AI Act for SMEs

01The short answer

The question this actually starts with in practice: can you put customer data into AI? Yes, you can. The AI Act doesn't prohibit that. The regulation does ask three things of you: that you know which AI is used in your business, that the people who work with it understand what they're holding, and that a customer can tell when they're dealing with AI instead of a human.

The GDPR is separate from that, and stricter on this point: customer data may only go to a party you have a data processing agreement with. A free, public AI service that you simply paste a customer email into usually doesn't qualify. In practice, that's the real risk, not the AI Act.

02Which rules apply, and since when

The regulation didn't take effect in one day, but in stages. This is where things stand right now, after the July 2026 amendment.

03What changed in July

Just before the summer, Brussels amended the regulation again. That amendment, the Digital Omnibus, was published on 24 July 2026 and has applied since 27 July. The news coverage focused mostly on the postponement, but more happened than that. Three things matter for you.

• The heavy requirements for high-risk systems were pushed back to December 2027 and August 2028. For most SMEs this changes little, since those requirements never applied to ordinary office work anyway.
• The AI literacy requirement became a bit more lenient. Before, you had to guarantee a sufficient level of knowledge; now you have to take measures that support that level of knowledge. The obligation still stands, but you're no longer judged on the result per individual. The European Commission will also publish practical examples, specifically for SMEs too.
• The transparency rules got one extension. AI systems that were already on the market before 2 August 2026 have until 2 December 2026 for the machine-readable marking of AI-generated material. That's an obligation for the makers of those systems, not for you as the user.

So the core stays exactly the same: a customer must be able to tell they're dealing with AI, and your people must understand what they're working with.

04What the law now asks of you

Most businesses started on this later than the law did. That's not a reproach: research from the Dutch Chamber of Commerce (KVK) shows that three in ten Dutch businesses use generative AI, while only 7 percent say they're well informed about the AI Act. And Statistics Netherlands (CBS) has measured for years that lack of experience is by far the biggest reason not to start with AI, at 74.6 percent. The problem is unfamiliarity, not unwillingness. So here are the three things it comes down to for you.

That last rule surprises a lot of people, so it deserves an explanation. The labelling requirement for AI-generated text only applies to text intended to inform the public about matters of general interest — think news articles. And even then the obligation lapses when a human reviews the text's content before it goes out, and takes responsibility for it. So a quote you draft with AI and proofread yourself doesn't need a stamp.

Meanwhile, it's already happening

KPMG researched how working people use AI worldwide. Just over half, 58 percent, use AI at work. Of that group, 73 percent use general-purpose AI services and 70 percent use free, publicly accessible versions. Work through the numbers and you land at roughly four in ten working people using free, public AI for their work.

That's where the real risk sits, and it predates the AI Act. Someone pastes a complaint email into a chat window to turn it into a polite reply. Someone has a quote summarised. All understandable, and meanwhile customer information goes to a party the business has no agreement with. That's not an AI Act problem, that's a GDPR problem. And it's largely covered by a single team agreement.

05The law goes easier on smaller businesses

This part gets skipped almost everywhere, even though it's exactly the reassuring bit. The regulation explicitly distinguishes on a few points between a large business and an SME.

• The fine caps are lower for SMEs. Where the law names an amount and a revenue percentage, SMEs and start-ups pay whichever of the two is lower. So the amounts from the headlines aren't the amounts you need to plan for.
• The paperwork is lighter if you ever provide AI yourself. Smaller businesses may submit the technical documentation for a high-risk system in simplified form. This only comes into play once you build AI yourself or offer it under your own name, not while you're simply buying in software.
• You get priority in the supervisor's testing environment. Every member state must set up an environment where businesses can test AI under supervision. SMEs get priority there and generally pay no participation fees.

The common thread: the legislator distinguishes between businesses that build AI and businesses that use AI. If you buy in and use, the heavy lifting sits with your supplier. Your part is keeping an overview, bringing your people along, and not leaving your customer in the dark.

06Where you can start this week

Four steps, roughly half a day together. Nothing more needs to happen in the first week.

1. Make the list.

   Ask each department which AI services are being used, including the built-in features that aren't called AI. Without this overview, every next step is guesswork.

2. Agree what is and isn't allowed in AI.

   One rule is enough to start with: no customer or personal data in AI services we don't have a business agreement with. Write down what is allowed too, or the rule gets ignored.

3. Review your customer contact points.

   Could a customer think somewhere that they're talking to a human when it's AI, for example in a chatbot on your website? If so, add a clear notice.

4. Plan the first team briefing, and record that it happened.

   Start with the people who work with AI daily. What does the system do, where does it go wrong, and when do you not simply trust an answer.

07How we've approached it at Raydo

We're building a digital colleague ourselves, so these rules apply to us too. Here's how we built Raydo.

Raydo runs on European infrastructure. The compute sits with Scaleway, the models come from providers including Mistral. Your data stays yours and doesn't go to anyone else to train a model with. Sovereignty isn't a luxury, it's just how it should be.

Every outcome carries its source. Underneath every message is where it came from: which systems, how many emails, which filing. You can check it without having to take our word for it.

Nothing goes to a customer without you having seen it. An outgoing message is always a draft first. You press send, per message.

And Raydo says so itself. A first message to someone outside your business states underneath that it was drafted by an AI colleague, in the recipient's language. That's Article 50, and it's the reason this page exists.

You can read what that looks like in practice on the security page and on how it works.

08Frequently asked questions