The EU AI Act and SMEs: 2 August

Published on 15 July 2026

Position as at 15 July 2026. This note relies on Regulation (EU) 2024/1689 (the EU AI Act) in its consolidated version and on the already signed text (8 July 2026) of the so-called AI Digital Omnibus which, at the time of writing, is awaiting publication in the Official Journal of the European Union and will enter into force three days after publication. That may happen any day; what follows takes it into account.

2 August 2026 is the date of "general application" of the EU AI Act (Article 113 of Regulation (EU) 2024/1689). Around that date a simplified message has taken hold: that "everything arrives" that day. For an SME that uses AI (uses it, rather than develops it) — including foreign-owned businesses operating in Spain — the real map has three layers, and they are worth telling apart because each one asks something different of you.

What was already in force, and 2 August does not change

The Act's first two chapters have applied since 2 February 2025 (Article 113(a)). They contain the prohibited practices of Article 5 and, most relevantly for a business that uses AI, the AI literacy duty of Article 4: providers and deployers of AI systems must see to it that their staff have "a sufficient level of AI literacy", taking account of their training and the context of use. In practice: basic, documented training for the people who work with these tools. It is not a recommendation; it has been binding for a year and a half.

The European ceiling on fines also predates August: the penalties chapter has applied since 2 August 2025 (Article 113(b)). Article 99 provides for fines of up to 35 million euros or 7 % of worldwide turnover for prohibited practices, up to 15 million or 3 % for most other obligations (including the transparency duties of Article 50) and up to 7.5 million or 1 % for supplying incorrect information. For SMEs there is a specific rule that is rarely quoted (Article 99(6)): of the two references, percentage or amount, the lower one applies, not the higher.

What does start on 2 August

For a business that uses AI, the centrepiece becoming applicable on 2 August 2026 is the transparency regime of Article 50. Three everyday situations:

• The chatbot. AI systems that interact directly with people must be designed so that the person knows they are talking to a machine (Article 50(1)). The design duty falls on the provider; if the chatbot on your website is a third party's, now is the moment to check that it complies and to reflect that in the contract.
• Generated content. Providers of systems that generate synthetic audio, image, video or text must mark the output in a machine-readable format, detectable as artificial (Article 50(2)).
• What you publish. Whoever deploys a system that generates or manipulates a deepfake must disclose that the content is artificial, and whoever publishes AI-generated text to inform the public on matters of public interest must disclose that too (Article 50(4)).

The rest of what starts in August (governance, registration, market surveillance) weighs more on providers and public authorities than on the SME that merely uses AI.

What has just been postponed (and is not yet in the Official Journal)

The AI Digital Omnibus, signed on 8 July 2026 and awaiting publication at the date of this note, adjusts the calendar and some obligations:

• High risk, postponed. The obligations for high-risk systems under Annex III (recruitment, access to credit, education…) move to 2 December 2027; those for systems embedded in regulated products under Annex I, to 2 August 2028 (new point (c) of Article 113). If your internal roadmap had "August 2026" pencilled in for this, change the date, but do not delete the entry.
• Marking, with a transition. Systems generating synthetic content placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking duty of Article 50(2) (new Article 111(4)).
• New prohibitions. Non-consensual intimate deepfakes and the material referred to in Article 2 of Directive 2011/93/EU are added to Article 5, applicable from 2 December 2026.
• AI literacy is softened. Article 4 is replaced: "ensuring a sufficient level" becomes "taking measures to support the promotion" of AI literacy, without requiring any specific level to be guaranteed. Mind the timing: until the Omnibus is published, the binding wording remains that of 2024.

Who enforces this in Spain?

The state agency exists and is operating: AESIA, the Spanish agency for the supervision of artificial intelligence, created by Royal Decree 729/2023 of 22 August. What Spain does not yet have is its accompanying statute: the Organic Law Bill on the sound use and governance of artificial intelligence is still before Parliament and, as this note closes, no such law has been published in the BOE (Spain's official State gazette). That law will complete the designation of national authorities required by Article 70 of the Act and the domestic penalty regime. The prudent reading, especially if you run a business in Spain from abroad: the absence of a Spanish statute does not suspend the European obligations, which are directly applicable.

What an SME should have in place on 3 August

• An inventory of the AI systems in use, even a simple sheet: which tool, what for, who operates it, what data it touches.
• Basic, documented training for the staff who use them (Article 4).
• Transparency in order if you run a chatbot or publish generated content: the notices and labels of Article 50, and the provider contract reviewed.
• The calendar noted: 2 December 2026 (marking and new prohibitions), 2 December 2027 and 2 August 2028 (high risk).

How I approach it

In a field that changes every week, my method is the usual one, applied with all the more reason: I check the actual state of the rule at the date that matters, I verify every citation against the Official Journal and the BOE before relying on it, and I take none of them on memory. It is the same discipline I apply to artificial intelligence inside my own practice, under a written working method. If your business uses AI in Spain and you want to know where you stand (what is binding on you today and what to expect), you can see how I handle business law matters or write to me for an initial assessment.

Editorial responsibility: Carles Jiménez, attorney-at-law (Barcelona Bar No. 34.946). This note was prepared with the assistance of artificial-intelligence tools and reviewed and approved by the author before publication.

Back to News