AI Act compliance · SMEs
The AI Act is already in force. Find out in 2 minutes what you have to do.
A free diagnostic of the EU AI Act, built for SMEs. You answer a few questions and we tell you where you stand, what you have outstanding and where to start. No sign-up to see the result.
Who it binds
It does not matter whether you build AI. What matters is what you use it for
The AI Act applies to any European company that uses or develops AI systems, SMEs included. And it is not something still to come: the prohibited practices and the AI literacy obligation (Art. 4) have been in force since February 2025. Transparency (Art. 50) applies from 2 August 2026, and Annex III high risk from 2 December 2027. More than 60 % of European SMEs have not yet started preparing.
The point is not whether you build AI, but what you use it for: hiring staff, scoring customers, running chatbots or generating content each carry different obligations.
How the law classifies
Four levels. Most SMEs are in the first two
Minimal risk
Internal use that does not affect people: productivity tools, summaries, drafts. No special obligations beyond training your team.
Limited risk
Chatbots or AI-generated content. The obligation is transparency (art. 50): telling people that they are dealing with an AI, or that the content is artificial. It applies from 2 August 2026. If your system was already on the market before that date, you have until 2 December 2026 to bring the marking of its outputs into line.
High risk
Sensitive uses such as staff selection, granting credit or biometric identification (Annex III). Strict requirements and a study made to measure. They apply from 2 December 2027.
Prohibited
Uses banned by the regulation, such as social scoring of people. They are not permitted under any circumstances.
The diagnostic
Answer a few questions and you will know exactly where you stand
The diagnostic below runs in Spanish only: its questions, and the report it returns, have not been translated yet. If you would rather go through it in English, write to us and we will do it with you.
What follows is a diagnostic produced by an AI system from your answers. The classification is computed by fixed rules; the text around it is written by a model.
Pregunta 1 de 7
Why Kairos
The team that advised Europol and the European Commission, applied to your compliance
We have advised Europol, the European Commission and Banco de España, trained more than 12 institutions and shipped AI products to production. That same judgement is what we apply to help you comply with the AI Act without over-engineering it.
Frequently asked questions
What SMEs ask about the AI Act
Does the AI Act affect my SME?
Yes. The EU AI Act applies to any company that uses or develops AI systems in the EU, whatever its size. There are obligations in force already: the prohibited practices and AI literacy (Art. 4) since February 2025. The transparency obligations (Art. 50) apply from 2 August 2026, and the Annex III high-risk ones from 2 December 2027.
What do I have to do, and when?
The prohibited practices and your team's AI literacy already apply to you today (Art. 4, in force since February 2025). The transparency obligations apply from 2 August 2026, so if you use chatbots or generate content they already reach you. If your generative system was already on the market before that date, you have until 2 December 2026 to bring the marking of its outputs into line. And you have until 2 December 2027 to prepare the Annex III high-risk uses, if that is your case. Start by taking stock of which AI systems you use and what for: the diagnostic on this page returns your concrete outstanding items.
What is the AI literacy obligation (Art. 4)?
Art. 4 asks providers and companies using AI to take measures to promote AI literacy among those operating those systems on their behalf, taking into account their training and their context of use. It is an obligation of means, not of result: it does not require a certificate, it requires you to take measures. Documented training is the usual way to show you have taken them. It has been in force since February 2025; Regulation (EU) 2026/1744 softened its wording, but neither removed nor postponed it.
Do I need a lawyer to comply with the AI Act?
For most SMEs, no. What you need is a clear picture of which systems you use, what for, and what training sits behind them, and that is work we do ourselves. When a case does call for specialist legal review, you do not have to go looking for it: we arrange it as part of the engagement. A first indicative diagnostic you can get here in minutes, free.
What if I use ChatGPT or a chatbot in my company?
Using generative AI tools or chatbots usually places you at the limited-risk level, with transparency obligations (Art. 50): telling people that they are interacting with AI, or that a piece of content is AI-generated. The diagnostic detects it and tells you.
Is the AI Act the same as the GDPR? Does complying with one cover the other?
No. They are distinct, simultaneous legal frameworks. The AI Act looks at the use and the purpose of the AI; the GDPR looks at the processing of personal data. Complying with one does not cover the other: you can be fine on the AI Act and still have a data protection matter.
How much does it cost an SME to comply with the AI Act?
It depends on your risk level. For most minimal- or limited-risk SMEs, the cost is mostly organisation and documentation. The diagnostic and the basic documentation on this page are free; they help you work out where to start before investing in anything.
And also, bear this in mind
The AI Act and the GDPR are not the same thing
If you use AI with people's data (customers, case files, health data), the GDPR comes into play as well as the AI Act. They are distinct, simultaneous legal frameworks: the AI Act looks at the use and the purpose of the AI; the GDPR looks at the processing of personal data.
The GDPR is approached differently, with its own logic. It is a matter the AI Act does not resolve and which needs another approach. If your diagnostic detects personal or sensitive data in AI, we will point it out, and we will tell you.
Unsure where you stand with the AI Act?
Start with the free diagnostic, or write to us and we will go through it with you.