What obligations does an SME have under the EU AI Act?

A small or midsize business (SME) in Germany that uses a chatbot or phone assistant is a deployer under Art. 3(4) of the EU AI Act (Regulation (EU) 2024/1689). Since February 2, 2025, it must promote the AI literacy of its staff (Art. 4). Since August 2, 2026, it must disclose that people are talking to an AI (Art. 50), and it must check whether a use case falls under Annex III. High-risk obligations only apply from December 2, 2027.

Regulation (EU) 2024/1689 is long, but the obligations for a company that only uses AI are short. Below is the status after the Digital Omnibus, with which the EU postponed deadlines in summer 2026. Every statement cites the article.

Which deadlines apply and what did the Digital Omnibus postpone?

The European Commission proposed the Digital Omnibus on November 19, 2025. It became Regulation (EU) 2026/1744 of July 8, 2026, published in the Official Journal on July 24, 2026 and in force since July 27, 2026. It amends Art. 113 of the AI Act, which contains the timeline:

Date	What applies	For an SME as a user
February 2, 2025	Prohibited practices under Art. 5, AI literacy under Art. 4	Yes, Art. 4
August 2, 2025	Obligations for providers of general-purpose AI models, Chapter V	No
August 2, 2026	General date of application, including transparency under Art. 50 and penalties under Art. 99	Yes, Art. 50(1) and (4)
December 2, 2026	New prohibitions in Art. 5 (non-consensual intimate content, child sexual abuse material), end of the deferral for machine-readable marking under Art. 50(2) for legacy systems	Hardly
December 2, 2027	High risk under Annex III (previously August 2, 2026)	Only for use cases under Annex III, such as recruitment
August 2, 2028	High risk as a safety component under Annex I (previously August 2, 2027)	Only manufacturers of regulated products

Two things matter. Art. 50 was not postponed: anyone running a chatbot without an AI notice today has been in breach since August 2, 2026. And Art. 4 was weakened: instead of ensuring AI literacy, companies must promote it, without guaranteeing a specific level.

Am I a provider or a deployer?

A provider under Art. 3(3) is anyone who develops an AI system or has it developed and places it on the market or puts it into service under their own name. A deployer under Art. 3(4) is anyone who uses an AI system under their own authority in a professional capacity. A company that obtains a phone assistant from a service provider and connects it to its own number is a deployer. The service provider is the provider. The role decides the list of obligations, and the deployer's list is considerably shorter.

A deployer can become a provider. Art. 25(1) names three cases for high-risk systems: you put your own name or trademark on the system, you make a substantial modification to it, or you change its intended purpose so that it becomes a high-risk system. A chatbot under your company name does not make you a provider as long as it is not a high-risk system. But if you build a tool for pre-screening applicants from a general-purpose language model yourself, you are a provider with all the obligations from Chapter III.

What exactly do I have to do for a chatbot or phone assistant?

Art. 50(1) requires providers to design systems intended to interact directly with people so that those people are informed they are interacting with an AI system, unless this is obvious from the circumstances. Formally the obligation falls on the provider, but the system runs under your number and on your website. So you check that the notice actually appears. Paragraph 5 requires it at the latest at the first interaction, in a clear and distinguishable manner. In practice: one sentence in the phone assistant's greeting, one sentence above the chat window, one sentence in the signature of every email the assistant writes.

Art. 50(4) applies to you directly as a deployer. If your system generates images, audio or video that appear authentic (deepfakes), you must disclose that. If your system publishes texts intended to inform the public on matters of public interest, you must label them as artificially generated, unless a person has reviewed them editorially and holds editorial responsibility. For most businesses this means: a person approves AI-written newsletters, blog posts and social media posts, and that approval is recorded.

Art. 4 requires measures to promote the AI literacy of your staff, tailored to their knowledge, experience and the intended use. For a chatbot or phone assistant, training the people who take over handoffs, read logs and configure the system is enough: what it can do, where it gets things wrong, when a person takes over, what must not be entered. Two hours, attendance list, date, filed. That fulfills the obligation and makes it verifiable.

When does my use case become a high-risk system?

Under Art. 6(2), the systems listed in Annex III are considered high risk. Two points are relevant for an SME. Point 4 covers systems for the recruitment or selection of natural persons, including targeted job ads, filtering applications and evaluating candidates, as well as systems for decisions on working conditions, promotion, termination, task allocation and performance monitoring. Point 5 covers, among other things, the assessment of the creditworthiness of natural persons.

A chatbot for inquiries, a phone assistant for appointments, an assistant that pre-sorts emails or writes quotes is not listed in Annex III. A tool that sorts applications by suitability is. Art. 6(3) exempts systems that only perform a narrow procedural task or improve the result of a human activity. As soon as a system evaluates people or performs profiling, the exemption does not apply.

Anyone who deploys a high-risk system carries the obligations of Art. 26 from December 2, 2027: use in accordance with the instructions for use, human oversight by trained persons, monitoring of operation, logs kept for at least six months, informing employees and their representatives before deployment, informing the affected persons, and under paragraph 9 usually a data protection impact assessment. Our recommendation: if you want to use AI in recruitment, do not wait for December 2027, and only buy from providers who already commit to conformity under Chapter III. Anything else is an investment risk.

What fines are possible and what applies to SMEs?

Art. 99 tiers the penalties. Paragraph 3: up to EUR 35 million or 7 percent of worldwide annual turnover for prohibited practices under Art. 5. Paragraph 4: up to EUR 15 million or 3 percent for violations of the other obligations, including Art. 50. Paragraph 5: up to EUR 7.5 million or 1 percent for supplying incorrect information to authorities. For large companies, the higher amount applies in each case.

For SMEs, paragraph 6 reverses this: the lower of the percentage and the fixed amount applies. Under Art. 3(14a), an SME is a company covered by Recommendation 2003/361/EC, meaning fewer than 250 employees and annual turnover of no more than EUR 50 million or a balance sheet total of no more than EUR 43 million. For a business with two million euros in turnover, the cap for a missing AI notice is therefore EUR 60,000, not EUR 15 million. Paragraph 7 also requires the authority to take into account the nature, gravity and duration of the infringement as well as the size of the company. In Germany, the competent authority since July 29, 2026 is the Federal Network Agency (Bundesnetzagentur) under the German AI Market Surveillance Act (KI-MIG), with an independent AI market surveillance chamber. It also accepts complaints, for example from customers who spoke with a bot that was not labeled.

Checklist for using AI in your business

1. List of all AI systems in use with provider, purpose and role (deployer or provider)
2. No use under Annex III without a high-risk review, recruitment and credit scoring explicitly checked
3. AI notice under Art. 50(1) in the greeting, chat window and email signature, checked in the real process
4. AI-generated texts for the public are approved by a person, approval documented (Art. 50(4))
5. Training under Art. 4 carried out and filed with attendance list and date
6. Provider has confirmed in writing that its system complies with Art. 50 and who supplies the marking under paragraph 2
7. For high-risk use: instructions for use, oversight person named, logs kept six months, employees informed, DPIA (Art. 26)
8. Calendar reminders for December 2, 2027 for Annex III and August 2, 2028 for Annex I

How we do it at B&S

B&S Ventures from Hannover builds AI assistants for reception, appointments, follow-ups and internal information. None of these use cases is listed in Annex III, so the obligations remain those of a deployer. We build the AI notice under Art. 50 firmly into the greeting and the signature, and the training under Art. 4 and its documentation are included. We start with one channel and expand in stages. The goal is more time for your team, not fewer people.

The intro call and an initial direction are free of charge. On request, we check in a booked consulting session whether systems you already use fall under Annex III. The data protection questions for the same use case are covered under AI assistants and the GDPR.

Frequently asked questions

Does the EU AI Act apply to a company with ten employees?

Yes. It is tied to the role, not to size. Anyone who uses an AI system under their own authority in a professional capacity is a deployer under Art. 3(4) and carries the deployer obligations. Size matters for fines, Art. 99(6).

Does my chatbot have to say that it is an AI?

Yes, since August 2, 2026. Art. 50(1) requires that people interacting with an AI system are informed of this, unless it is obvious from the circumstances. Under paragraph 5, at the latest at the first interaction. One sentence in the greeting and the signature is enough.

What does Art. 4 on AI literacy require in practice?

Measures that promote the AI literacy of your staff, tailored to their knowledge and the intended use. Since the amendment by the Digital Omnibus, you do not have to guarantee a specific level. A documented two-hour training for the people who work with the system meets the obligation for a chatbot or phone assistant.

Is a phone assistant for scheduling appointments a high-risk system?

No. Annex III does not list appointment scheduling, inquiries or customer service. It only becomes high risk if the system decides on applicants, employees, creditworthiness or access to essential services, or prepares such decisions.

What did the Digital Omnibus change in the EU AI Act?

Regulation (EU) 2026/1744 of July 8, 2026, in force since July 27, 2026, postpones the high-risk obligations for Annex III to December 2, 2027 and for Annex I to August 2, 2028. Art. 4 was weakened to an obligation to promote. Art. 50 has applied unchanged since August 2, 2026. Only the machine-readable marking under paragraph 2 gets a deferral for legacy systems until December 2, 2026.

Who enforces this in Germany?

The Federal Network Agency (Bundesnetzagentur). The German AI Market Surveillance Act (KI-MIG) entered into force on July 29, 2026 and sets up an independent AI market surveillance chamber there, which also handles complaints.

Sources: Regulation (EU) 2024/1689, Regulation (EU) 2026/1744, OJ L of July 24, 2026, KI-MIG, Recommendation 2003/361/EC. Reviewed on September 22, 2026.