The EU AI Act 2026 for SMEs does not require the same compliance program for every company; duties depend on role, purpose, and risk. Starting August 2, 2026, enforcement expands around transparency, AI literacy, and existing prohibitions. Delayed high-risk deadlines provide preparation time, not a general exemption from operational responsibility.
Legal status: July 25, 2026. This article provides operational guidance and does not replace legal advice for a specific case.
Why does August 2, 2026 matter for mid-sized companies?
The EU AI Act has been in force since 2024 and applies through several implementation stages. Some requirements already took effect earlier. Prohibited AI practices and AI literacy requirements have applied since February 2025, while obligations for providers of general-purpose AI models began applying in August 2025.
August 2, 2026 marks the next major operational phase. Article 50 transparency requirements begin to apply, and enforcement expands for applicable provisions concerning prohibited practices, AI literacy, transparency, and general-purpose AI.
This does not mean that every AI tool used by a small or mid-sized company suddenly requires certification, registration, or a large compliance department. It does mean that AI use can no longer be treated solely as an informal productivity experiment.
A company using writing assistants, AI telephony, customer chatbots, translation features, image generators, recruiting software, or automated scoring should be able to identify the system, its business purpose, the data it processes, the people responsible for reviewing outputs, and any notice that customers or employees must receive.
Use AI with clear rules and responsibilities
KrambergAI helps companies establish practical AI compliance structures for internal rules, data handling, approvals, responsibilities and responsible use in daily work.
Structured guidance · Responsible implementation · Made in Germany
Which requirements actually apply in 2026?
The most useful starting point is not to create every document that might eventually be needed for a high-risk system. Companies should first implement the requirements that already apply to their current systems and roles.
AI literacy is one of those requirements. Employees and other people operating AI systems on behalf of the company need knowledge appropriate to their responsibilities. They should understand how the system is used, what information may be entered, where the system can fail, how outputs must be checked, and when a matter must be escalated.
Companies must also exclude prohibited practices. In a workplace context, AI-based emotion recognition may be prohibited unless a limited statutory exception applies. Other prohibited uses include certain manipulative techniques, specific social-scoring practices, and applications that create unacceptable risks to fundamental rights.
Transparency becomes especially relevant in August 2026. People interacting with certain AI systems must be informed that they are dealing with AI. Deepfakes and certain AI-generated public-interest content are subject to additional disclosure requirements.
The transition period through December 2026 is narrow. It applies to technical marking and detection obligations for certain systems already placed on the market before August. It is not a blanket delay for chatbot notices, deepfake disclosures, AI literacy, or operational governance.
Which high-risk deadlines were postponed?
The Digital Omnibus adopted in 2026 moved the application dates for the most extensive high-risk AI requirements.
Requirements for stand-alone high-risk systems listed in Annex III are now scheduled to apply on December 2, 2027. Depending on their function, this category can include systems used in employment, education, biometric identification, critical infrastructure, credit assessment, and other sensitive areas.
High-risk AI embedded in regulated products will generally move to the later date of August 2, 2028. Potential examples include AI components in certain medical devices, lifts, toys, and other products governed by European product legislation. Classification depends on the product rules, the safety function, and the role of the AI component.
These postponements do not suspend the rest of the AI Act. Requirements concerning transparency, AI literacy, prohibited practices, and other applicable provisions remain relevant. Companies should use the additional time to assess systems, improve supplier documentation, negotiate contractual support, and design controls that can later support high-risk compliance.
Why does a company’s role matter more than its size?
The AI Act distributes responsibilities across the AI value chain. Company size may affect proportionality and access to support, but it does not determine the legal role by itself.
A business is often a deployer when it uses an off-the-shelf AI system under its own authority. A technical service company using an AI assistant to prepare field reports is usually operating the system as a deployer. The same applies to a contractor using an AI telephone assistant to collect service requests.
A company may become a provider when it develops or commissions an AI system and places it into service or supplies it under its own name. Significant modifications or repurposing a system for a new sensitive use may also change the role.
This distinction is often missed during procurement. The software contract may describe the company as a customer, but the AI Act examines the actual system, purpose, and operating responsibility. A contract label such as customer, reseller, integration partner, or platform user does not settle the regulatory classification.
How do common business AI applications compare?
The following table provides an initial operational view. It does not replace a case-specific assessment, but it illustrates why companies need different approval paths for different use cases.
| Common use case | Possible classification | Main 2026 concern | Appropriate operating control |
|---|---|---|---|
| Writing assistant for emails, proposals, and summaries | Usually limited risk | AI literacy, privacy, intellectual property, output review | Approved enterprise account, data rules, subject-matter review |
| Customer chatbot or AI telephone assistant | Transparency obligations may apply | AI notice at the first interaction and effective human handoff | Opening notice, escalation path, logging, quality review |
| Automated applicant scoring or ranking | May qualify as high-risk AI | Early classification and preparation for later high-risk duties | Human decision authority, documented criteria, stakeholder review |
| AI supporting maintenance or safety recommendations | Depends on effect and product context | Professional responsibility, operating limits, possible product rules | Approval by a qualified person, test scenarios, incident process |
| Publicly distributed synthetic images, audio, or video | Transparency requirements may apply | Disclosure for deepfakes and certain manipulated media | Editorial approval, provenance records, publication rules |
| Internal knowledge assistant using company documents | Commonly a deployer scenario | Permissions, confidentiality, source quality, access boundaries | Role-based access, source references, retention and deletion controls |
The same underlying model can support both a low-impact writing task and a consequential employment decision. The technology alone does not determine the risk category. The purpose, data, affected people, degree of automation, and actual use of the output matter.
How widely is AI already used in Germany’s mid-sized economy?
A recent German mid-market analysis reported AI use among 20 percent of the companies in its study period. Among mid-sized companies with at least 50 employees, the measured share reached 36 percent. Adoption is therefore already material, although it varies substantially by company size, innovation activity, sector, and digital maturity.
A separate representative business survey found a significant organizational gap. At the time of the survey, 43 percent of companies did not yet offer AI training. Among respondents that considered themselves affected by the AI Act, 93 percent expected the implementation effort to be high or very high.
The studies use different company definitions, samples, and measurement periods and should not be combined into a single adoption estimate. Their shared operational message is still important: AI usage is expanding faster than training, assigned ownership, and internal controls.
What does AI literacy mean in daily operations?
AI literacy does not require every employee to become an AI engineer. It requires knowledge and skills appropriate to the person’s role, the system being used, and the consequences of possible errors.
A salesperson preparing a proposal with an AI writing tool should understand which customer information may be submitted, how fabricated claims can appear, and when technical or commercial review is required. An administrator also needs knowledge of permissions, connected repositories, configuration, logs, and system updates.
Employees working in human resources, dispatch, customer service, or technical operations need additional instruction because AI outputs can influence people, deadlines, safety measures, and resource allocation. They must know when an output can be accepted, when it must be corrected, and when a qualified decision-maker must take over.
Official guidance does not require a particular certificate or a standard training duration. Internal records of participants, roles, topics, and training dates are still useful. Depending on the use case, asking employees to read the vendor manual may not be sufficient.
What applies to chatbots and AI telephony in August 2026?
People interacting with an AI system generally need to be informed that they are communicating with AI unless that fact is already obvious from the circumstances. The notice must be provided no later than the first interaction.
For a mid-sized company, this may apply to a website chatbot, automated voice assistant, AI receptionist, or customer-service agent. A disclosure located only in a privacy policy is disconnected from the point of interaction. The notice should appear or be spoken when the conversation begins.
The company also needs an effective human handoff. A caller with a complex, sensitive, contractual, or safety-related request must be able to reach an employee. An AI assistant used by a heating contractor, electrical service provider, traffic-safety company, or industrial maintenance business should not present an automated response as a binding professional determination when qualified human approval is required.
Recording, transcription, and processing of personal data require separate analysis. Satisfying an AI Act notice requirement does not automatically satisfy the GDPR, employment law, telecommunications rules, or contractual obligations.
Does every AI-generated document require a label?
No. The AI Act does not create a universal label for every business document that involved AI.
Specific disclosure requirements apply to deepfakes and to AI-generated or manipulated text published for the purpose of informing the public about matters of public interest. An exception may apply where the content has undergone human review or editorial control and a person or organization assumes editorial responsibility.
Routine business correspondence, internal summaries, proposal drafts, and language editing therefore require a more specific assessment. Disclosure may still be required by a contract, customer policy, industry code, online platform, or internal publication standard even when the AI Act does not impose a label.
How can companies integrate the AI Act into existing management processes?
Most mid-sized businesses do not need a separate organization operating alongside quality management, privacy, information security, procurement, and internal controls. AI-specific checks can be inserted into existing processes.
Supplier assessments can include questions about models, data use, subprocessors, technical logs, security controls, and notice of material changes. Identity and access management can define which employees may use particular AI features and which repositories those features may access.
Training management can document role-based instruction. Quality management can maintain test cases, sampling procedures, output checks, and error analyses. Incident management can include AI-specific triggers such as fabricated information, unauthorized disclosure, discriminatory outputs, or uncontrolled automated actions.
Existing risk registers can also be extended. The underlying business risk may still be an incorrect quote, privacy breach, unsafe service recommendation, disclosure of confidential information, or failure of a cloud platform. AI changes the source and speed of the risk, but companies can often use the controls they already know.
How should AI procurement change in 2026?
AI supplier assessment should begin before contract signature. A data-processing agreement and general security statements do not explain how a particular AI feature will operate in the company’s process.
Procurement needs a description of the intended use case, users, data categories, connected systems, affected people, review points, and level of automation. Without that information, the company cannot determine whether the product is suitable or which contractual commitments it needs.
Contracts should address material changes. AI vendors may replace models, add functions, change subprocessors, or alter data handling during the term. The customer should know which changes trigger advance notice, a new assessment, or renewed approval.
The company also needs an exit process. Data must be exportable or deletable, user access must be removable, automated actions must be stoppable, and business processes must continue during a transition. These capabilities matter during security incidents, supplier changes, service failures, and disputed model updates.
What usually goes wrong during implementation?
One recurring failure is writing an extensive policy before identifying the actual systems in use. The company debates language but cannot identify all AI tools, business purposes, users, or data flows.
Another failure is providing the same generic training to every employee. A broad introduction may be useful, but it does not replace application-specific instructions for sales, human resources, administrators, field service, or technical decision-makers.
Some companies prohibit all external AI tools without offering approved alternatives. This often produces shadow AI. Employees use personal accounts, transfer content between systems, and bypass official workflows.
Other businesses assume that the software vendor carries all responsibility. The supplier does not control the customer’s permissions, internal data quality, business rules, contractual commitments, or use of outputs.
A final mistake is postponing all work until 2027 or 2028. The delayed high-risk dates are treated as a general pause even though transparency, literacy, privacy, security, and operational responsibility require attention earlier.
What does a realistic 2026 implementation program look like?
A practical program starts with an inventory. The company records officially purchased products, AI features embedded in existing software, custom applications, and identifiable shadow use. Each entry should include purpose, users, data, connected systems, owner, and output use.
The second stage prioritizes systems with customer interaction, personal data, automated actions, employment relevance, financial impact, or safety implications. A simple writing assistant can follow a lighter approval path than an application that ranks applicants or initiates customer transactions.
The third stage implements immediate minimum controls: approved tools, data rules, assigned ownership, transparency notices, human review points, escalation routes, and role-based instruction.
Procurement and change management are then updated. New AI functionality introduced through a software update should not automatically become approved for operational use.
Management receives a compact status report covering identified systems, approved applications, unresolved assessments, completed training, material incidents, and decisions requiring executive authorization. This turns the program into a business process rather than a one-time documentation exercise.
Why should potential high-risk systems be assessed now?
High-risk documentation and controls cannot be produced effectively in a few weeks. Risk management, data governance, technical documentation, logging, human oversight, monitoring, and incident procedures must reflect the real system.
Companies using AI in employment, credit assessment, regulated products, or safety-related operations should examine which functions materially influence decisions. Not every automation in a sensitive area is automatically high-risk. Conversely, a tool described as advisory may have a substantial effect when employees rarely challenge its recommendation.
Early assessment also improves supplier negotiations. Missing logs, insufficient documentation, weak change notifications, or inadequate interfaces are easier to address before procurement and integration than after the system has become operationally dependent.
How is Germany organizing AI Act supervision?
Germany adopted its national implementation framework in 2026. The Federal Network Agency, Bundesnetzagentur (https://www.bundesnetzagentur.de/EN/Areas/Digitalisation/AI/start_ki.html), is assigned a central market-surveillance and coordination role, while other specialized authorities remain involved in relevant regulated sectors.
The substantive obligations continue to arise primarily from the directly applicable EU AI Act. Germany’s implementation legislation mainly addresses national responsibilities, cooperation, supervision, and administrative procedures.
The Federal Network Agency already provides an AI Service Desk and compliance resources. Its published information supports business preparation, while binding interpretation remains with competent authorities and courts in individual proceedings.
How can compliance become a usable operating model?
An effective operating model does more than prohibit risky behavior. It gives business units an approved path for adopting useful AI applications.
When approved tools, data categories, review points, responsibilities, and escalation routes are established, teams do not need to reopen the same policy discussion for every pilot. A reviewed use case can be extended to another department or location with less duplication.
This also supports customer and supplier relationships. Business partners increasingly ask whether AI is involved in proposals, documentation, support, service delivery, or decision support. A company with an inventory, assigned owners, training records, supplier documentation, and operating controls can respond with evidence.
KrambergAI GmbH (https://krambergai.com/) helps German mid-sized companies identify existing AI applications, prioritize obligations by use and risk, and build an operating model that fits real workflows. Typical areas include management, sales, customer service, technical operations, documentation, and internal knowledge systems.
Sources for the statistics used
KfW Research – AI use is concentrated among companies with strong innovation and digital activity
https://www.kfw.de/PDF/Download-Center/Konzernthemen/Research/PDF-Dokumente-Fokus-Volkswirtschaft/Fokus-2026/Fokus-Nr.-533-Februar-2026-KI-Mittelstand.pdf
Bitkom – Artificial Intelligence in Germany: Perspectives from businesses and the public
https://www.bitkom.org/sites/main/files/2026-02/bitkom-studienbericht-ki.pdf
Further reading
EU AI Act Service Desk – Official EU AI Act implementation timeline
https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
Federal Network Agency – AI Service Desk for Germany
https://www.bundesnetzagentur.de/EN/Areas/Digitalisation/AI/start_ki.html
European Commission – Questions and answers on Article 50 transparency obligations
https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act
Frequently asked questions
Does the EU AI Act apply to every mid-sized company?
The EU AI Act does not apply in the same way to every company. Duties depend on the system, business purpose, company role, and potential impact. Even routine business use of a general AI assistant may still require employee instruction, privacy review, approved data practices, and internal responsibility for how outputs are used.
What should an SME have completed by August 2, 2026?
An SME should have identified its AI applications, assigned owners, prepared relevant transparency notices, and provided appropriate instruction to users. Prohibited use cases must be excluded. For sensitive or potentially high-risk systems, the company should at least maintain a documented initial classification, unresolved issues, responsible functions, and a plan for further assessment.
Does every company need an AI officer?
The AI Act does not generally require a formally appointed AI officer. A company still needs an accountable coordination role. This responsibility may sit with management, IT, compliance, privacy, information security, or quality management. The responsible person needs sufficient authority, access to business units, and the ability to initiate assessments, approvals, and escalation.
Is a written AI policy sufficient?
An AI policy is only one component. Companies also need an inventory, approval process, role-based training, supplier assessment, and operational controls. The policy should be connected to approved tools and workable business procedures. Without practical alternatives, employees may move to personal accounts or unapproved systems and create unmanaged shadow AI.
Must every company train its employees?
Providers and deployers must take measures to support an appropriate level of AI literacy among people operating AI systems on their behalf. Training should reflect the system, user role, and potential consequences. A writing-tool user needs different instruction from an administrator or human-resources employee using AI output in applicant-related decisions.
Must a chatbot always identify itself as AI?
Users of an interactive AI system generally must be informed about the AI interaction no later than the first contact unless it is already obvious. For a website chatbot or AI telephone assistant, the notice should appear or be spoken when the conversation begins. The company should also maintain an accessible handoff to a human employee.
Does every AI-generated text require disclosure?
There is no universal disclosure requirement for every business text supported by AI. Specific rules apply to certain text published to inform the public about matters of public interest. Human editorial review and accepted editorial responsibility may support an exception. Contracts, industry standards, customers, and platforms may impose additional requirements beyond the AI Act.
Is every AI feature in recruiting automatically high-risk?
Not every AI function used in human resources is automatically high-risk. The assessment depends on whether the system recruits, ranks, evaluates, or materially influences employment decisions or working conditions. Narrow administrative or procedural functions may receive different treatment. The company should document the actual workflow, human authority, and practical influence of the output.
Is the software vendor solely responsible for compliance?
No. The vendor carries obligations associated with its product and legal role, but the customer remains responsible for users, permissions, connected data, deployment purpose, and human review. Even when using a major cloud provider, the deploying company must determine which information may be processed and how AI output affects business decisions.
What records should an SME maintain?
A practical minimum includes an AI system inventory, use-case classification, assigned owners, data and usage rules, training records, and documented approvals. More consequential applications may also require supplier documentation, test results, quality checks, change records, and incident reports. Documentation should be proportionate to the system’s actual business and human impact.
Does AI Act compliance replace a GDPR assessment?
No. The AI Act and the GDPR address different but overlapping risks. A properly disclosed AI system may still process personal data unlawfully. Companies must separately assess legal basis, purpose limitation, data minimization, privacy notices, processor arrangements, retention periods, international transfers, and whether a data protection impact assessment is required.
Should companies wait until 2027 because high-risk rules were postponed?
Waiting entirely would create unnecessary exposure. The postponement primarily affects the extensive high-risk requirements. AI literacy, prohibited practices, transparency, privacy, information security, and operational responsibility matter earlier. Potential high-risk systems also need advance preparation, particularly when compliance depends on technical documentation, supplier cooperation, logging, or changes to the product architecture.
