On August 2, 2026, the remaining provisions of the EU AI Act become enforceable. Penalties for the worst category of violation top out at 35M EUR or 7% of global annual turnover, whichever is higher. The Act has been on the books since 2024. The August date is when it starts having teeth.
If your reaction is "I am not in Europe, this is not my problem," read the next section carefully.
Why It Probably Applies to You Anyway
The AI Act regulates by the functional role you play in the AI value chain, not by the size of your company or the country your HQ is in. If your business deploys an AI system whose output reaches a person in the EU, you are most likely a "deployer" or a "provider" under the Act, regardless of where you are based.
That includes:
- An ecommerce store that uses AI to recommend products to EU shoppers.
- A SaaS company with an AI feature that any EU customer can turn on.
- A consultancy that runs an AI agent on behalf of a client with EU employees.
- A solopreneur with a chatbot on their website that anyone in the EU can chat with.
The Four Risk Tiers, In One Look
| Tier | Examples | What you must do |
|---|---|---|
| Unacceptable | Social scoring, manipulative dark-pattern AI, certain biometric surveillance. | Banned outright. Already enforceable since Feb 2, 2025. |
| High | Hiring tools, credit scoring, education scoring, critical infrastructure. | Conformity assessment, risk management, human oversight, technical documentation. |
| Limited | Chatbots, AI-generated content, deepfakes. | Transparency notices. Users must know they are interacting with AI. |
| Minimal | AI in spam filters, video games, most productivity tools. | No specific obligations, voluntary codes of conduct. |
Most small businesses sit in the "Limited" tier. That means transparency, not paperwork mountains.
The Decision Tree
Most SMBs land in the "transparency, not paperwork mountains" branch.
What To Actually Do Before August 2
- Run an AI inventory. Make a one-page list of every AI feature your business uses, builds, or resells. For each, write down what it does, what data it touches, and who in the EU might encounter it. This is one afternoon of work and it determines everything else.
- Add transparency notices where they are missing. Any chatbot, AI-generated copy, AI-generated image, or AI voice agent that an EU user might encounter needs a clear disclosure.
- Document your suppliers. If you use OpenAI, Anthropic, or Google as the underlying model, you are a "deployer," not a "provider." Keep the contracts and model cards on file. It is most of your defense.
- Train your team in AI literacy. The Act explicitly requires it. A one-hour internal session and a written summary in the employee handbook counts.
The EU's free AI Act Compliance Checker walks you through the same logic. Run it once, save the output.
The Bottom Line
For most small businesses, EU AI Act compliance is not the multi-month enterprise project the consultancies want to sell you. It is an afternoon of inventory and a few weeks of cleanup, unless you sit in a high-risk vertical. The cost of getting it wrong is real, but the cost of doing it is small. Just do it before August.
Sources
- Fusefy, "EU AI Act August 2026 Deadline: Enterprise AI Compliance Guide," dates and penalty structure. fusefy.ai
- European Commission, "AI Act" official policy page. digital-strategy.ec.europa.eu
- Council of the European Union, "Artificial Intelligence: Council and Parliament agree to simplify and streamline rules," May 7, 2026 press release on SME-related streamlining. consilium.europa.eu
- artificialintelligenceact.eu, "EU AI Act Compliance Checker," free tool for SMEs and startups. artificialintelligenceact.eu
- Colombani.ai, "EU AI Act 2026: What SMEs Need to Know (and Do) Before August." colombani.ai
Want the one-afternoon AI inventory done with you, not lectured at you?
We run the inventory, mark the risk tier, write the transparency notices, and hand you a folder you can show a regulator. Days, not months.