.png){kind=icon}
EU AI Act: what does your SME need to arrange in 2026?
The EU AI Act takes full effect on 2 August 2026. Find out what this means for your business and how you can start preparing right now.
AI rules since August 2026: what applies now and what has been postponed
Since 2 August 2026 the transparency obligations of the EU AI Regulation (AI Act) have applied. The strictest rules, for high-risk systems, were postponed in July 2026 through the Digital Omnibus to December 2027 and August 2028. Do you use AI tools in your business? Then you are dealing with rules around transparency, documentation and knowledge within your team. For most SMEs the obligations are manageable. In this article you will read what applies now, what you can do and how accounting software can help you with it.
Updated on 7 September 2026: the Digital Omnibus (postponement of the high-risk rules), the marking deadline of 2 December 2026, Dutch supervision and Guideline 2 from NBA and NOREA.
What does the EU AI Regulation involve?
The AI Act is the first comprehensive AI legislation in the world. Its goal is to make AI systems reliable and safe without blocking innovation. The law divides AI systems into four risk levels:
| Risk level | Example | Consequence |
|---|---|---|
| Unacceptable | Social credit system | Banned |
| High risk | Medical diagnosis, credit scoring | Strict requirements for documentation and supervision |
| Limited risk | Chatbots, AI assistants | You must inform users |
| Minimal risk | Spam filters, recommendations | No obligations |
Which category applies to you as an SME?
Most SMEs use AI tools with limited risk, such as chatbots, AI assistants for your administration, or automated analyses. An AI assistant on your accounting does not fall under high risk. Annex III of the law mentions applications such as recruitment, credit assessment, education and critical infrastructure. Three obligations apply to AI with limited risk:
Transparency obligation
Let users know that they are communicating with an AI system. Do you generate AI content for your business? Then make it clear that it was created by AI. This obligation (article 50) has applied since 2 August 2026 and has not been postponed. On 2 December 2026 the transitional arrangement for already existing systems that generate synthetic content also ends. From that date their output must be marked in a machine-readable way.
Documentation obligation
Record which AI systems you use, what you use them for and which measures you take to limit risks.
AI literacy
Employees who work with AI must have enough knowledge to use it responsibly. This does not have to be a formal training. An internal manual or a short training is sufficient. This obligation (article 4) has applied since 2 February 2025.
What do you need to do? Four steps
1. Map out your AI use
Make a list of all the AI tools your business uses:
- ChatGPT, Claude or other AI assistants
- Automated analyses or reports
- Chatbots on your website
- AI features in existing software (such as your accounting software)
2. Determine the risk level
Classify each tool in the right risk category. For most business applications (administration, customer service, analyses) limited risk applies.
3. Record everything
Document for each AI tool:
- What it does and what you use it for
- Which data it processes
- Who has access to it
- Which measures you take (confirmation for changes, logging of actions, etc.)
4. Inform your team
Make sure your employees know:
- Which AI tools are available
- How to use them responsibly
- What the limitations are
- Where they can go with questions
How does a good AI connector help with compliance?
A professionally set up AI connector with your accounting software already takes part of the obligations off your hands. Curious how such a connector protects your data? Read our article about the security of accounting data with AI connectors.
| Requirement | How a good connector solves this |
|---|---|
| Transparency | Every change requires confirmation before it is applied |
| Logging of actions | All requests and actions automatically end up in an audit log |
| Security | Secure login procedure, encryption and ISO 27001 certification |
| Control | You always stay in charge of what happens |
Our experience is that companies that set up their AI connector properly already meet the majority of the obligations without extra administrative work.
For accountants there has also been Guideline 2 "AI applied" from the NBA and NOREA since 1 June 2026: AI must not be a black box, with requirements for validation, reproducibility and documentation. A connector that first has every change confirmed and keeps an audit trail fits right in.
What does it cost if you do not comply?
The fines are hefty:
- Up to 35 million euros or 7% of annual turnover for prohibited AI systems
- Up to 15 million euros or 3% for other violations
- Up to 7.5 million euros or 1.5% for providing incorrect information
For SMEs lower maximums apply, but the message is clear: take the rules seriously.
Timeline
| Date | What takes effect? |
|---|---|
| 2 February 2025 | Ban on unacceptable AI practices |
| 2 August 2025 | Rules for general-purpose AI (GPT-4, Claude, etc.) |
| 2 August 2026 | Transparency obligations (article 50) in force |
| 2 December 2026 | End of transitional arrangement: output from existing generative AI must be marked in a machine-readable way |
| 2 December 2027 | High-risk obligations for standalone systems (Annex III), postponed by the Digital Omnibus |
| 2 August 2028 | High-risk rules for AI in regulated products (Annex I) |
In the Netherlands the Dutch Data Protection Authority and the Dutch Authority for Digital Infrastructure exercise central supervision, alongside the sectoral supervisors; the Implementation Act for the AI Regulation was open for consultation in the spring of 2026.
Start today
The EU AI Regulation calls for preparation, but for most SMEs the steps are manageable: transparency, documentation and basic knowledge within your team. Start taking inventory now, because the transparency obligation already applies, the rules for high risk follow in 2027 and 2028.
Do you want to get started right away with an AI connector that is compliance-proof? Take a look at our step-by-step guide to get started in five minutes.
Want to try it yourself? Start for free with Exact AI Connect →
