EU AI Act: What SMEs Must Do Now

The EU AI Act is the most significant piece of AI regulation the world has seen and if your business uses AI in any form, it affects you. Most SMEs are not ready and many don't know where to start.

Why the EU AI Act Matters More Than You Think

The EU AI Act came into force in August 2024 but its application has been phased, with the most demanding obligations rolling out through 2025 and 2026. The European Commission extended certain deadlines and there is strong evidence this was driven by the sheer number of organisations that had not begun preparing. Regulators do not extend timelines because things are going well.

For SMEs, the risk is treating this as a problem for enterprise businesses and legal teams. However, the Act applies to any organisation that develops, deploys or uses AI systems in a way that affects people within the EU, and that scope is broader than most assume.

What the EU AI Act Actually Requires

The Act classifies AI systems by risk level: unacceptable, high, limited and minimal. High-risk systems, which include AI used in hiring, credit decisions, access to essential services and certain customer-facing tools, carry the heaviest obligations. These include transparency requirements, human oversight, technical documentation and conformity assessments.

Even if your AI use falls into the limited or minimal risk categories, you are still expected to understand where your systems sit and demonstrate that understanding to customers, partners and, ultimately, regulators. Ignorance is not a defence.

The Timeline Has Shifted, But the Pressure Has Not

Prohibitions on unacceptable-risk AI systems applied from February 2025. Obligations for general-purpose AI models and high-risk systems are progressively tightening through 2025 and into 2026. The European AI Office is actively building its enforcement capability.

According to the European Parliament's official AI Act overview, organisations that fail to comply with high-risk obligations face fines of up to €30 million or seven per cent of global annual turnover, whichever is higher. For an SME, either figure is potentially catastrophic.

How UK Businesses Are Affected Post-Brexit

This is a question many SMEs ask, and the answer is more straightforward than expected. If your business sells to or serves customers in the EU or if you use AI systems developed by EU-based providers, the Act applies to you. The UK's own AI governance framework is also developing and aligning with the EU AI Act now creates a compliance foundation that will serve you regardless of how domestic regulation evolves.

What SMEs Should Be Doing Right Now

The first step is understanding your AI footprint. What systems are you using? What decisions do they influence? Who is affected? Many SMEs are surprised to discover how many AI-powered tools sit across their operations, from recruitment software to customer service platforms to financial forecasting tools.

The second step is understanding your risk classification under the Act. This determines the specific obligations you need to meet. A structured EU AI Act Readiness Workshop is the most efficient way to get this clarity without burning internal resource on a process your team was never trained for.

Building Your AI Compliance Roadmap

Once you know where you stand, you need a plan. Not a vague aspiration, but a documented AI roadmap that maps your current AI use, identifies gaps against Act requirements and sets out a prioritised programme of work with realistic timescales.

This is not a one-off exercise. As your AI use evolves, your compliance position evolves with it. That means embedding AI governance into how your business operates, rather than treating it as a project you complete and file away.

For SMEs already working through this process, the AI consulting services available from AI Expert are built specifically to make this practical and proportionate. The methodology moves from assessment to AI roadmap to AI implementation, so you are always moving forward rather than circling the problem.

The Cost of Waiting

Think about what compliance requires in practice. It means auditing your AI systems, updating contracts and privacy notices, training your teams on responsible AI use and potentially reconfiguring or replacing tools that do not meet the required standards.  

Teams that have already completed an AI readiness assessment are discovering two things: first, that their AI exposure is broader than they assumed and second, that with a structured plan, the path to compliance is far less daunting than the regulation's reputation suggests. As Jon Rew, Managing Director of Scimitar Sports, noted after working with AI Expert: 'The report highlighted things that were likely costing us money and they were.' Compliance work often surfaces operational improvements that pay for themselves.

Frequently Asked Questions

Does the EU AI Act apply to UK businesses?

Yes, if your business operates in, sells to or serves customers in the EU. Post-Brexit, UK law does not exempt you from EU regulation when your activities touch EU citizens or markets.

What are the fines for EU AI Act non-compliance?

Fines reach up to €30 million or seven per cent of global annual turnover for the most serious violations. For high-risk AI system failures, fines of up to €20 million or four per cent of turnover apply.

What counts as a high-risk AI system under the Act?

High-risk systems include AI used in employment decisions, credit and insurance assessments, access to essential services and certain safety-critical applications. The AI compliance guidance from AI Expert can help you determine where your tools sit.

How long does it take to become EU AI Act compliant?

It depends on the complexity of your AI use, but building a defensible compliance position typically takes several months of structured work. Starting now gives you the time to do it properly rather than reactively. The EU AI Act will not wait for businesses that feel it is too far away to worry about. The phased timeline is an opportunity to get ahead, not a reason to delay. Take the free AI readiness assessment to understand where your business stands today or explore the EU AI Act Readiness Workshop to build a clear, proportionate compliance plan before the deadlines arrive.

‍