EU AI Act for SMEs: duties now, delays until 2027

If your company uses AI tools, this much of the EU AI Act is already mandatory. Since 2 February 2025, you must take measures for your staff's AI literacy. Since 2 August 2026, customers must be told when they are talking to a machine, and AI-generated deepfakes must be labelled.

What was postponed

The strict rules for HR screening, credit scoring and other high-risk systems, however, were postponed by the AI omnibus adopted this summer: to 2 December 2027, and to 2 August 2028 for systems embedded in products.

What the AI omnibus is, and why it matters

Regulation (EU) 2026/1744, officially the digital omnibus package on artificial intelligence, was adopted on 8 July 2026. It was published in the Official Journal of the European Union on 24 July and entered into force on the third day after publication, 27 July.

It is not a new law but an amendment to the original AI Act, Regulation (EU) 2024/1689: it simplifies, pushes deadlines back, and tightens a few points as well.

In Hungary, the enforcement framework is set by Act LXXV of 2025, which authorises the government to designate the market surveillance authority and the notifying authority. The content of the obligations, however, comes directly from the EU regulation.

Already mandatory: AI literacy

Article 4 of the AI Act has applied since 2 February 2025. It originally required providers and deployers to ensure, to their best extent, a sufficient level of AI literacy among their staff. The omnibus softened this: companies must take measures to develop AI literacy, but need not guarantee any specific level for anyone.

So you do not need exam certificates, but you do need demonstrable effort. Record in writing who uses which AI tool, what training or guidance they received, and what the tool must not be used for.

Under the amended text, the Commission and the Member States will give SMEs specific support here, and the Commission will publish practical examples.

Already mandatory: a machine must not pretend to be human

The transparency obligations in Article 50 have applied since 2 August 2026, and the omnibus did not postpone them. The only grace period concerns machine-readable marking in older generative systems, covered below.

Under paragraph (1), an AI system that interacts directly with people must be designed so that they are informed they are dealing with a machine. The exception relevant to SMEs is when this is obvious to a reasonably well-informed, observant person from the circumstances.

Chatbots and voice bots: who is responsible?

Formally, this obligation falls on the provider of the system, meaning the developer. An SME using a supplier's chatbot or voice bot is typically the deployer: its job is to check that the disclosure appears and to require it in the contract.

Under paragraph (5), the information must be clear and given at the latest at the first interaction. In a chat window that can be a prominent first message, on the phone a sentence at the start of the call.

Custom-built bots

If the bot is custom-built for you, the disclosure should be part of the system, not a sticker added afterwards. For AI customer service systems this is as much a design question as the handover to a human.

Generated marketing content and deepfakes

Article 50(4) obliges the deployer: if you use AI to create or manipulate a deepfake, you must disclose that it is artificial. The regulation defines a deepfake as image, audio or video content that resembles existing persons, objects, places or events and would falsely appear authentic.

An advert using a real person's cloned voice typically qualifies. For evidently artistic, satirical or fictional work the disclosure can be more discreet, but not omitted.

Text is treated differently

The rule for text is narrower: AI-written text informing the public on matters of public interest must be labelled, unless a human has reviewed or edited it and someone holds editorial responsibility. An ordinary product description or newsletter does not get a label automatically.

What arrives in December

Article 50(2) requires providers of generative systems to mark their output in a machine-readable format. Under the omnibus, systems placed on the market before 2 August 2026 have until 2 December 2026, and later systems get no such grace period.

If you release your own generative tool to customers, this may apply to you as well.

Two new prohibitions

From 2 December 2026, two new prohibitions added by the omnibus also apply. They target AI generation of realistic intimate or sexual content of an identifiable person without consent, and of child sexual abuse material.

Providers may not place on the market a system intended for this, or one that foreseeably enables it without adequate safeguards. Deployers may not use AI for this purpose.

When does an HR screener or credit scoring tool become high-risk?

Under point 4 of Annex III, a system intended for recruiting or selecting employees is high-risk, for example one that screens applications or evaluates candidates. So are tools that decide on promotion, termination or task allocation, or that monitor performance. Point 5(b) adds systems assessing the creditworthiness of natural persons, except fraud detection.

Not every such tool is high-risk. Article 6(3) exempts, for example, a system that only performs a narrow procedural task, improves the result of completed human work, or performs a preparatory step, without materially influencing the decision. A system that profiles individuals, however, is always high-risk.

What arrives in December 2027

After the omnibus, the full set of obligations for these systems applies from 2 December 2027, and for systems embedded in products under Annex I from 2 August 2028.

As a deployer, you will then have to operate the system according to its instructions for use and assign competent human oversight. Before using it at the workplace, you must also inform workers and their representatives.

What to document now

1. AI inventory: every AI tool in use, its supplier, what it is used for, and whether it touches customers or staff.
2. Literacy record: who uses which tool, what training or internal rule they received, and when.
3. Transparency check: for every chatbot, voice bot and piece of generated visual content, one line on where and how you disclose the AI.
4. Supplier declarations: ask in writing that the provider complies with Article 50, and for generative tools with machine-readable marking too.
5. Risk pre-screening: for HR and lending tools, record why they fall or do not fall under Annex III, because you have until December 2027 to get ready.

Fines and next steps

A breach of Article 50 can be fined up to 15 million euros or 3 percent of total worldwide annual turnover, and for SMEs whichever of the two is lower. The penalty rules themselves are laid down by the Member States.

If you are about to introduce a chatbot, voice bot or internal AI tool and want disclosure, logging and human oversight in the design from day one, see how we build custom AI systems.

This article is not legal advice, and for a specific classification it is worth involving a lawyer.

Sources

• Regulation (EU) 2026/1744 of the European Parliament and of the Council (AI digital omnibus), OJ, 24.7.2026
• Regulation (EU) 2024/1689 of the European Parliament and of the Council on artificial intelligence
• Act LXXV of 2025 on the implementation in Hungary of the European Union regulation on artificial intelligence
• Hunton Andrews Kurth: EU Digital Omnibus on AI Enters into Force (28.07.2026)
• Cuatrecasas: Digital Omnibus on AI has been published (24.07.2026)