"Do we have to do something about the EU AI Act now?" — we hear this in almost every first conversation right now. The honest answer: yes, but far less than the panic headlines suggest. And the dreaded August 2026 deadline is, for most companies, off the table. Here's the calm classification for small and mid-sized businesses.
The good news first: the big deadlines have been postponed
For a long time, 2 August 2026 was the big cut-off — the date the strict obligations for high-risk AI were meant to kick in. But in May 2026 the EU institutions agreed on a clear delay through the so-called Digital Omnibus:
- Stand-alone high-risk systems (Annex III) only have to meet the obligations from 2 December 2027 — roughly 16 months later than planned.
- Systems embedded in regulated products (Annex I) have until 2 August 2028.
The delay becomes legally binding once it's published in the EU Official Journal, which is expected before August 2026 — until then the old date formally stands, but the political agreement is considered settled. For you, that means the time pressure currently pushing many vendors to sell expensive "AI Act packages" is off, at least for now.
Four risk classes — and why you're probably in the harmless one
The AI Act doesn't treat all AI the same; it sorts it by risk. That's the most important distinction — and the reason most smaller companies can stay relaxed.
- Unacceptable risk — banned. Things like social scoring or manipulative AI. In force since February 2025, and it practically never touches a legitimate business.
- High risk — the strict class with risk management, documentation and oversight. This means AI in sensitive fields like hiring, lending, medicine or critical infrastructure. This is where the just-postponed deadlines apply.
- Limited risk — transparency obligations. If you run a chatbot or publish AI-generated content, you have to label it. Nothing more.
- Minimal risk — no specific obligations. This is where most everyday work lands: drafting texts, summarizing quotes, generating images, sorting data.
If you mainly use AI — ChatGPT, Copilot, a few automations — rather than building a high-risk system yourself, you're almost always in the bottom two classes.
What already applies today (and gets overlooked)
Two things apply regardless of any delay — and have since 2 February 2025:
1. AI literacy. If you deploy AI in your business, you have to make sure the employees working with it actually understand it — the basics, the limits, data protection. That's mandatory and meant to be demonstrable. The reassuring part: it doesn't mean certification, it means appropriate training. A compact briefing plus a two-page usage policy — half a day's work, not a compliance mega-project. You can generate such a policy in minutes.
2. Transparency. If you run a chatbot, users must know they're talking to a machine. If you publish AI-generated text or images, label them. Simple — but often forgotten.
What you don't need to spend money on (yet)
The honest warning: the AI Act is currently a convenient selling point for expensive consulting and software that many companies simply don't need. If you don't operate a high-risk system — and few SMEs do — the heavy package of audits and documentation just isn't relevant to you. The Digital Omnibus lowers the bar further: for smaller companies (the planned category reaches up to 750 employees and €150M revenue), reduced technical documentation is meant to suffice. So don't buy an "AI Act all-in-one package" before you even know whether the strict rules apply to you.
Pragmatic, in three steps
First, write down which AI you use and for what. Second, cover the two obligations that already apply today — a short training session and a clear usage policy. Third, check once, properly, whether any of your applications fall into the high-risk class.
For exactly that third step we built a free EU AI Act risk check — in a few minutes you'll know where you stand. If you're still unsure afterwards, talk to us: you'll get an honest assessment, not a fear-driven sales pitch. (This article is for orientation and is not legal advice.)