The EU AI Act has not been postponed in full. The part covering high-risk systems was pushed back, while AI literacy, prohibited practices and transparency stay on their original timetable. This guide sets out what that means for a small or mid-sized business, with dates. It was last updated on 18 October 2026 and is general information, not legal advice.

Does it apply to a UK company?

The AI Act is EU law (Regulation (EU) 2024/1689). The UK is not an EU member and it does not apply directly to a business that operates only in the UK. It can matter if your business sells to, or serves customers in, the EU, or if the output of your AI is used there. Dutch companies are inside the EU and are covered. Whether it applies to your case depends on the facts, so take advice from your lawyer or adviser. We explain the rules; we do not give a legal opinion.

Obligations that already affect you

The Act is not only about whoever builds AI. It is also about whoever uses it. If someone on your team drafts with ChatGPT, translates with an automatic translator or designs with Canva, your company is one of those affected. For a small business, today the important points are:

Sufficient knowledge in the team (Article 4). People who use AI at work should know how it fails, what data never goes into it and who to ask. The Digital Omnibus reworded the scope of this article: it now speaks of taking measures to encourage that training, depending on the role and context of use. In practice, the sensible course is still to be able to show that you trained the team.
Avoid prohibited practices (Article 5). These include certain uses for manipulation or scoring of people. An ordinary small business rarely comes near them, but it helps to know where the line is.
Transparency (Article 50). If you put an AI assistant in front of customers, they must know it is an AI. Images, video or audio generated with AI are labelled as such where appropriate.
Know which AI you use. This is not a specific article, but without an inventory you cannot meet any of the above.

Key dates after the Digital Omnibus

Regulation (EU) 2026/1744, the "Digital Omnibus on AI", changed the timetable and entered into force on 27 July 2026. It now stands as follows:

2 February 2025: already in force. Prohibited practices and AI literacy (Article 4).
2 August 2025: already in force. Rules for general-purpose AI models and the governance regime.
2 August 2026: already in force. Transparency under Article 50 (telling people they are speaking to an AI and marking generated content).
2 December 2026: new prohibitions added by the Omnibus (intimate fake content without consent) and the end of the transitional period for marking on systems already on the market.
2 December 2027: postponed. High-risk systems in Annex III (employment, education, access to essential services and similar).
2 August 2028: postponed. High risk linked to regulated products (Annex I).

The practical reading: what weighs most on a small business that uses AI is already under way. What was postponed is high risk, which mainly affects those who use AI to select staff, score customers or decide on essential services.

Fines: what the Act says

The Regulation provides scaled penalties: higher for prohibited practices and lower for other breaches. For small businesses, the lower limit of each band applies, not the higher one. The detail of the penalty regime is developed by each member state, and each one designates its own supervisory authority. In Spain that is the AESIA, the Spanish AI supervisory agency.

We do not quote figures here, because what a breach would cost depends on which breach it is and on the national rules in force; for that, ask your adviser. What is within your control is being able to show that you acted: an inventory of the AI you use, training for the team and a written record.

What to do this week

Note which AI tools your team uses and for which tasks.
Check whether any use touches people (recruitment, evaluation) or talks to customers.
Train whoever uses it and record who and when.
Check that your website tells people about the AI where it should.

Frequently asked questions

Has the AI Act been postponed?

Only in part. The Digital Omnibus pushes high-risk systems to December 2027 and August 2028. Literacy, prohibitions and transparency follow their timetable.

Where do I start?

By finding out which AI is really used in your company and who uses it. With that inventory you can see what applies to you and organise team training, with a written record.

If you would like us to set it up with you, see our AI training for companies and, with the transparency kit included, our AI regulation compliance service. We deliver in writing and remotely. For an overview of the rest of our AI work, visit the AI agency page, or contact us. Sources: Regulation (EU) 2026/1744 and the consolidated text of Regulation (EU) 2024/1689, both on EUR-Lex.

EU AI Act for SMEs: What Applies and From When