EU AI Act for an SME using ChatGPT: what applies now, what was delayed and what to do in 4 weeks

Does the EU AI Act apply to Italian SMEs?

Yes. Regulation (EU) 2024/1689 has been in force since August 2024. It applies to anyone who develops, distributes or uses AI systems in the European Union, SMEs included.

Most Italian SMEs are deployers, not providers of high-risk systems. That means lighter obligations, but not zero obligations.

Companies that build AI governance before it becomes a perceived obligation gain a real competitive advantage.

The official summary on EUR-Lex states that definitions, basic prohibitions and AI literacy apply from 2 February 2025. For an SME, this is no longer a topic to “watch”. It is a topic to organise.

What this means in practice

For an SME, this comes down to one simple thing:

• you do not need to become a legal expert on AI
• you need to avoid improvised use of AI in critical processes
• you need to be able to explain how you use it

What did the Digital Omnibus delay?

Regulation (EU) 2026/1744, known as the Digital Omnibus, dates from 8 July 2026 and has been in force since 27 July 2026. It moved one thing only: the rules on high-risk systems.

The rules of Annex III, such as staff selection or credit, move to 2 December 2027. The rules of Annex I, meaning AI built into regulated products, move to 2 August 2028.

The delayed rules include the obligations of deployers of high-risk systems (Art. 26). If you use ChatGPT or Copilot to write, summarise or analyse, you are outside that scope. It changes if you use them to make decisions about people, for example to select candidates.

The full picture is in the article AI Act delay: it only touched high risk.

What are the concrete obligations for an SME using AI?

For SMEs that use AI systems (ChatGPT, Claude, Copilot, data analysis tools), three obligations already apply:

• AI literacy (Art. 4): take measures to support the skills of people who use AI on the company’s behalf
• Prohibitions (Art. 5): do not use prohibited practices, such as subliminal or manipulative techniques that distort a person’s decisions
• Transparency (Art. 50, from 2 August 2026): disclose deepfakes and AI-generated texts published on matters of public interest without human review

Anyone who puts a chatbot online has one more obligation: people must know they are talking to an AI system. The design obligation, however, falls on the provider of the system.

Human oversight and documentation are not obligations of every SME that uses AI. They are requirements for high-risk systems, delayed as seen above. They remain a good way of working: know where AI is used and who validates the outputs.

You do not need a dedicated legal team. You need a system that builds these principles into the way you work.

The obligations as a checklist

If you want to cut it to the bone, ask yourself:

1. do we know where AI is used?
2. do we know who validates the outputs?
3. do we know which outputs must not go out without a check?
4. do we know who needs training?

Article 4 of the AI Act, rewritten by the Digital Omnibus, asks for measures that support the AI literacy of people who use and manage AI systems. What counts is the context of use and the starting level of skill.

You are not required to guarantee a specific level for each person. But opening an account is not enough: you have to prepare the people who use it.

Why does AI governance matter in sales too?

When a client, a partner or a tender asks how you govern AI, a traceable system is more credible than an opinion. Not because the law imposes it on every SME. Because a company that can explain process, boundaries and validation looks more reliable.

It also lets you talk about efficiency, risk and reliability inside one architecture, not three disconnected projects.

Why this matters commercially

In front of a board, a partner or a structured client, a company that can explain governance and responsibility:

• looks more credible
• is easier to defend in a sale
• is stronger where supply requirements apply

How do you turn compliance into a competitive advantage?

Compliance can be a cost or an investment. The difference is in the approach.

Cost approach:

• Wait until someone asks for the documentation
• Fill in checklists after the fact
• Treat the EU AI Act as a bureaucratic formality

Investment approach:

• Build documented, transparent AI processes from the start
• Use governance as a differentiator in client presentations
• Position yourself as a partner who can govern AI, not just use it

The key question

When a client asks you “how are you governing AI?”, today you have:

• an opinion
• a policy
• or a traceable system?

For a Fractional Manager, arriving with a documented AI governance framework is an advantage when the client chooses. For an SME general manager, it is a concrete answer to the board when it asks “how are you managing AI risk?”.

The European Commission also links AI adoption, trust, skills and the implementation of the AI Act explicitly. So compliance done well is not a brake. It is a form of operational reliability you can put to use.

What are the real risks of non-compliance?

Penalties are set by Art. 99. Up to €35 million or 7% of worldwide turnover for prohibited practices. Up to €15 million or 3% for most other obligations, transparency included.

For SMEs, the lower of the amount and the percentage applies. The reputational risk, however, stays the same.

The most concrete risk for an Italian SME today is not the fine. It is losing a client or a tender because you cannot show that you use AI responsibly.

In practice, we see 3 recurring risks:

• use of AI without validation criteria
• no traceability of who did what
• AI-supported outputs without clear oversight

These are reputational risks even before they are regulatory ones. But they become commercial risks at once, when a client or partner asks how you govern the process.

The most underestimated risk

It is not the theoretical fine. It is this scenario:

• the team uses AI in an inconsistent way
• a client asks for transparency
• you cannot explain process, boundaries and validation

What can an SME do in the next 4 weeks

These are not legal obligations for every SME. They are the minimum for using AI under control, and they also cover the training of Art. 4.

The minimum path is this:

1. map where AI is already used
2. define which outputs require human review
3. assign an internal owner
4. track the critical use cases
5. train the people who actually use the tools

If you start only from a written policy, the policy stays sterile. If you build the system first, the policy becomes adoptable.

A minimum 4-week plan

To make it concrete:

1. week 1: map uses and processes
2. week 2: define the minimum boundaries
3. week 3: assign ownership and validation
4. week 4: train the people who actually use the tools

Where can an SME start?

The SME diagnostic takes about 7 minutes. It is not an AI Act compliance check: it tells you where work gets stuck and what the status quo costs. You get:

• a first operational diagnosis
• the estimated cost of the status quo
• the most sensible next step

It is not legal advice. It is a starting point for deciding where AI needs governing first: who uses it, for what, and who validates the outputs.

If you want an even more practical version of the problem, continue with AI policy for SMEs: an operational checklist to avoid chaos or go straight to the For Companies page.

“Operational-ROI governance, not institutional governance. Total control, not a black box.” — AIEH

Primary sources and references

• EUR-Lex - Regulation (EU) 2026/1744, Digital Omnibus on AI
• EUR-Lex - Regulation (EU) 2024/1689, consolidated text as of 27 July 2026
• EUR-Lex - Rules for trustworthy artificial intelligence in the EU
• European Commission - Quick facts: transparency rules for AI systems
• European Commission - European approach to artificial intelligence