EU AI Act: what an SME using AI must do in 2026

For the EU AI Act (Regulation (EU) 2024/1689), an SME that uses AI tools is a "deployer". In 2026 this mainly means supporting the AI literacy of its staff, avoiding prohibited practices and meeting the Article 50 transparency duties, which apply from 2 August 2026. If it uses AI in high-risk areas such as recruitment, it has additional obligations which, after the Digital Omnibus, apply from 2 December 2027.

This guide summarises what an SME, professional firm or advisory practice operating in Spain must do when it uses AI day to day, with the deadlines in force after the July 2026 amendment. It is general information: for your specific situation, consult a lawyer who specialises in this area.

Provider or deployer: which side is your company on

The AI Act distinguishes several roles. The two that matter to an SME are:

• Provider: whoever develops an AI system and places it on the market or puts it into service under its own name or trademark.
• Deployer: whoever uses an AI system under its own authority in the course of a professional activity.

If your company uses ChatGPT, Copilot, a writing assistant, a chatbot on its website or a tool that sorts invoices, it is a deployer. Most technical obligations (documentation, conformity assessment, CE marking) fall on the provider.

One nuance: if your company commissions a bespoke system and puts it into service under its own name, or substantially modifies a high-risk system, it could be treated as a provider. In that case, check how responsibilities are allocated in the contract.

What the Digital Omnibus changed

In November 2025 the Commission proposed a simplification package known as the Digital Omnibus. The AI part is now law: Regulation (EU) 2026/1744 was adopted on 8 July 2026, published in the Official Journal on 24 July and entered into force on 27 July 2026.

The most relevant changes for an SME using AI are:

• High-risk postponed. Obligations for Annex III high-risk systems (employment, credit, education, among others) now apply from 2 December 2027. Those for systems embedded in regulated products (Annex I) apply from 2 August 2028.
• AI literacy reworded. Article 4 no longer requires companies to "ensure" a sufficient level of knowledge, but to take measures to support its development.
• Transparency not delayed. Article 50 obligations still apply from 2 August 2026. Only the technical marking of generated content, which is a provider duty, has a transitional period until 2 December 2026 for systems already on the market before 2 August 2026.
• New prohibitions. Systems that generate child sexual abuse material or non-consensual intimate images of identifiable people are banned.

Current AI Act timeline

The AI literacy obligation (Article 4)

After the amendment, Article 4 requires providers and deployers to take measures to support the AI literacy of their staff and of other people using AI systems on their behalf. They must take into account those people's technical knowledge, experience and training, the context of use and who the systems affect. The text makes clear that it does not require a specific level of literacy to be guaranteed for each individual.

In practice, for an SME this means:

• Knowing which AI tools your team uses and for what.
• Explaining to each person the limits of those tools: errors, data that must not be entered, and the need to check outputs.
• Keeping a record of what you did: an internal session, a usage policy, an attendance log.

Prohibited practices (Article 5)

In force since February 2025, these include systems that manipulate people through subliminal techniques, social scoring, emotion recognition in the workplace or in education (except for medical or safety reasons) and building facial recognition databases through untargeted scraping of images.

Few SMEs would use anything like this on purpose, but it is worth checking. A realistic example: a tool that "analyses the mood" of employees during video calls could fall under the ban on emotion recognition at work.

Transparency: chatbots and generated content (Article 50)

Since 2 August 2026:

• Chatbots. People must be told they are interacting with an AI system unless it is obvious. The design duty lies with the provider, but if you install the chatbot on your website or on WhatsApp, make sure the notice is there.
• Deepfakes. If your company publishes AI-generated or manipulated images, audio or video that appear real, it must disclose this. For clearly artistic or satirical works, the duty is limited so as not to spoil the work.
• Texts on matters of public interest. If you publish AI-generated text to inform the public on matters of public interest, you must disclose it, unless it has undergone human review and someone holds editorial responsibility.
• Emotion recognition or biometric categorisation. If you use such systems (where they are not prohibited), you must inform the people exposed to them.

In July 2026 the Commission published guidelines on Article 50 and confirmed a code of practice on the transparency of AI-generated content, both useful for putting these duties into practice.

High-risk uses that affect SMEs

Annex III includes uses an SME may come across without realising:

• Employment and HR: AI to target job ads, filter CVs, evaluate candidates, decide on promotions or dismissals, allocate tasks based on personal traits or monitor performance.
• Credit: AI to assess the creditworthiness or credit score of individuals (fraud detection is excluded).
• Insurance: risk assessment and pricing in life and health insurance.
• Education: admissions, assessment or exam proctoring.

If you use AI in these areas, from 2 December 2027 Article 26 will require you, among other things, to use the system according to the provider's instructions, assign human oversight to people with the necessary competence and authority, ensure input data is relevant, keep the automatically generated logs and, for employment uses, inform workers and their representatives before deployment. People affected by decisions based on these systems will also have a right to an explanation.

Who enforces it in Spain: AESIA

In Spain, the lead authority is the Spanish Artificial Intelligence Supervisory Agency (AESIA), based in A Coruña. Other authorities act in specific areas, such as the Spanish Data Protection Agency (AEPD) and the Bank of Spain.

On 26 May 2026 the Council of Ministers approved the draft Organic Law on the good use and governance of artificial intelligence, which adapts the AI Act to Spanish law and sets out the penalty regime. As of the date of this guide it is still going through Parliament.

The maximum fines under the AI Act are up to 35 million euros or 7% of worldwide annual turnover for prohibited practices, and up to 15 million euros or 3% for other breaches. For SMEs, the lower of the two amounts applies.

Remember that the GDPR remains fully in force: almost any use of AI with customer or employee data is also processing of personal data.

Checklist for an SME

1. Take an inventory of the AI tools your company uses, who uses them and with what data.
2. Classify each use: general use, transparency (chatbot, published content) or potential high-risk (HR, credit).
3. Rule out prohibited practices, especially emotion recognition of employees.
4. Train your team and keep a record: an internal usage policy and a practical session.
5. Add AI notices to chatbots and review how you label generated images, video or text that you publish.
6. Review contracts with providers: who is the provider, who meets each duty and how data is handled.
7. Prepare high-risk uses before December 2027: human oversight, logs and information for staff.
8. Align with the GDPR: legal basis, privacy information, data processors and, where needed, an impact assessment.
9. Appoint an internal owner to follow regulatory developments and the Spanish law going through Parliament.

How we work at BL Diseno

At BL Diseno, a technical studio in Barcelona, when we audit or implement AI in a company we start with that inventory and document which system is used, for what and with which notices. It does not replace legal advice, but it makes your lawyer's job much easier.