, transparency arrives on 2 August 2026.

There is nothing to watch out for: every stage is dated, and the steps to take (register, policy, documented training) are the same whatever your situation.

Our method rests on public texts: the EU AI Act, the GDPR for personal data, the NIST AI Risk Management Framework for risk analysis, and the ISO/IEC 42001, 23894 and 42005 standards for AI system governance.

The wording is deliberately precise: our method is aligned with these frameworks, and every deliverable ties back to them so it can be verified by a lawyer or an auditor. We never write 'certified' without a certification obtained: that is our discipline, and it holds for this page too.

The first step is the AI-usage register: who uses what, on which accounts, with which data. The second is the usage policy, signed: it gives a written framework to what is permitted. The third is documented training: the record that demonstrates your literacy measures.

These three steps are exactly the deliverables of our four-week audit, and they are yours to keep, with or without a follow-up. Compliance is not a separate project: it happens through the same documents that bring order to your uses.

Sources: Regulation (EU) 2024/1689, Official Journal of the EU, 12 July 2024; entry into force on 1 August 2024; application in stages from February 2025 to August 2027.