What Is the EU AI Act?

The EU AI Act is a landmark regulation designed to ensure AI is safe, transparent, and accountable. Unlike voluntary frameworks, it has real legal weight, with enforcement starting in 2025 and phasing in through 2026.

Timeline of the EU AI Act

• 2021 – Draft legislation first proposed by the European Commission.

• 2023–2024 – Negotiations and approval by the European Parliament.

• 2025 – Certain bans and governance requirements come into force.

• 2026 – Full obligations for high-risk AI systems apply.

This timeline means SMEs have a short window to prepare – waiting until enforcement begins risks non-compliance and rushed adoption.

How the Act Classifies AI Systems

The EU AI Act uses a risk-based framework. Not all AI is treated equally:

• Minimal risk – AI that poses little to no danger, e.g. spam filters or AI in video games.

• Limited risk – Systems requiring transparency, e.g. chatbots that must identify themselves as AI.

• High risk – AI used in sensitive areas such as healthcare, finance, hiring, or critical infrastructure. These systems require strict documentation, monitoring, and human oversight.

• Unacceptable risk – AI systems that are outright banned, e.g. predictive policing or social scoring.

Different types of AI carry different levels of risk under the Act – for example, generative models used in hiring are treated very differently to predictive AI used in marketing.

Examples of High-Risk AI Systems

• AI for recruitment or CV screening.

• Credit scoring and financial lending decisions.

• Healthcare diagnostics powered by AI.

• AI used in critical infrastructure, such as energy or transport.

For SMEs, this means even simple-sounding use cases, like a startup using AI for candidate filtering, could fall under “high risk” and demand compliance.

Why the EU AI Act Matters for Startups and SMEs

Large enterprises already have compliance teams, legal budgets, and enterprise AI vendors like IBM or Microsoft offering pre-approved solutions. But SMEs don’t have that luxury.

For smaller businesses, the stakes are higher:

• Resource gaps – no dedicated compliance or cybersecurity teams.

• Fewer tailored solutions – enterprise tools don’t fit SME scale.

• Thin margins for error – a compliance fine or reputational breach could end growth altogether.

SME Scenarios

• A fintech startup integrating AI into fraud detection must ensure its models are explainable and bias-free – or risk being flagged as high risk.

• A SaaS scaleup deploying AI chatbots to support customers may not fall into “high risk,” but still faces transparency requirements and data protection obligations.

This is why AI and Cybersecurity must go hand in hand. Without proper guardrails, even well-meaning adoption could land you in breach of regulation. (See our guide on AI and Cybersecurity for how to build guardrails into adoption.)

Common Pitfalls SMEs Face Under the EU AI Act

1. Shadow AI

Employees using unapproved AI tools without oversight, exposing sensitive data and compliance risks. (We explained this in our post on Cyber Threats in the Age of AI.).

2. Poor Documentation

The Act requires detailed records of how AI systems are trained and used. Many SMEs lack processes to track this properly.

3. Legacy System Integration

Trying to bolt AI onto outdated systems creates security gaps. 

4. Underestimating Data Sensitivity

AI projects often involve personal, financial, or customer data. Mishandling this creates both compliance and trust issues.

5. Vendor Overconfidence

Many SaaS AI vendors claim to be “compliant by default.” But under the EU AI Act, the deploying business holds responsibility, not just the vendor. SMEs relying blindly on third parties risk inheriting their compliance gaps.

How Startups and SMEs Can Prepare

The EU AI Act may feel daunting, but preparing doesn’t have to mean hiring an army of lawyers. By embedding compliance early, SMEs can move faster and with more confidence.

1. Map Your AI Use Cases – list existing AI, categorise as minimal, limited, or high risk.

2. Build Cybersecurity Into AI Adoption – encrypt training data, restrict access, monitor models.

3. Start Documentation Early – track datasets, training methods, oversight, and vendors.

4. Evaluate Vendors Carefully – ask if they align with EU AI Act requirements.

5. Embed Governance Roles – assign an AI lead for oversight.

6. Work With the Right Talent – engineers who understand AI and regulatory guardrails.