1. General Framework: Which AI Systems Are Covered?
The AI Act (EU Regulation 2024/1689) classifies AI systems into four risk levels (F1):
- Unacceptable risk: Banned since February 2025 (e.g., behavioral manipulation, social scoring).
- High risk: Subject to strict obligations starting August 2, 2026. Examples:
- Biometric systems (facial recognition, fingerprints).
- Recruitment or employee evaluation tools.
- Medical devices integrating AI.
- Critical infrastructure systems (transport, energy).
- Limited risk: Transparency obligations (e.g., informing users they are interacting with AI).
- Minimal risk: Exempted (e.g., spam filters).
For an SME, the priority is to determine if its systems fall under high risk. If so, the obligations below apply from August 2026 (F2).
2. Compliance Checklist for High-Risk Systems
Here are the concrete steps to follow, including simplifications for SMEs:
2.1. Technical Documentation and Compliance
- Simplified technical documentation:
- Use the form provided by the European Commission for SMEs (accepted by notified bodies) (F4).
- Minimum content to cover (Annex IV of the AI Act):
- System description (functionalities, architecture, data used).
- Risk management and cybersecurity measures.
- Human oversight and transparency procedures.
- Quality Management System (QMS):
- Implement a documented QMS, proportionate to your company’s size (F3). For an SME, this can be integrated into existing processes (e.g., ISO 9001).
- Key elements to include:
- Compliance strategy (system update procedures).
- Data management (sources, potential biases, protection).
- Post-market monitoring (incident reporting).
- Clear responsibilities within the team.
2.2. Conformity Assessment and CE Marking
- Conformity assessment:
- Demonstrate that your system complies with Articles 8 to 15 of the AI Act (e.g., transparency, robustness, cybersecurity) (F6).
- This assessment can be internal for SMEs, unless the system is integrated into a regulated product (e.g., medical device).
- CE marking:
- Affixed the CE marking to your system or its documentation before market release (F2).
- Include your contact details to allow authorities to reach you.
2.3. Registration and Traceability
- Registration in the EU database:
- Register your system in the official EU database before deployment (F2).
- Record retention:
- Keep technical documentation and system logs for 10 years (F6).
- Ensure a mechanism to provide these records to authorities upon request.
2.4. Risk Management and Transparency
- Risk management system:
- Document identified risks (e.g., biases, prediction errors) and mitigation measures (F2).
- Update this system regularly.
- Human oversight:
- Designate a person responsible for overseeing the system before deployment (F2).
- Provide them with the tools and information needed to supervise the system.
- Transparency for users:
- Provide a clear notice explaining the system’s operation, limitations, and user rights (e.g., right to contest) (F2).
3. Support and Simplifications for SMEs
SMEs benefit from specific measures to ease compliance (F5):
- Regulatory sandboxes:
- Free access to controlled environments to test and develop your AI systems.
- Ideal for validating compliance before market release.
- Streamlined documentation:
- Use the simplified form from the European Commission for technical documentation (F4).
- Representation in advisory bodies:
- SMEs are represented in the AI Act’s advisory forum to advocate for their interests.
4. Timeline and Next Steps
Here are the key deadlines to meet (F7):
- August 2, 2026: Obligations for high-risk AI systems come into effect.
- Before this date:
- Identify if your systems qualify as high-risk.
- Prepare technical documentation and the QMS.
- Test your system in a regulatory sandbox if possible.
- Conduct the conformity assessment and obtain CE marking.
5. Penalties and Source Limitations
Non-compliance may result in administrative penalties, but the sources do not specify exact amounts for SMEs (F8). Fines vary based on:
- Company size (SMEs benefit from proportionate measures).
- Risk type (higher for critical systems).
For further reading, check our detailed article on AI Act obligations or our guide to AI implementation for businesses.