A Practical Guide for Companies Using AI in Europe
The EU AI Act introduces the world’s first comprehensive legal framework governing artificial intelligence.
While the regulation is often discussed in the context of large technology companies, small and medium-sized enterprises (SMEs) will also face concrete obligations when they develop, deploy, or use AI systems.
For many businesses the challenge is not the law itself — it is understanding what practical steps must be taken to ensure compliance.
This guide provides a clear and practical AI Act compliance checklist for SMEs, explaining what companies should verify before deploying or using AI systems.
Later in this guide you will also find the downloadable AI Act Compliance Checklist tool, designed to help companies conduct their first internal assessment.
Why SMEs Should Care About the AI Act
Many SMEs assume the regulation only targets large AI developers. In reality, the AI Act applies broadly to:
- companies developing AI systems
- companies integrating AI into products
- companies deploying AI tools in their operations
For example:
Logistics company
A logistics SME using AI software to optimize delivery routes may not be an AI developer — but it is still a deployer of AI systems under the regulation.
HR software provider
A company selling AI recruitment tools may qualify as a provider of high-risk AI systems, triggering stricter compliance requirements.
Marketing agency
A marketing agency using generative AI for content production must comply with transparency obligations.
In other words: many SMEs interact with AI in ways that bring them under the scope of the AI Act.
Step 1: Identify All AI Systems Used in Your Company
The first step is surprisingly simple: identify where AI is used.
Many companies underestimate how widely AI tools are already embedded in daily operations.
Examples include:
- HR recruitment software
- fraud detection tools
- predictive maintenance systems
- generative AI writing tools
- recommendation engines
- automated credit scoring systems
Practical tip
Create a simple internal AI inventory.
For each system document:
- system name
- vendor/provider
- business function
- whether the AI makes or influences decisions about people
This inventory becomes the foundation of your AI governance process.
Step 2: Determine the AI System’s Risk Category
The AI Act regulates systems according to four levels of risk:
- Unacceptable risk – prohibited
- High risk – strict compliance obligations
- Limited risk – transparency obligations
- Minimal risk – no major regulatory burden
Most SMEs will encounter two categories:
Examples:
- AI used for recruitment or employee evaluation
- AI used in creditworthiness assessment
- AI used in education or exam evaluation
These systems fall under Annex III of the AI Act and require formal compliance procedures.
Limited-risk systems
Examples:
- chatbots interacting with customers
- AI generating marketing content
- AI used in recommendation systems
These require transparency toward users.
Practical tip
If a system affects people’s rights or opportunities, there is a high probability it falls under high-risk classification.
Step 3: Check Your Role Under the AI Act
Companies often assume compliance is the responsibility of the software vendor.
That is not always the case.
The AI Act defines several roles:
- Provider – develops or places AI systems on the market
- Deployer – uses AI systems internally
- Importer
- Distributor
Most SMEs will be deployers, but if they modify or integrate AI into their own products they may become providers.
Example
A startup integrates a third-party AI model into its HR software product.
Even if it did not build the AI model itself, the company may legally become an AI provider under the AI Act.
This significantly increases compliance obligations.
Step 4: Verify High-Risk Compliance Requirements
If a system qualifies as high risk, several requirements apply.
Key obligations include:
Companies must identify and mitigate potential risks associated with the AI system.
Example:
An HR AI tool should be evaluated for bias against gender or ethnicity.
Training data must be relevant, representative, and free from errors.
Providers must produce documentation allowing regulators to understand how the system works.
AI systems must not operate without meaningful human control.
Example:
An automated credit scoring tool should not be the sole decision-maker for loan approval.
Step 5: Ensure Transparency Where Required
For many SMEs, transparency obligations will be the most common compliance requirement.
Users must be informed when they interact with AI systems.
Examples:
- a chatbot must clearly disclose it is AI
- AI-generated content should be identifiable
- deepfake-style synthetic media must be labeled
Practical example
A customer service chatbot should start conversations with a message such as:
“You are interacting with an AI-powered assistant.”
This simple disclosure may satisfy AI Act transparency requirements.
Step 6: Establish Internal AI Governance
Compliance is not a one-time exercise.
Companies should establish basic AI governance procedures.
Practical measures include:
- appointing a person responsible for AI oversight
- maintaining an AI systems inventory
- reviewing AI systems periodically
- training staff about AI risks and limitations
Even small companies benefit from simple governance structures.
In practice, many SMEs will integrate AI oversight into existing compliance or IT management roles.
Step 7: Monitor Future AI Act Obligations
The AI Act will not apply all at once.
The regulation will enter into force in phases over several years, with some obligations applying earlier than others.
Companies should therefore monitor:
- regulatory guidance from the European Commission
- national supervisory authorities
- updates to Annex III high-risk categories
Risk classifications may evolve over time.
The AI Act Compliance Checklist Tool
Understanding the regulation is one thing.
Applying it inside an organization is another.
To make this process easier, this platform provides a structured AI Act Compliance Checklist for SMEs.
The checklist helps companies:
- map AI systems used internally
- determine risk classifications
- identify potential compliance obligations
- document initial governance steps
👉 Access the tool:
AI Act Compliance Checklist for SMEs
Final Thoughts
For SMEs, AI Act compliance does not necessarily require large legal teams or complex regulatory departments.
What it requires is structured awareness.
Companies that begin early with simple steps — such as building an AI inventory and assessing risk levels — will be far better prepared once enforcement becomes fully operational.
In practice, the companies that start compliance before regulators start enforcement will face the lowest costs and the least disruption.
