AI Act 2026: what SMEs actually need to know
Applicable since 2 August 2026, the AI Act comes down to three duties for an SME that buys AI. The heavy Annex III rules now wait until 2 December 2027. Here are the dates, the fine ceilings that actually apply to an SME, and who enforces in the Netherlands, Belgium, France and Luxembourg.
The short answer
The AI Act (Regulation (EU) 2024/1689) has been applicable since 2 August 2026[1]. For SMEs in the Netherlands, Belgium, France or Luxembourg that buy AI rather than build it, three duties are already live: train the people who use it (Article 4), stay clear of the prohibited practices (Article 5), and say that it is an AI (Article 50). The heavy obligations for Annex III "high-risk" systems were pushed back to 2 December 2027 by the simplification regulation known as the "AI Omnibus", in force since 27 July 2026[1].
The AI Act timeline, step by step
The regulation entered into force on 1 August 2024, but it applies in waves. These are the dates that matter, as published by the European Commission[1].
| Date | What becomes applicable | Relevant to an SME? |
|---|---|---|
| 2 February 2025 | Prohibited practices (Article 5) and the AI literacy duty (Article 4) | Yes, for any company using AI |
| 2 August 2025 | Governance rules and obligations for general-purpose AI models | Indirectly: your vendor is covered |
| 2 August 2026 | General application, including Article 50 transparency; enforcement powers of national authorities | Yes |
| 2 December 2026 | Ban on systems generating non-consensual intimate or child sexual abuse material, added by the AI Omnibus | Rarely |
| 2 December 2027 | Obligations for Annex III high-risk systems (recruitment, worker management, access to essential services, biometrics…) | Yes if you screen CVs or score people with AI |
| 2 August 2028 | High-risk systems embedded in regulated products (Annex I: lifts, toys, machinery…) | Yes if you manufacture such products |
The Annex III delay is not a rumour: it comes from the "AI Omnibus", proposed on 19 November 2025, politically agreed on 7 May 2026 and in force since 27 July 2026[1].
Provider or deployer: the one question to settle
The regulation separates whoever places a system on the market (the provider) from whoever uses it under their own authority (the deployer). An SME that plugs in a writing assistant, a reply bot or a screening tool is a deployer. It becomes a provider in one specific case: if it places the system on the market under its own name or trade mark, or changes the intended purpose.
The distinction is not academic: documentation duties, risk management and conformity assessment sit with the provider. The deployer's list is short but real — and for a high-risk system it includes, from 2 December 2027, informing workers' representatives and the affected workers before putting the system into service at the workplace, and keeping logs for at least six months[2].
The three duties already live for an SME
1. Train, without certifying (Article 4)
Providers and deployers must take measures to build the AI literacy of the people operating these systems, taking account of their technical knowledge, training and the context of use. The AI Omnibus clarified the wording: the duty does not require you to guarantee any specific level of AI literacy for any individual[3]. In practice: a documented half-day, a short internal policy and an annual refresher beat a certificate. The Commission has committed to publishing practical compliance examples on its single information platform[3].
2. Stay behind the red lines (Article 5)
Nine practices are banned. Two reach straight into SME life: emotion recognition in the workplace and in education, and social scoring. A tool claiming to measure an employee's mood, stress or motivation from their voice or face falls under that ban, applicable since February 2025[1]. Worth checking before you buy any call-analysis product.
3. Say that it is an AI (Article 50)
Since 2 August 2026, Article 50 requires that people be informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant person. Synthetic output (audio, image, video, text) must be marked in a machine-readable format and detectable as artificially generated or manipulated. Deepfakes must be disclosed, and so must text published to inform the public on matters of public interest — unless it went through human review or editorial control[4].
Fines: what an SME actually risks
Article 99 sets three tiers: up to EUR 35 000 000 or 7 % of total worldwide annual turnover for a prohibited practice; up to EUR 15 000 000 or 3 % for other breaches, including Article 50; up to EUR 7 500 000 or 1 % for incorrect or incomplete information given to an authority[5]. For large companies, the higher of the two applies. For SMEs, the text does the opposite.
Worked assumption, to be replaced by your own figures: a company with EUR 2 000 000 turnover in breach of Article 50 faces min(EUR 15 000 000; 3 % × EUR 2 000 000) = EUR 60 000 as a theoretical ceiling, not EUR 15 000 000[5]. The text also requires Member States to take the interests of SMEs and start-ups, and their economic viability, into account when imposing penalties[5].
Who enforces in the Netherlands, Belgium, France and Luxembourg
Since 2 August 2026, enforcement sits with the Commission's AI Office for general-purpose models, and with national market surveillance authorities for systems[1]. Here is the state of the Commission's published list, last updated 7 September 2026[6].
| Country | Notified single point of contact | Status |
|---|---|---|
| Netherlands | Rijksinspectie Digitale Infrastructuur (RDI) | National designation not yet finally adopted |
| Belgium | No single point of contact published | Blank entry on the Commission list |
| France | Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF) | National designation not yet finally adopted |
| Luxembourg | Commission nationale pour la protection des données (CNPD) | National designation not yet finally adopted |
A blank entry does not mean the regulation does not apply: it applies in all twenty-seven Member States. It means the national desk is not published yet, and that the Commission may open an infringement procedure against a Member State that failed to designate its authority[6]. For a Belgian SME the reflex is the same as for personal data: keep a written record of your choices.
Where your neighbours stand
In 2025, 19.95 % of EU enterprises with ten or more people employed used at least one AI technology. The spread across your four markets is wide[7].
| Country | Enterprises with 10+ employed | Enterprises with 10 to 49 employed |
|---|---|---|
| Belgium | 34.54 % | 28.82 % |
| Luxembourg | 33.61 % | 30.48 % |
| Netherlands | 33.21 % | 28.76 % |
| France | 18.16 % | 15.04 % |
| European Union | 19.95 % | 17.00 % |
The brake is not only technical: 5.92 % of EU enterprises with ten or more people employed say they do not use AI because of a lack of clarity about the legal consequences[7]. That is precisely what the timeline above removes. To pick the first projects, our piece on the five tasks SMEs should automate first sets the order, and Flash Eurobarometer 578 on AI and algorithmic management shows what employees expect. If your use cases touch prospecting, the data rules stack with the GDPR: see B2B prospecting and the GDPR in France, Belgium and the Netherlands.
Your seven-line checklist
- List the AI tools actually in use, including those that arrived through an individual subscription.
- For each one: provider or deployer? In nine cases out of ten, deployer.
- Check that no tool measures employees' emotions or scores people.
- Add the "automated assistant" notice wherever a customer talks to a machine.
- Mark generated content and have a human read anything you publish.
- Document a half-day of training per exposed team, and repeat it yearly.
- If a use case touches recruitment, worker management or access to an essential service: diarise 2 December 2027 and inform employee representatives before go-live.
These seven lines are not legal advice. They restate, in order, what the sources listed at the end of this article require from a deployer. For any risk classification, your national competent authority and the Commission's AI Act Service Desk are the places to ask.
At CyberNovaLabs.io
We install AI automation in SMEs across the four countries, and compliance is part of the scoping: tool inventory, provider-or-deployer call, disclosure notices, content marking, decision log. See our AI automation for business and AI training for teams pages, the latter covering the Article 4 duty. Pricing on quotation, depending on scope.
Request a 20-minute call about your AI tool inventory
Sources
- Commission européenne — Cadre réglementaire de l'IA : calendrier d'application et AI Omnibus
- AI Act Service Desk — Article 26 : obligations des déployeurs de systèmes à haut risque
- AI Act Service Desk — Article 4 : culture de l'IA (version consolidée au 27/07/2026)
- AI Act Service Desk — Article 50 : obligations de transparence
- AI Act Service Desk — Article 99 : sanctions
- Commission européenne — Autorités de surveillance du marché au titre de l'AI Act (maj 07/09/2026)
- Eurostat — Intelligence artificielle par classe de taille d'entreprise (isoc_eb_ai, 2025)
- Règlement (UE) 2024/1689 (AI Act) — texte au Journal officiel de l'Union européenne
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Belgian tax portal attacked: deadline moved (28/10/2026)
Four days without MyMinfin, Tax-on-Web or Biztax, and a filing deadline that did not move. No data was stolen, so the cost sits elsewhere. What the Belgian tax portal cyberattack changes in practice for an SME in Belgium, France, the Netherlands and Luxembourg.
Read the article →November 3, 2026 · 8 min readB2B appointment setting for webshops
B2B appointment setting with webshops is decided before the call: the channel (own site, marketplace or EDI), the country, and the legal form. This guide cites Eurostat, the CNIL, FPS Economy and the ACM.
Read the article →November 2, 2026 · 7 min readDrupal Commerce flaw exploited: prices editable (28/10/2026)
An access bypass in Commerce Core let a customer write the price and the state of their own order. Drupal scored it 21 out of 25, reported active exploitation and asked merchants to audit their orders. What an SME should check, and which regulatory clocks may start.
Read the article →November 2, 2026 · 8 min readNIS2 Belgium: are hotels and tourism firms in scope?
Accommodation and restaurants are not in the annexes of the Belgian law of 26 April 2024. Three duties still catch you, and one of them already decides corporate contracts.
Read the article →