EUAICheck is an independent self-assessment tool. We are not a law firm and have no link with any official authority.
EUAICheck is an independent self-assessment tool published by Vival Solutions (EI). This content is informational, is not legal advice and may change: always check the official text on EUR-Lex.
Preparing for the EU AI Act: a 5-step method for SMEs
Updated 30 September 2026 · Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
Some obligations already apply (prohibited practices, AI literacy, transparency); others arrive in December 2027 for high-risk systems. For an SME, the hard part is rarely "when to start" but "where to start". Here is a simple method, to adapt to your situation.
Step 1: list your AI systems
- SaaS software with AI features (CRM, ATS, ERP, marketing tools).
- Models called through an API (OpenAI, Anthropic, Google, Mistral…) and what you build on them.
- In-house tools.
- Chatbots and assistants, on your website or internal.
- Text, image or video generation tools used for your communication.
Think of informal use: AI tools used individually by your teams, without a framework. Article 4, as amended by the Digital Omnibus, asks you to take measures to support the AI literacy of people using AI on your behalf.
Step 2: identify your role for each
- Provider: you develop the system, or have it developed, and place it on the market or put it into service under your name.
- Deployer: you use the system under your authority in your business.
- You can be both, for example for a chatbot you built and use on your website.
Step 3: estimate the risk level
- Prohibited practices (Article 5): harmful manipulation, exploitation of vulnerabilities, social scoring, emotion recognition at work or school, etc.
- High risk: uses listed in Annex III (biometrics, critical infrastructure, education, employment, credit and insurance, essential public services, law enforcement, migration, justice), or safety component of a regulated product (Annex I). The use matters, not your company's sector.
- Transparency (Article 50): chatbots, generated content, deepfakes.
- Minimal risk: other uses, with no specific obligation beyond Article 4.
The EUAICheck pre-assessment gives a first indicative estimate for one system in 17 questions. For a high-stakes case, have the classification confirmed by a specialised lawyer.
Step 4: prioritise by timeline
- Now: check there is no prohibited practice; tell people who chat with your chatbots that they are dealing with AI; organise your teams' AI literacy.
- Before 2 December 2026: marking of generated content for systems already on the market before 2 August 2026.
- Before 2 December 2027, for Annex III high-risk systems: for providers, risk management, technical documentation, conformity assessment, registration in the EU database; for deployers, human oversight, logs, informing people and, in some cases, a fundamental rights impact assessment.
- Ongoing: monitor operation, report serious incidents, update the inventory.
Step 5: document and train
For a high-risk system, the provider keeps technical documentation whose content is set by Annex IV (simplified for SMEs):
- system description: purpose, operation, capabilities, limitations;
- data: origin, collection, preparation, bias examination;
- performance: metrics, tests, results by affected group;
- risk management and human oversight measures.
For training, keep a record of what was done (date, content, participants): it is the simplest way to show the measures taken under Article 4.