The EU AI Act and SMEs: what applies since 2 August

Published on 15 September 2026

Position as at 15 September 2026. This note relies on Regulation (EU) 2024/1689 (the EU AI Act) and on the so-called AI Digital Omnibus, which is now law in force: Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal of the European Union on 24 July 2026 and in force since 27 July. What follows already incorporates its changes.

2 August 2026 is the date of "general application" of the EU AI Act (Article 113 of Regulation (EU) 2024/1689). Around that date a simplified message has taken hold: that "everything arrives" that day. For an SME that uses AI (uses it, rather than develops it), including foreign-owned businesses operating in Spain, the real map has three layers, and they are worth telling apart because each one asks something different of you.

What was already in force, and 2 August does not change

The Act's first two chapters have applied since 2 February 2025 (Article 113(a)). They contain the prohibited practices of Article 5 and, most relevantly for a business that uses AI, the AI literacy duty of Article 4, binding since that date. What did change, on 27 July 2026, is its intensity: where the 2024 text asked providers and deployers to "ensure" that their staff had "a sufficient level of AI literacy", the wording now in force asks them to "take measures to support the promotion" of that literacy, and states expressly that it does not require any specific level to be guaranteed in any particular person. The duty remains, and in practice it still asks for the same thing: basic, documented training for the people who work with these tools. It is not a recommendation.

The European ceiling on fines also predates August: the penalties chapter has applied since 2 August 2025 (Article 113(b)). Article 99 sets three tiers, from most to least serious: up to 35 million euros or 7 % of worldwide turnover for prohibited practices, up to 15 million or 3 % for most other obligations (the transparency duties of Article 50 fall here) and up to 7.5 million or 1 % for supplying incorrect information. And there is a rule for SMEs that is rarely quoted (Article 99(6)): between the two references, percentage or amount, the lower one applies, not the higher.

What started on 2 August

For a business that uses AI, the centrepiece that became applicable on 2 August 2026 was the transparency regime of Article 50. Three everyday situations:

• The chatbot. AI systems that interact directly with people must be designed so that the person knows they are talking to a machine (Article 50(1)). The design duty falls on the provider; if the chatbot on your website is a third party's, now is the moment to check that it complies and to reflect that in the contract.
• Generated content. Providers of systems that generate synthetic audio, image, video or text must mark the output in a machine-readable format, detectable as artificial (Article 50(2)).
• What you publish. Whoever deploys a system that generates or manipulates a deepfake must disclose that the content is artificial, and whoever publishes AI-generated text to inform the public on matters of public interest must disclose that too (Article 50(4)).

The rest of what started in August (governance, registration, market surveillance) weighs more on providers and public authorities than on the SME that merely uses AI.

What the Digital Omnibus postponed (and is now in the Official Journal)

The Digital Omnibus adjusts the calendar and some obligations:

• High risk, postponed. The obligations for high-risk systems under Annex III (recruitment, access to credit, education…) move to 2 December 2027; those for systems embedded in regulated products under Annex I, to 2 August 2028 (point (c) of Article 113, as replaced). If your internal roadmap had "August 2026" pencilled in for this, change the date, but do not delete the entry.
• Marking, with a transition. Systems generating synthetic content placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking duty of Article 50(2) (new Article 111(4)).
• New prohibitions. Two new points, (ba) and (bb), are added to Article 5: non-consensual intimate deepfakes, and the material or performances referred to in Article 2(c) and (e) of Directive 2011/93/EU. They apply from 2 December 2026.
• AI literacy is softened, and that already applies. Article 4 was replaced on 27 July 2026: "ensuring a sufficient level" becomes "taking measures to support the promotion" of AI literacy, without requiring any specific level to be guaranteed. Unlike the postponements above, this change is not waiting for a future date: it is the wording binding today.

Who enforces this in Spain?

The state agency exists and is operating: AESIA, the Spanish agency for the supervision of artificial intelligence, created by Royal Decree 729/2023 of 22 August. What Spain does not yet have is its accompanying statute: the Organic Law Bill on the sound use and governance of artificial intelligence is still before Parliament and, as this note closes, no such law has been published in the BOE (Spain's official State gazette). That law will complete the designation of national authorities required by Article 70 of the Act and the domestic penalty regime. The prudent reading, especially if you run a business in Spain from abroad: the absence of a Spanish statute does not suspend the European obligations, which are directly applicable.

What an SME should already have in place

• An inventory of the AI systems in use, even a simple sheet: which tool, what for, who operates it, what data it touches.
• Basic, documented training for the staff who use them (Article 4).
• Transparency in order if you run a chatbot or publish generated content: the notices and labels of Article 50, and the provider contract reviewed.
• The calendar noted: 2 December 2026 (marking and new prohibitions), 2 December 2027 and 2 August 2028 (high risk).

How I approach it

In a field that changes every week, my method is the usual one, applied with all the more reason: I check the actual state of the rule at the date that matters, I verify every citation against the Official Journal and the BOE before relying on it, and I take none of them on memory. It is the same discipline I apply to artificial intelligence inside my own practice, under a written working method. If your business uses AI, I can help you draw up that inventory and review the contract with your chatbot provider or with whoever supplies the tools you use: write to me, or see first how I handle business law matters.

Editorial responsibility: Carles Jiménez, attorney-at-law (Barcelona Bar No. 34.946). This note was prepared with the assistance of artificial-intelligence tools and reviewed and approved by the author before publication.

Back to News