The EU AI Act in 2027: What SMEs Must Comply With

The EU AI Act is no longer a future regulation. Its bans and AI literacy duty have applied since February 2025, the rules for general-purpose AI since August 2025 and most of the remaining rules since 2 August 2026. What many SMEs still need to plan for is 2027: on 2 December 2027 the obligations for high-risk AI systems in areas such as recruitment, credit scoring and education start to apply.

This guide reflects the law after the Digital Omnibus on AI, which was adopted in July 2026 and moved the high-risk dates. It separates what is already in force, what applies in 2027 and what is only proposed. Research checked: 10 November 2026. This is general information, not legal advice; confirm your own case with a lawyer or your data protection adviser.

The short answer

For most SMEs, the AI Act means four things today: do not use banned AI practices, take measures to build AI literacy among staff who use AI, make chatbots and AI-generated content transparent, and know which of your AI use cases could be high-risk. If you use AI to screen job applicants, evaluate employees, score creditworthiness or price life and health insurance, the full high-risk deployer duties apply from 2 December 2027. High-risk AI built into regulated products such as medical devices or toys follows on 2 August 2028, not 2027 as many older guides still say.

The current timeline (as of November 2026)

• 1 August 2024: the AI Act, Regulation (EU) 2024/1689, entered into force.
• 2 February 2025: the general provisions, including AI literacy, and the bans on prohibited AI practices apply.
• 2 August 2025: obligations for providers of general-purpose AI models apply, and Member States must have authorities and penalty rules in place.
• 2 August 2026: most remaining rules apply, including the transparency obligations in Article 50, and enforcement starts for general-purpose AI, prohibitions, transparency and AI literacy.
• 2 December 2026: two new prohibitions apply, and generative AI systems placed on the market before 2 August 2026 must have machine-readable marking of their outputs.
• 2 August 2027: providers of general-purpose AI models placed on the market before 2 August 2025 must comply, and each Member State should have at least one AI regulatory sandbox running.
• 2 December 2027: the rules for high-risk AI systems listed in Annex III apply, such as employment, education, credit scoring, essential services and biometrics.
• 2 August 2028: the rules for high-risk AI embedded in products covered by the EU product legislation in Annex I apply.

These dates follow the European Commission’s AI Act implementation timeline, which already includes the amendments made by the Digital Omnibus on AI.

What changed with the Digital Omnibus on AI

The Commission proposed the Digital Omnibus on AI on 19 November 2025, mainly because harmonised standards and national authorities were not ready for the original 2 August 2026 high-risk date. Parliament and Council reached agreement on 7 May 2026, the Council gave its final green light on 29 June 2026, and Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026. It entered into force on 27 July 2026, so the following changes are law:

• Fixed new dates for high-risk obligations: 2 December 2027 for stand-alone systems under Annex III and 2 August 2028 for systems embedded in products under Annex I.
• A reworded AI literacy duty: providers and deployers must take measures to support the AI literacy of their staff, but they do not have to guarantee a specific level for each person.
• Relief extended to small mid-cap enterprises (SMCs): SMEs, start-ups and SMCs may use simplified technical documentation for high-risk systems, and fines must take their economic viability into account.
• New bans from 2 December 2026 on AI that generates non-consensual intimate images of identifiable people or child sexual abuse material, and AI-enabled machinery moved to the sectoral Machinery Regulation.

One practical consequence: the date of 2 August 2027 for product-related high-risk AI, which appears in many articles written before mid-2026, no longer applies. That date is now 2 August 2028.

In force, coming in 2027, and only proposed

Already applies today

The prohibitions in Article 5, the AI literacy duty in Article 4, the obligations for general-purpose AI model providers, the transparency rules in Article 50 and the national supervision and penalty framework. If you have not looked at these yet, they are your first priority, because they are already enforceable.

Applies during 2027

On 2 August 2027 the transition ends for general-purpose AI models that were on the market before August 2025, which mainly concerns model providers, not their business users. On 2 December 2027 the high-risk rules for Annex III use cases apply to providers and deployers. Product-related high-risk AI under Annex I follows in August 2028.

Proposed, not adopted

A separate Digital Omnibus on data protection, privacy and cyber incident reporting is still in the legislative process: the Council agreed its negotiating position on 21 October 2026, Parliament has not yet adopted its own, so none of it is law. The Commission’s guidelines on classifying high-risk AI systems were published as a draft on 19 May 2026 and are still marked as draft at the time of writing. Do not plan on further delays to the AI Act; the high-risk dates are now fixed in the regulation itself.

Which rules actually matter for a typical SME

Most SMEs are deployers: they use AI systems built by others, such as ChatGPT, Microsoft Copilot, a website chatbot or AI features in their ERP. The AI Act distinguishes these roles, and the deployer’s duties are much lighter than the provider’s. Four questions cover most cases:

• Is any use banned? Article 5 prohibits, among others, emotion recognition at the workplace or in education (except for medical or safety reasons), manipulative techniques that cause significant harm, exploiting people’s vulnerabilities, social scoring and biometric categorisation that infers sensitive traits.
• Does it need transparency? People must be told when they are talking to an AI system unless this is obvious, which matters for every AI chatbot on a website. Deepfakes and AI-generated text published to inform the public on matters of public interest must be disclosed; for images, see our note on AI-generated images on websites and shops.
• Are staff prepared? Everyone who operates or uses AI on your behalf should receive training suited to their role and the context in which the AI is used.
• Could it be high-risk? Annex III includes AI used for recruitment and CV screening, decisions on promotion, termination or task allocation, monitoring and evaluating employees, creditworthiness checks, risk assessment and pricing in life and health insurance, education admissions and grading, biometrics and critical infrastructure.

If you use AI only for drafting, summarising, internal search, coding help or marketing ideas, your obligations are mainly AI literacy and, where content is published, transparency. That is the situation of most small businesses.

If you use high-risk AI from December 2027

Deployers of high-risk systems must meet the duties in Article 26. In practice this means:

• use the system according to the provider’s instructions for use, with appropriate technical and organisational measures;
• assign human oversight to people with the necessary competence, training and authority;
• ensure that input data under your control is relevant and sufficiently representative for the intended purpose;
• monitor the system, inform the provider and the market surveillance authority of risks or serious incidents, and suspend use where necessary;
• keep the automatically generated logs under your control for at least six months, unless other law requires otherwise;
• inform workers’ representatives and affected employees before using a high-risk system at the workplace, and inform people when a high-risk system is used to make or support decisions about them.

Public bodies, private companies providing public services, and deployers using AI for credit scoring or life and health insurance pricing must also carry out a fundamental rights impact assessment. High-risk systems already in use before 2 December 2027 are generally only covered if their design changes significantly after that date, but relying on this exemption is risky if you plan to update or switch tools.

When an SME becomes a provider

You take on provider obligations if you put your name or trademark on a high-risk system, substantially modify one, or change the intended purpose of an AI system so that it becomes high-risk. A typical example is building your own CV-ranking tool on top of a general-purpose model. Providers of high-risk systems need risk management, data governance, technical documentation, logging, human oversight, a quality management system, a conformity assessment and registration in the EU database. If you build on your own data, as described in how to build a private AI on your company data, decide early whether the use case is high-risk. A provider who concludes that an Annex III system is not high-risk because it only performs a narrow or preparatory task must document that assessment and still register the system.

Germany: who supervises the KI-Verordnung

Germany implemented the national side with the KI-MIG (KI-Marktüberwachungs- und Innovationsförderungsgesetz) of 22 July 2026, in force since 29 July 2026. The Bundesnetzagentur is the central market surveillance authority and single point of contact, unless a specialised authority is responsible. BaFin supervises AI directly linked to regulated financial activities, and the existing product authorities cover AI in products under Annex I. The Bundesnetzagentur must also operate at least one AI regulatory sandbox (KI-Reallabor), which SMEs can use to test new applications.

What are the fines?

Under Article 99, using prohibited AI can lead to fines of up to €35 million or 7% of worldwide annual turnover, breaches of operator duties such as those of deployers or the transparency rules up to €15 million or 3%, and incorrect information to authorities up to €7.5 million or 1%. For SMEs and start-ups the lower of the two amounts applies, and SMCs benefit from the same cap for the second and third categories. Member States set the detailed penalty rules and must take the economic viability of smaller companies into account.

A 2027 compliance roadmap for SMEs

1. Build an AI inventory now

List every AI tool and feature in use, including AI functions inside existing software and tools employees use on their own. Note the vendor, the purpose, the data involved and an internal owner for each.

2. Classify each use case

Sort each use into prohibited, high-risk under Annex III, transparency-relevant or minimal risk. Use the Commission’s draft guidelines and record your reasoning, because that record is what you will show an authority or customer.

3. Fix transparency first

Make sure chatbots disclose that they are AI and label deepfakes and AI-generated public-interest texts. The Commission’s Code of Practice on AI-generated content and the EU labelling icons give a practical template.

4. Run AI literacy as a programme

Offer short, role-based training: what the tools can and cannot do, what data may be entered, how to check outputs. Keep a simple record of who was trained and when.

5. Prepare high-risk use cases for December 2027

For recruitment, HR, credit or insurance use cases, ask your vendors now for the instructions for use, logging options and oversight features. Plan the worker information, assign oversight roles and check whether a fundamental rights impact assessment applies to you.

6. Build governance into your systems

Compliance is easier when it is part of the workflow: human approval steps before an AI decision takes effect, logs that are retained automatically, and clear limits on what an agent may do. Our outlook on AI agents in business in 2027 and our experience connecting AI to Odoo show how this works in practice.

7. Review twice a year

Final guidelines, harmonised standards and national practice will keep arriving through 2027. Put a review in the calendar for spring and autumn, and update the inventory whenever you add a new AI tool.

How Metanow helps

Metanow has worked on AI, automation and ERP projects since 2022. We help companies map their AI use, classify use cases, design oversight and logging in Odoo and n8n workflows, add disclosure to chatbots and run practical AI literacy sessions for teams. We are not a law firm, so we work alongside your legal or data protection adviser on legal assessments and focus on making the technical and organisational side work.

Frequently asked questions

Official sources

• EUR-Lex — Regulation (EU) 2024/1689 (Artificial Intelligence Act)
• EUR-Lex — Regulation (EU) 2026/1744 (Digital Omnibus on AI)
• European Commission AI Act Service Desk — implementation timeline
• AI Act Service Desk — Article 4: AI literacy (as amended)
• AI Act Service Desk — Article 26: obligations of deployers of high-risk AI systems
• AI Act Service Desk — Article 50: transparency obligations
• AI Act Service Desk — Article 99: penalties
• Council of the EU — final green light for the AI simplification rules (29 June 2026)
• European Parliament Legislative Train — Digital Omnibus on AI
• European Commission — guidelines on the classification of high-risk AI systems (draft)
• European Commission — Code of Practice on transparency of AI-generated content
• KI-MIG — German AI market surveillance act (gesetze-im-internet.de)
• Council of the EU — position on the Digital Omnibus for data protection, privacy and cyber reporting (21 October 2026)