Does the EU AI Act apply to small businesses?

Yes. It covers providers and deployers of AI systems of any size, including small firms that only use tools such as ChatGPT. Size mainly changes the fines: for SMEs each fine is capped at the lower of the fixed amount and the percentage of turnover, and small mid-caps now get the same rule in the 15 million and 7.5 million tiers. The duties themselves are largely the same.

What must a company do if it only uses ChatGPT or Copilot?

It must take measures that support its staff's AI literacy, avoid banned practices such as emotion recognition at work, and label realistic deepfakes and unreviewed AI text on public-interest topics that it publishes. Using the tools internally does not trigger chatbot or marking duties, which fall on providers. A short policy, a short training and a dated record are a sensible start.

When do the AI Act high-risk rules apply?

Regulation (EU) 2026/1744, in force since 27 July 2026, moved the date for Annex III systems such as recruitment, education and credit scoring from 2 August 2026 to 2 December 2027. High-risk AI that is a safety component of regulated products under Annex I moves from 2 August 2027 to 2 August 2028. Banned practices and transparency duties were not postponed.

Do I have to label AI-generated content?

Only in defined cases. Deployers must label deepfakes and AI-written text published to inform the public on matters of public interest, unless a person reviewed the text or an editor controls it. Providers of generative systems must mark outputs in a machine-readable way. Ordinary internal drafting, marketing copy that a person edits and published code are generally outside these duties.

How big are AI Act fines for an SME?

The ceilings are EUR 35 million or 7% of turnover for banned practices, EUR 15 million or 3% for most other duties, and EUR 7.5 million or 1% for misleading information. For SMEs the lower figure applies. A company with EUR 2 million turnover faces at most EUR 60,000 for an Article 50 breach. Authorities must also weigh gravity, intent and cooperation.

Who enforces the AI Act in Romania?

A Government memorandum proposed ANCOM as market surveillance authority and single point of contact, with ASF, BNR and ANSPDCP covering some high-risk areas. ANCOM said on 24 July 2026 that sanctions need a national law still in drafting. We found no adoption by 4 October 2026. EU obligations still apply directly in the meantime.

EU AI Act Small Business Guide: What to Do in 2026

The EU AI Act small business rules in 2026: which dates moved after the omnibus, what tool users must do, when to label AI content, and the fines as written.

By Alexandru Secureanu4 October 20268 min read

The EU AI Act small business rules for 2026 are short. If you only use AI tools such as ChatGPT or Copilot, you must support your staff's AI literacy, avoid banned practices, and label realistic deepfakes and unreviewed AI text on public-interest topics that you publish. If you run a chatbot on your website, you must also tell people it is an AI. Rules for high-risk uses such as CV screening and credit scoring now apply from 2 December 2027. This is general information, not legal advice.

Everything below was checked on 4 October 2026 against the official text and the European Commission's pages. Dates have moved before, so use the links in each section to confirm the current position.

What is the AI Act timeline in 2026, and what has changed?

The Act entered into force on 1 August 2024 and applies in stages. On 27 July 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force after the Council's final approval on 29 June 2026. It postponed the high-risk rules and left the transparency rules on schedule. This is the current calendar, taken from the Commission's AI Act Service Desk and the amending regulation.

Date	What applies
2 February 2025	Definitions, the AI literacy duty and the list of banned practices
2 August 2025	Duties for providers of general-purpose AI models start, EU governance bodies are set up, and Member States must name authorities and set penalty rules
2 August 2026	Most remaining rules, including Article 50 transparency, with national and EU enforcement of AI literacy, bans, transparency and general-purpose AI
2 December 2026	Grace period ends for marking AI-generated content in systems already on the market on 2 August 2026, and new bans on AI that generates non-consensual intimate content or child sexual abuse material
2 August 2027	National AI regulatory sandboxes due
2 December 2027	High-risk systems in Annex III (employment, education, credit, biometrics and more), postponed from 2 August 2026
2 August 2028	High-risk AI that is a safety component of products under Annex I, postponed from 2 August 2027

Three other changes matter to small firms. Article 4 on AI literacy now asks providers and deployers to take measures that support the development of AI literacy, where before it asked them to ensure a sufficient level. Small mid-cap companies, those with fewer than 750 employees, now share some SME relief, including the lower-of rule for fines. And Article 50 was not postponed.

Does the AI Act apply if you only use ChatGPT, Copilot or Gemini?

Yes. A business that uses an AI system under its own authority for professional purposes is a deployer, as the Commission's Article 50 FAQ explains. Employees who work under the company's instructions are not separate deployers; the company is. Your role decides what you owe.

What you do	Your role	Main duties	When
Use ChatGPT, Copilot or Gemini inside the company	Deployer	Support staff AI literacy, avoid banned practices, label realistic deepfakes and unreviewed public-interest AI text you publish	Literacy and bans since 2 February 2025, enforced from 2 August 2026; labelling from 2 August 2026
Put a chatbot or voice agent on your site	Provider of that system	Tell users they are dealing with an AI, unless it is obvious	2 August 2026
Ship a tool that generates text, images, audio or video	Provider	Mark outputs in a machine-readable format so they can be detected	2 August 2026, or 2 December 2026 for systems already on the market
Use AI for CV screening, performance scoring or credit decisions	Deployer of a high-risk system	Follow the provider's instructions, assign human oversight, keep logs, inform workers	2 December 2027
Build, rebrand or repurpose a high-risk system	Provider	Full provider duties under Article 16	2 December 2027 (Annex III) or 2 August 2028 (Annex I)

You can become a provider without training a model. Under Article 25, a deployer or reseller becomes the provider of a high-risk system if it puts its own name on it, makes a substantial modification, or changes the purpose of an AI system so that it becomes high-risk. Deployers of high-risk systems have their own duties under Article 26: use the system as instructed, give trained people oversight, monitor it, keep logs for at least six months and inform affected workers.

What are the AI Act risk categories?

The Commission describes four levels: banned, high-risk, transparency risk and minimal risk. Most current uses are minimal and have no AI Act rules. Examples make the levels concrete:

Banned: manipulation that causes significant harm, social scoring, emotion recognition in workplaces and schools, untargeted scraping of faces, and from 2 December 2026 AI that creates non-consensual intimate images or child abuse material.
High-risk: the eight areas of Annex III, among them recruitment and candidate evaluation, task allocation and monitoring of workers, credit scoring, life and health insurance pricing, and student assessment.
Transparency: a website chatbot, an AI voice agent, a generative tool, a realistic deepfake in an advert.
Minimal: spam filters, internal drafting help, stock forecasting.

What does the AI literacy duty require today?

The rewritten Article 4 tells providers and deployers to take measures that support AI literacy among staff and others who use AI systems on their behalf, taking into account their knowledge, the context and the people affected. It adds that the duty does not require guaranteeing any specific level for any individual. The Commission's AI literacy Q&A says there is no certificate, training is not strictly mandatory, and you may keep an internal record of trainings or other initiatives. It also says people who use tools such as ChatGPT should know specific risks, for example hallucination.

Article 4 is not listed in the fine tiers of Article 99, so national rules set the penalty. The Q&A says enforcement is more likely when an incident traces back to missing training. Our reading: a one-page policy and a short session with a dated attendance record is a proportionate response for a ten-person company.

When must you tell people that a chat or content is AI-made?

Article 50 applies from 2 August 2026. The Commission published its guidelines on Article 50 on 20 July 2026, with formal adoption to follow once all language versions exist. In practice:

Chatbots and voice agents (Article 50(1)). Providers must design the system so people know they are dealing with an AI, unless that is obvious. The notice must come at the latest at the first interaction.
Marking generated content (Article 50(2)). Providers of systems that generate audio, image, video or text must mark outputs in a machine-readable format. Source code and short strings of characters fall outside the rule. Systems already on the market before 2 August 2026 have until 2 December 2026.
Emotion recognition and biometric categorisation (Article 50(3)). Deployers must inform the people exposed to the system.
Deepfakes and public-interest text (Article 50(4)). Deployers must label deepfakes at first exposure. AI-written text published to inform the public on matters of public interest needs a label unless a person has reviewed it or an editor controls it and holds responsibility. Spell-checking does not count as review.

Content created before 2 August 2026 does not need retroactive labels. A voluntary code of practice on marking and labelling, assessed as adequate by the Commission and the AI Board, is the safest way to show compliance. Firms that skip it may face more information requests.

What penalties does the AI Act set?

Breach	Maximum fine
Banned practices (Article 5)	EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher
Most operator duties, including providers, deployers and Article 50 transparency	EUR 15,000,000 or 3%, whichever is higher
Incorrect or misleading information to authorities	EUR 7,500,000 or 1%, whichever is higher

For SMEs including start-ups, Article 99(6) turns whichever is higher into whichever is lower. The omnibus added the same lower-of rule for small mid-caps in the 3% and 1% tiers. For a company with EUR 2 million turnover, the ceiling for an Article 50 breach is therefore 3%, which is EUR 60,000, and for a banned practice 7%, which is EUR 140,000. These are maximums, and authorities must also weigh gravity, intent, size and cooperation.

In Romania, a Government memorandum dated 12 March 2026 proposed ANCOM as the national market surveillance authority and single point of contact. ANCOM said on 24 July 2026 that it and the other authorities can verify and sanction breaches only after a national implementing law, still in drafting, enters into force. We found no adoption of that law by 4 October 2026. The obligations apply directly under EU law, so a missing national law does not suspend them.

AI Act checklist for a small business

List every AI tool in use, including free personal accounts that staff use for work.
Check each use against the banned list and Annex III. HR screening, performance scoring and credit decisions need extra care.
Write a one-page AI-use policy, run a short training and keep a dated record.
Add a clear AI notice at the start of any website chatbot or voice agent.
Label realistic AI images, audio or video of real people or places, and AI text on public-interest topics that nobody has reviewed.
If you build or resell AI features, work out whether you are a provider and whether any feature is high-risk. Plan for 2 December 2027 and ask your model vendor for its AI Act documentation.
Check GDPR in parallel: processing agreements, and no customer personal data in free tools.
Diary the dates 2 December 2026 and 2 December 2027, and watch ANCOM for the national law.
Take any case that touches hiring, credit, health or biometrics to a lawyer before you launch.

This article is general information and not legal advice. For your own situation, ask a lawyer who works on the AI Act and data protection.

How can Danube Labs help?

Danube Labs is a software, AI and automation studio in Bucharest. We can map where AI sits in your workflows, build a chatbot or document pipeline with the notices and logging described above, and write up the result for your lawyer. We are not a law firm. See AI systems and IT and automation consulting, read the companion piece on AI adoption in Romanian SMEs, or book a free intro call.

Frequently asked questions

Does the EU AI Act apply to small businesses?: Yes. It covers providers and deployers of AI systems of any size, including small firms that only use tools such as ChatGPT. Size mainly changes the fines: for SMEs each fine is capped at the lower of the fixed amount and the percentage of turnover, and small mid-caps now get the same rule in the 15 million and 7.5 million tiers. The duties themselves are largely the same.
What must a company do if it only uses ChatGPT or Copilot?: It must take measures that support its staff's AI literacy, avoid banned practices such as emotion recognition at work, and label realistic deepfakes and unreviewed AI text on public-interest topics that it publishes. Using the tools internally does not trigger chatbot or marking duties, which fall on providers. A short policy, a short training and a dated record are a sensible start.
When do the AI Act high-risk rules apply?: Regulation (EU) 2026/1744, in force since 27 July 2026, moved the date for Annex III systems such as recruitment, education and credit scoring from 2 August 2026 to 2 December 2027. High-risk AI that is a safety component of regulated products under Annex I moves from 2 August 2027 to 2 August 2028. Banned practices and transparency duties were not postponed.
Do I have to label AI-generated content?: Only in defined cases. Deployers must label deepfakes and AI-written text published to inform the public on matters of public interest, unless a person reviewed the text or an editor controls it. Providers of generative systems must mark outputs in a machine-readable way. Ordinary internal drafting, marketing copy that a person edits and published code are generally outside these duties.
How big are AI Act fines for an SME?: The ceilings are EUR 35 million or 7% of turnover for banned practices, EUR 15 million or 3% for most other duties, and EUR 7.5 million or 1% for misleading information. For SMEs the lower figure applies. A company with EUR 2 million turnover faces at most EUR 60,000 for an Article 50 breach. Authorities must also weigh gravity, intent and cooperation.
Who enforces the AI Act in Romania?: A Government memorandum proposed ANCOM as market surveillance authority and single point of contact, with ASF, BNR and ANSPDCP covering some high-risk areas. ANCOM said on 24 July 2026 that sanctions need a national law still in drafting. We found no adoption by 4 October 2026. EU obligations still apply directly in the meantime.