The EU AI Act is law. Progressively enforceable since 2024, its main obligations become effective for European businesses in 2026. Many Italian SMEs are already adopting AI tools without realising they may fall within the scope of the regulation. This article is not written for lawyers — it is written for the person who needs to decide what to do on Monday morning.
What Is the AI Act and Why Does It Affect Small Businesses Too
The AI Act (EU Regulation 2024/1689) is the world's first comprehensive regulatory framework governing the use of artificial intelligence. It is not a data-privacy law — that is the GDPR. It deals specifically with AI systems and the risks they may generate.
The most common mistake is assuming it only affects large tech companies. The EU AI regulation for businesses applies to any organisation that uses, imports, or distributes AI systems in the European market, regardless of size. If you have integrated a customer service chatbot, use credit-scoring software, or rely on an AI system to screen job applicants, you may already fall within its scope.
The Risk-Based Classification of AI Systems
The heart of the AI Act is a four-tier risk pyramid:
| Level | Examples | Obligations |
|---|---|---|
| Unacceptable risk | social scoring, subliminal manipulation | Prohibited |
| High risk | CV screening, credit scoring, medical devices, critical infrastructure | Extensive obligations |
| Limited risk | chatbots, generative deepfakes | Mandatory transparency |
| Minimal risk | spam filters, playlist recommendations | No specific obligations |
The majority of AI tools used by Italian SMEs fall into the "limited risk" or "minimal risk" categories. However, any business using AI for HR decisions, credit scoring, or operational security needs to pay close attention to the "high risk" tier.
The "Unacceptable Risk" Systems to Avoid
Prohibited since 2 February 2025, these are AI systems the regulation deems incompatible with fundamental rights: real-time biometric identification in public spaces (with narrow exceptions), social scoring systems, subliminal psychological manipulation. For most Italian SMEs, this tier is irrelevant in practice. The real critical boundary lies between "limited risk" and "high risk."
What Concrete Obligations Apply to SMEs in 2026
The EU AI regulation for businesses distinguishes between organisations that develop AI systems (providers) and those that use them in a professional context (deployers). SMEs are almost always deployers — they purchase or integrate systems built by third parties. This does not exempt them from obligations; it reduces them, but does not eliminate them.
Transparency and Documentation
If you use a limited-risk AI system — a chatbot interacting with your customers — the main obligation is transparency: the user must know they are interacting with an automated system. A disclaimer buried in terms and conditions is not enough; it must be clear and immediate at first contact.
For high-risk systems, the obligations go further: an activity register for the system, up-to-date technical documentation, and a fundamental rights impact assessment. These are not formalities — they require dedicated technical and legal support.
Human Oversight: What It Actually Means
"Human oversight" is one of the pillars of the AI Act for SMEs. In practice, it means every high-risk system must include mechanisms that allow a human to intervene, correct, or stop the system's decisions in real time.
For an SME, this translates into a practical question: who in your organisation has effective control over the decisions your AI system makes? If the answer is "no one — the system decides autonomously," that is a potential compliance problem. You do not need a team of engineers: you need a clear, documented procedure and a named responsible person.
Are Italian SMEs Ready? 3 Risk Areas to Watch
The honest answer is: many are not. One reason is that AI Act 2026 SME obligations have been communicated mainly in technical-legal language, far from the day-to-day reality of small businesses. Three areas deserve immediate attention.
1. Staff recruitment. If you use an AI system to filter CVs or score job candidates, you almost certainly fall into the "high risk" category. It does not matter if the tool is a third-party SaaS product: as a deployer, you have your own obligations. A concrete example: software that automatically ranks CVs without documented human oversight is already out of compliance.
2. Credit or financial risk assessment. Tools that assign creditworthiness scores to customers or automate credit decisions fall under high risk. Many B2B SMEs use these tools without being aware — they are embedded as a secondary feature of a CRM or ERP system.
3. Automated customer service without human oversight. If your chatbot handles complaints, refunds, or sensitive requests entirely autonomously, check whether an escalation path to a human agent is configured. This is both a transparency and an oversight requirement. You can learn more about how to structure AI customer service automation that already meets these criteria.
How to Get Ready: a 4-Step Action Plan
You do not need to become an expert in European law. You need to know where you stand and what to do. Here is the 4-step method optibox.io uses in its AI compliance audits.
Step 1 — Take stock of your AI systems. List every tool that makes decisions automatically or semi-automatically in your business: from an ERP with predictive features to the chatbot on your website. SMEs often discover they have more "AI" than they thought.
Step 2 — Classify the risk level. For each system, check whether it falls into one of the regulation's categories. Your software vendor should help with this classification — if they cannot answer, that is a warning sign.
Step 3 — Review your supplier contract. The AI system's provider has its own compliance obligations. Your contract should require the vendor to supply the technical documentation you need to fulfil your obligations as a deployer. If the contract is silent on this, request it in writing.
Step 4 — Document and assign internal responsibility. Who in your organisation is responsible for AI compliance? A dedicated AI DPO is not required for small businesses, but someone must be able to answer that question. Appoint an internal contact, even if on a part-time basis. To understand how compliance preparation fits into your overall AI budget, read our guide on how much it costs to integrate AI.
The EU AI Act is not yet fully operational — full enforcement for high-risk systems in regulated sectors arrives in 2027 — but the window to prepare is now. SMEs that arrive ready will have a genuine competitive advantage: lower legal risk, stronger contracts with suppliers, and client trust in a market that increasingly demands ethical AI use.
Do you have AI systems in your business that might fall under the AI Act? Book a free audit with optibox.io. In 60 minutes we map your AI tools, identify compliance risks, and give you a concrete action plan — with no legal jargon. Book a free AI audit.