What should a small company do about the EU AI Act? A checklist

Two parts of the EU AI Act already bind every company that provides or uses an AI system: the banned practices in Article 5 and the AI literacy duty in Article 4. Everything else is decided system by system: list your AI systems, record whether you are the provider or the deployer of each, and check whether it is high-risk under Article 6.

Written and last checked 9 October 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Which duties bind every company already?

Every point of Article 5(1) bans the use of the AI system it describes, so a company that only uses one is caught; for points (ba) and (bb), only where it uses the system for the purpose of generating or manipulating that material (Article 5(1a), point (b), as inserted). The original eight points have applied since 2 February 2025 under Article 113, third paragraph, point (a). Points (ba) and (bb), inserted by Regulation (EU) 2026/1744, apply from 2 December 2026 with Article 5(1a) and (1b) (Article 113, third paragraph, point (a), as replaced). The ten practices in Article 5 are each set out.

Article 4(1), as replaced, requires providers and deployers to "take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used". It "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". As part of Chapter I, Article 4 has applied since 2 February 2025 (Article 113, third paragraph, point (a)); the wording quoted here has applied since Regulation (EU) 2026/1744 entered into force on 27 July 2026, and replaced a duty to "take measures to ensure, to their best extent, a sufficient level of AI literacy".

Neither has a size threshold, and Article 4 no risk qualifier: the AI literacy duty reaches a company whose systems are all minimal risk.

How do you sort your AI systems?

List every AI system you build or use, including those in tools you buy: role, risk level and dates attach to each system.

Under Article 3, a provider is one "that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge" (point (3)). A deployer is one "using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity" (point (4)). Using ChatGPT at work meets that test, and Article 25(1) lists when a deployer becomes the provider of a high-risk system.

Article 6(1) makes a system high-risk where "the AI system is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I" and that product must undergo a third-party conformity assessment; Article 6(1a), (1b) and (1c), inserted in 2026, refine both conditions. Article 6(2) adds the systems referred to in Annex III.

Under Article 6(3), "an AI system referred to in Annex III shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making", if one of four conditions is fulfilled. But "an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons". A provider relying on Article 6(3) "shall document its assessment before that system is placed on the market or put into service", registers under Article 49(2) and provides the documentation to national competent authorities on request (Article 6(4)). The decision tree walks the routes.

Which duties have applied since 2 August 2026 under Article 113?

Article 50, in Chapter IV, takes the general date of 2 August 2026 in Article 113, second paragraph, with one exception: a provider whose system generating synthetic content was placed on the market before 2 August 2026 has until 2 December 2026 to comply with Article 50(2) (Article 111(4), as added). Providers make sure people are told when they interact directly with an AI system (Article 50(1)), and mark synthetic audio, image, video or text "in a machine-readable format and detectable as artificially generated or manipulated" (Article 50(2)). Deployers inform people exposed to emotion recognition or biometric categorisation and process their personal data under Union data protection law (Article 50(3)), and disclose deep fakes and AI-generated or manipulated text published to inform the public on matters of public interest (Article 50(4)).

Each paragraph sets its own exceptions, such as an obvious AI in paragraph 1 or reviewed text under editorial responsibility in paragraph 4: the four Article 50 disclosures sets them out.

What changes if a system is high-risk?

Article 113, third paragraph, point (c), as replaced, applies "Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5)", which hold Articles 6 to 27, from "2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III" and from "2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I". Section 5 is not deferred, so conformity assessment under Article 43 and registration under Article 49 keep 2 August 2026. How Section 5 operates before Section 1 applies, the amending regulation does not say.

The provider then owes Article 16's twelve points, among them a quality management system, the conformity assessment and registration; the deployer owes Article 26, among them following the instructions for use, human oversight and the logs. A deployer that is a body governed by public law or a private entity providing public services, or that deploys a system under point 5(b) or (c) of Annex III, also assesses the impact on fundamental rights before deploying a system referred to in Article 6(2), outside point 2 of Annex III (Article 27(1)).

For a high-risk system placed on the market or put into service before then, other than the large-scale IT systems of Article 111(1), the Regulation applies to its operators "only if, as from that date, those systems are subject to significant changes in their designs" (Article 111(2), as replaced). Article 5 applies regardless, and the providers and deployers of those intended to be used by public authorities comply by 2 August 2030. Which of Article 113's two dates the paragraph means is open.

What does the Act ease for a small company?

Article 3, points (14a) and (14b), as inserted, define an SME by "Article 2 of the Annex to Recommendation 2003/361/EC" and an SMC by "point (2) of the Annex to Recommendation (EU) 2025/1099". The Act restates neither threshold, and neither Recommendation is in our pinned sources.

• Technical documentation: "SMEs, including start-ups, and SMCs, may provide the elements of the technical documentation specified in Annex IV in a simplified manner", on a Commission form that they must then use and that notified bodies shall accept (Article 11(1), second subparagraph, as replaced). The form is not in our pinned sources.
• Quality management: proportionate to the size of the provider's organisation, "in particular, if the provider is an SME, including a start-up, or an SMC", with the rigour and level of protection compliance requires (Article 17(2), as replaced). SMEs "may comply with certain elements of the quality management system required by Article 17 in a simplified manner, provided that they do not have partner enterprises or linked enterprises within the meaning of Recommendation 2003/361/EC", under Commission guidelines this guide has not checked for (Article 63(1), as replaced). That exempts them from no other requirement or obligation (Article 63(2)).
• Fees: conformity assessment fees for SME providers are reduced in proportion to their size, market size and other relevant indicators (Article 62(2)).
• Fines: for SMEs, "each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower" (Article 99(6)); for SMCs, the same holds for paragraphs 4 and 5 (Article 99(6a), as inserted).

What does Complipath do here, and what does it not?

The AI inventory records each system you build or use, with its owners and risk class, and confirming a classification creates the obligations that follow, each with an owner, a status and the date it applies from. The step-by-step plan asks you to classify each system first, then lists the Article 4 and Article 5 steps as already applying; its quality management step is marked not in the app yet. The AI literacy register records who was trained on what, and when. What Complipath does today lists every live feature, and what software for a small company should do has its own page.

What this means for you

If you're a provider: classify each system first: Article 16 attaches only to high-risk systems, Article 4 and Article 50(1) and (2) whatever the risk level.

If you're a deployer: ask each vendor for its classification and, for a high-risk system, the instructions for use Article 26(1) makes you follow. Article 50(3) and (4) apply now where they reach you; Article 26, and Article 27 where Article 27(1) names you, from 2 December 2027 for Annex III systems; Article 26 from 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as replaced).

FAQ

Does the EU AI Act apply to a small company? Yes. Articles 4, 5 and 50 have no size threshold, and the high-risk duties attach to the system, not to the company's size. An SME under Recommendation 2003/361/EC may simplify its technical documentation (Article 11(1)), and each of its fines is capped at the lower of the fixed amount and the turnover percentage (Article 99(6)).

Do we have to keep an AI inventory? No article requires one by that name. Every duty that follows is per system: Article 6 classifies systems, Article 26 binds the deployer of each high-risk system and Article 50 attaches to particular kinds of system. A list with each system's role and risk level is where those duties start.

When do the high-risk duties start? On 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as replaced). Conformity assessment and registration, Articles 43 and 49, sit in Section 5, which keeps 2 August 2026 under Article 113, second paragraph; how it operates before the classification rules apply, the text does not say.

What can an SME be fined? The lower of the amount and the percentage of total worldwide annual turnover for the preceding financial year (Article 99(6)): EUR 35 000 000 or 7 % for Article 5 breaches, EUR 15 000 000 or 3 % for Article 99(4), EUR 7 500 000 or 1 % for incorrect, incomplete or misleading information to notified bodies or national competent authorities on request.

Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 3, points (3) and (4), Article 4, Article 5, Article 6, Article 11(1), Article 16, Article 17(2), Article 25(1), Article 26, Article 43, Article 49, Article 50, Article 62, Article 63, Article 99, Article 111, Article 113, Annex I and Annex III; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which inserted Article 3, points (14a) and (14b), Article 5(1), first subparagraph, points (ba) and (bb), Article 5(1a) and (1b), Article 6(1a), (1b) and (1c), Article 99(6a) and Article 99(4), point (da); it added Article 111(4) and replaced Article 4, Article 11(1), second subparagraph, Article 17(2), Article 63(1), Article 99(1), Article 111(2) and Article 113, third paragraph, points (a) and (c).

Where this question meets the product: EU AI Act compliance software for SMEs. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire. The feature that does this in the app: EU AI Act plan, step by step. Tools ranked on it: EU AI Act compliance software for SMEs. Everything else: every live Complipath feature.