The EU AI Act in autumn 2026: what German SMEs need to do now
The high-risk deadline moved to December 2027, Germany has named its AI regulator, and the transparency rules already apply. A plain summary for small and mid-sized companies.
This summer changed the timetable of the EU AI Act twice within a week. The EU postponed the strictest obligations, and Germany passed the law that says who enforces the rules here. If you run a small or mid-sized company and use AI, or plan to, this is where things stand.
This article is a summary for orientation, not legal advice. For a binding assessment of your own systems, talk to a lawyer.
What changed in summer 2026
The high-risk deadline moved. The "Digital Omnibus on AI" (Regulation (EU) 2026/1744) was published on 24 July 2026. It postpones the obligations for high-risk AI systems:
| Obligation | Old date | New date |
|---|---|---|
| High-risk systems listed in Annex III (for example hiring, credit scoring, education) | 2 August 2026 | 2 December 2027 |
| High-risk AI built into regulated products (Annex I) | 2 August 2027 | 2 August 2028 |
Germany has an AI regulator. The German implementation law, the KI-MIG, entered into force on 29 July 2026. The Bundesnetzagentur is now the market surveillance authority, the single point of contact and the place to file complaints. It runs an AI Service Desk with an online tool that gives a first estimate of the risk level of an AI system, and a regulatory sandbox where companies, SMEs in particular, can test AI systems under supervision.
What already applies
The postponement covers high-risk systems only. Three parts of the AI Act are already in force:
- Prohibited practices (since 2 February 2025). Some uses are banned outright, such as social scoring or emotion recognition in the workplace. Fines for violations go up to €35 million or 7% of worldwide annual turnover.
- AI literacy (since 2 February 2025). People who work with AI in your company should understand what it can and cannot do. The 2026 amendments softened the wording of this duty, but did not remove it.
- Transparency (since 2 August 2026). If a chatbot talks to your customers, they must be told they are dealing with an AI, unless that is obvious. Realistic AI-generated images, audio or video must be labelled as such. For the machine-readable marking of generated content, systems that were on the market before 2 August 2026 have until 2 December 2026.
The rules for providers of general-purpose AI models have applied since 2 August 2025. They concern the companies that build the large models, not the companies that use them.
Are you affected by the high-risk rules?
Most AI that small and mid-sized companies use is not high-risk: a chatbot that answers product questions, a tool that reads invoices, an assistant that drafts emails or summarises documents.
It becomes high-risk when the system makes or prepares decisions about people in sensitive areas. Typical cases are software that screens or ranks job applicants, evaluates employees, scores creditworthiness or grades students. If you use such a system, you have duties as a "deployer", even if someone else built it: human oversight, use according to the instructions, keeping logs and informing the people affected.
Five things to do this quarter
- Make a list. Write down every AI tool in use, including the ones employees signed up for on their own. Note what it does, which data goes in and who the provider is.
- Classify each one. The Bundesnetzagentur's online tool is a sensible first check. For most entries the answer will be "minimal" or "limited risk".
- Fix transparency now. Check every chatbot, voice assistant and AI-generated image on your website. This obligation is already in force.
- Train your team. A short, documented session on how your tools work, where they fail and what must not be entered into them covers most of the literacy duty.
- Use the extra time for high-risk systems. December 2027 sounds far away. Setting up oversight, logging and documentation takes months, and standards are still being written. Start with a gap analysis, not with the deadline.
The AI Act does not replace the GDPR. If an AI system processes personal data, both apply.
Our view
For most SMEs the AI Act is manageable. The work is knowing what you use, telling people when they are dealing with a machine, and keeping a human responsible for decisions that matter. Systems that are built that way from the start need very little rework when the next deadline arrives.
Sources
Thinking about AI for your business?
Tell us what you have in mind and we'll say honestly how we'd build it.
More articles
· 4 min read
57% of German companies now use AI. Most have barely started.
For the first time, a majority of German companies use AI. What the 2026 figures say, why smaller firms are still behind, and where AI pays off first.
Read article
· 4 min read
Five AI trends German businesses should plan for in 2027
AI agents, data sovereignty, smaller models, compliance by design and the e-invoicing deadline: what is likely to shape AI projects in Germany next year, and what to do about each.
Read article