AI Act compliance for small firms: what August 2026 really requires, and the tools you already pay for

The headlines said the AI Act got delayed. For the high-risk systems most small firms never build, that is true. For the AI you actually use every day, nothing moved. Those rules go live on 2 August 2026.

You probably read that the EU AI Act got delayed. For the heavy stuff, the high-risk systems most small firms will never build, that is true. For the AI you actually use every day, it is not. The chatbot on your website. The assistant drafting your emails. The tool screening your CVs. None of that moved. Those rules go live on 2 August 2026. And here is the part nobody is selling you: you almost certainly already own the tools to meet them.

This is a business translation, not a legal brief. I am not a lawyer. What I am is someone who puts AI to work inside real companies and watches what happens when the whole thing gets left to the legal team without anyone who understands how the tools actually behave. So let me tell you which deadline moved, which one did not, and what to do about it with software you are probably already paying for.

What moved in July, and what didn't

This summer the EU adopted the Digital Omnibus, a package that reshuffled the AI Act timeline. It pushed the high-risk deadlines out. The stand-alone high-risk systems now land at the end of 2027, the ones baked into physical products in 2028. Real relief, if you build those systems. Most firms do not.

What it left untouched is the part that reaches an ordinary business. Transparency. AI literacy. The duties you pick up the moment you use someone else's AI in your work. Those still start on 2 August 2026. So when someone tells you the Act got delayed, they are half right. About the half that was never going to touch them.

Date	What applies	Status
Feb 2, 2025	Prohibited AI practices banned. AI literacy required for staff who use AI.	● IN FORCE
Aug 2, 2025	General-purpose AI obligations active. Penalty regime begins. AI Office operational.	● IN FORCE
Aug 2, 2026	Article 50 transparency, the bulk of remaining obligations, and full enforcement. NOT delayed by the Omnibus.	● APPLIES
Dec 2, 2027	Stand-alone high-risk systems (Annex III: employment, credit, healthcare, education AI). Deferred by the Omnibus.	✓ DELAYED
Aug 2, 2028	Product-embedded high-risk systems (Annex I). Deferred by the Omnibus.	✓ DELAYED

The Act cares what you do, not how big you are

There is no headcount that gets you out of this. The Act sorts everyone by role. Build or brand an AI system and you are a provider. Use one in your work and you are a deployer. A twelve-person firm running ChatGPT is a deployer, and that is a legal role with real obligations, not a shrug.

Being small changes one thing. The fines are capped lower for SMEs, you pay the lower of the two figures instead of the higher, and you get access to regulatory sandboxes. That is the whole benefit.

Violation	Maximum fine
Using a prohibited AI system	€35 million or 7% of worldwide turnover
High-risk or transparency (Article 50) breach	€15 million or 3% of worldwide turnover
Misleading information to authorities	€7.5 million or 1% of worldwide turnover

For an SME the number is the lower of the two, not the higher. Smaller, yes. Still the kind of number that ends a small firm.

The four moments you have to say this is AI

Article 50 is the transparency rule, and it is the one that lands on a normal business. Take out the legal language and it comes down to a handful of moments where you have to tell people they are dealing with a machine.

Your chatbot has to say it is a chatbot. If something is answering questions on your site or handling intake, the person needs to know they are talking to AI, from the first message.

AI-generated content shown to the public has to be marked as AI. The machine-readable watermark is mostly the vendor's job, but you pick the vendor, so pick one that actually does it.

Deepfakes get disclosed. Publish AI-made images, audio, or video of real-looking people or events and you say, clearly, that it is artificial.

Published text on matters of public interest gets a label, with one exception that matters for a law firm. If a human reviewed it and a named person or organisation holds editorial responsibility, the labelling duty falls away. So your client alerts and your thought-leadership are fine, as long as a real person signs off on them.

The practical read: drafting a contract or a memo that a lawyer reviews is generally not a public transparency trigger. Your exposure there is confidentiality, where the client's data ends up, not a label. The label rules bite on the client-facing surfaces. The chatbot, the marketing, anything photoreal.

The Monday-morning checklist

No theory. Here is what a firm of twenty to a hundred and fifty people actually does.

• List every AI tool you use. Include the ones hiding inside other tools: your CRM, your writing assistant, your helpdesk, your HR screening. Most firms find more than ten once they look properly.
• Sort them by risk. Flag anything that touches hiring, client vetting, or access to a service. That is where high-risk lives for a firm like yours.
• Mark each one provider or deployer. Off the shelf is deployer. White-labelling or heavily modifying a tool can make you a provider.
• Add the disclosures where Article 50 applies. The chatbot says it is a chatbot. Published AI content gets its label or its editorial sign-off.
• Put a human in the loop. No decision that matters runs fully on autopilot, and someone can review it, override it, or stop it.
• Log what the AI does. An auditable trail is a requirement for the high-risk cases and your defence if anyone ever asks.
• Control the data going in. Keep client and sensitive data out of tools that should not see it, and keep processing inside the EU where it counts.
• Set retention. Decide how long you keep prompts, outputs, and documentation, then hold to it.
• Train your people. Article 4 asks for proportionate AI literacy. No certificate required, but you have to show you did something.
• Write it down and keep it alive. An inventory, a short policy, the logs, reviewed on a cadence. Not a PDF you file and forget.

You already own most of the answer

Here is the part that should make a managing partner exhale. Read that checklist again. Inventory, classification, transparency records, oversight, logging, data governance, retention. If your firm runs on Microsoft 365, you already own the machinery for almost all of it. It is sitting in your tenant, mostly switched off.

Purview Compliance Manager ships with a built-in EU AI Act template. It walks you through the assessment and exports the report an auditor wants to see. Purview DSPM for AI finds the AI already in use, including the shadow AI nobody told you about, and flags where data is oversharing. Auditing, retention policies, and eDiscovery cover the logging, the record-keeping, and legal hold over AI activity. And Azure and Copilot can be set to keep data inside the EU, through EU Data Zones and the EU Data Boundary, once someone configures it that way.

What it means by industry

Five sentences that will cost you

"We're too small." Wrong test. It is about what you do, not how many of you there are.

"We only use ChatGPT." That makes you a deployer, and a deployer has duties. It is a role, not a loophole.

"The free version is fine for client work." Not when it lacks EU residency, admin controls, and audit logs, and you are holding privileged data.

"Data leaving the EU doesn't matter." It does, for this and for GDPR both, and it is a setting you can change.

"We'll write a policy." A policy you file once is not evidence. The Act expects something living.

Frequently asked questions

Is the August 2026 deadline cancelled?

No. The Omnibus moved the high-risk system deadlines to 2027 and 2028. The transparency obligations under Article 50, AI literacy, and the deployer duties still apply from 2 August 2026. The part that reaches an ordinary firm was not delayed.

We use ChatGPT or Copilot. Do we have to do anything?

Yes. Using someone else's AI in a professional context makes you a deployer, a defined role with real duties: transparency where it applies, human oversight, AI literacy, and data governance. The Act does not ban a vendor. It assigns you responsibilities.

What is the fastest way to start without a compliance team?

The inventory is free and it is the hardest part to skip. If you run on Microsoft 365, most of the evidence and controls the Act asks for are features you already pay for, waiting to be switched on and kept current. The bottleneck is rarely money. It is the decision to start.