Since February 2, 2025, every business using an AI system is required to have trained the people who use it day to day. That’s Article 4 of the EU’s AI Act, and it’s an obligation many SME leaders are discovering by reading this article rather than a legal newsletter. The regulation entered into force in August 2024 and has been rolling out in waves ever since, with the next major deadline landing on August 2, 2026. Understanding this timeline, and which role you occupy in it, keeps you from assuming this is a regulation reserved for the giants building the models.
A classification by use case, not a blanket law on artificial intelligence
Leaders are already tracking other AI-driven shifts, like the announced arrival of AI Overviews in France, which is redistributing businesses’ online visibility. The AI Act plays out on different ground: your legal liability for how you use AI. The regulation doesn’t govern the technology itself: it sorts use cases into four risk tiers, and most of your obligations depend on which tier your use case falls into.
- Prohibited: social scoring, subliminal manipulation, emotion recognition at work or school, real-time biometric identification in public spaces.
- High risk: recruitment, credit scoring, justice, education.
- Limited risk, subject to transparency rules: chatbots, deepfakes, AI-generated content.
- Minimal risk: the overwhelming majority of current use cases, unregulated.
An automated resume-screening tool falls into the second category. A customer service chatbot falls into the third. A spell checker or an image generator for your marketing visuals stays, for now, in the last one (source: artificialintelligenceact.eu). This use-based logic means the same technology can land in two different tiers depending on what you do with it, which is why the question to ask is never “am I using AI” but “what exactly does the tool I’m using do”.
A timeline rolling out in waves since 2024
The regulation entered into force in August 2024, but its obligations don’t all apply at once. Five dates structure the timeline:
- August 2024: the regulation enters into force.
- February 2, 2025: unacceptable practices are banned, and the AI literacy obligation (Article 4) takes effect, meaning training for staff who use AI.
- August 2025: a specific regime for large language model providers, the companies behind GPT, Claude or Gemini.
- August 2, 2026: Article 50 transparency obligations, including labeling of AI-generated content.
- December 2, 2027, then August 2, 2028: the high-risk regime, first for standalone systems like recruitment or credit, then for AI embedded in already-regulated products (medical devices, machinery).
The last two dates moved this summer. The European Commission proposed delaying the high-risk regime in late 2025, a political agreement followed between the Council and Parliament on May 7, 2026, and the so-called Digital Omnibus entered into force on July 27, 2026 (source: Gibson Dunn). Article 50’s transparency obligations, though, haven’t moved: they’ve applied since August 2, 2026, with a grace period only until December 2, 2026 for the technical marking of AI content already on the market (source: artificialintelligenceact.eu). The delay therefore concerns only the high-risk regime, not the whole regulation, a nuance missing from a lot of press coverage in a hurry to headline a general postponement.
The deployer: the role that concerns you directly
The regulation distinguishes two roles. The provider builds the system and carries most of the technical obligations: documentation, risk management, CE marking. That’s the role of Anthropic, OpenAI, or a vendor embedding a model in its own product. The deployer uses AI in its own operations, as a tool, without building or reselling it. Most French SMEs fall into this second role, with lighter obligations than the provider’s, but real ones nonetheless.
In practice, being a deployer means informing the people concerned when they interact with a limited-risk system, a support chatbot for example, and making sure the teams running these tools have received training suited to the context of use, the Article 4 literacy obligation already mentioned. A principle already familiar to teams that worked through GDPR compliance applies the same way here: the regulation’s reach is global and applies as soon as its effects touch the European market, regardless of where the company is headquartered. On this ground of digital compliance, SME cybersecurity challenges follow a similar logic: the obligation exists as soon as you process the data, not only when you’re the primary target of the text.
Who actually enforces these obligations in France remains, as we write this, a work in progress. The government has proposed a bill distributing oversight among existing authorities by sector: the CNIL on data and biometrics, Arcom on content, the ACPR on finance, the DGCCRF for overall coordination, but the bill hasn’t yet been finally adopted by Parliament. No single point of contact has emerged yet.
The fines, and the nuance that changes everything for an SME
The AI Act sets three tiers of fines. Up to 35 million euros or 7% of global turnover for prohibited practices. Up to 15 million euros or 3% for other breaches, including transparency. Up to 7.5 million euros or 1% for misleading information provided to authorities (source: artificialintelligenceact.eu).
Taken at face value, these numbers are enough to worry a small structure. For an SME or a startup, the regulation applies the lower of the two thresholds set for each tier, not the higher one used for large companies. It’s a detail most press coverage leaves out, even though it materially changes the exposure of a ten- or fifty-person company. The nuance scales the risk to company size, rather than treating a ten-person SME like a multinational building its own models.
This article sets out the framework, not legal advice: for a specific situation, a legal professional remains the right person to ask. What’s worth remembering is that the AI Act has been rolling out in waves since 2024, and two quiet obligations already apply to most regular B2B businesses: training the teams who use AI, and informing users when they’re interacting with it. The heavier high-risk regime directly concerns only a minority of use cases, and not before late 2027.
If you want to dig into this framework on a specific case, we can talk it through.
Photo credit: Pixabay (photos 5382501, 3196481 and 594090), Pixabay Content License.
