The AI Act's Other Half: SME Deployers Face the August 2026 Deadline

The European Union's AI Act is usually described as a rulebook for the companies that build artificial intelligence. For most small and medium-sized enterprises, that framing is wrong. Most SMEs will never train a model or place an AI system on the market. They will buy software, switch it on, and use it to sort job applicants, score customers, assess students or decide who gets access to a service. Under the Act, that makes them deployers, and deployers carry obligations of their own.

The compliance conversation has been dominated by providers because they carry the heaviest load: conformity assessment and technical documentation. But the Act's high-risk regime is written around contexts of use as much as around products, and it places a parallel set of duties on the organisations that put those systems to work. For high-risk systems listed in Annex III, those deployer obligations begin to apply from 2 August 2026.

Most SMEs will meet the law as users, not builders

The Act defines a deployer as any organisation using an AI system under its own authority, other than in a purely personal, non-professional capacity. A recruitment agency that runs CVs through a ranking tool supplied by a vendor is a deployer. A lender using a third-party creditworthiness model is a deployer. A training provider using automated assessment, or a business using AI to triage applications for a service, is a deployer.

What makes a system high-risk is not its sophistication but its function. Annex III covers biometric identification, critical infrastructure, education, employment and worker management, and access to essential services, including credit scoring and the pricing of life and health insurance. An SME in hiring, education or financial services, or any business that gates access to a service, is in scope.

Two things follow. The obligations attach to how a system is used, not to the size of the company using it. And some duties are already live: the Act's AI literacy requirement has applied to deployers since February 2025, well ahead of the high-risk timetable.

The first deliverable is an inventory, not a policy

The instinct in a compliance deadline is to commission a policy document, but that is the wrong order of work. A policy written before anyone knows what is running inside the business will describe a company that does not exist.

The practical starting point is a plain inventory of every AI tool and AI feature in use, including the ones nobody thinks of as AI. Embedded functionality is the difficult part, because it arrives inside software the business already bought: applicant tracking systems that rank candidates, finance platforms that flag fraud or set payment terms, customer service tools that route enquiries, HR software that scores performance, productivity tools that summarise or draft. None of these is procured as an AI project, and all of them can involve automated decision-making.

For each entry, the inventory should record what the system does, which decision it informs or makes, who inside the business owns that decision, what data it consumes, who is affected, and whether a human can realistically override the output. That last question is often answered no in practice, whatever the vendor's documentation says.

The inventory should also flag a status change SMEs rarely anticipate. A deployer can become a provider if it puts its own name or trademark on a high-risk system, substantially modifies it, or changes its intended purpose. Rebadging a vendor tool as an in-house product, or repurposing a recruitment model to assess credit, moves the organisation into the heavier tier.

What the duties look like as operating routines

Read closely, the deployer obligations are management disciplines rather than legal paperwork. Deployers must use high-risk systems in accordance with the instructions for use, and assign human oversight to named individuals with the necessary competence, training, authority and support. Oversight in practice is a rota of people who understand the system's limits, can interpret its outputs, and have the standing to pause or reverse a decision.

Deployers must also keep the system's automatically generated logs, for at least six months unless other law requires longer. Those records are what make oversight auditable after the fact, and they are frequently the first thing an SME discovers it cannot obtain from its vendor.

Transparency runs alongside. Employers must inform workers and their representatives that high-risk AI is in use, and affected individuals must be told when they are subject to it. Where a system supports a decision that adversely affects someone, that person can request a clear explanation of its role and the main elements of the decision.

One further duty is easy to miss. Deployers that are public bodies or private entities providing public services must carry out a fundamental rights impact assessment before first use of most Annex III systems. So must any deployer using AI to assess creditworthiness or to set life and health insurance risk and pricing. The assessment covers the processes involved, the frequency of use, the categories of people affected, the specific risks of harm, the oversight measures in place, and what happens if those risks materialise.

Enforcement carries weight. Breaches of deployer obligations can attract penalties of up to EUR 15 million or 3% of total worldwide annual turnover, with the lower of the two figures applying to SMEs and start-ups.

Procurement is where compliance is won or lost

Almost every deployer obligation depends on information the vendor holds. An SME cannot assign meaningful human oversight without knowing how a system reaches its outputs, cannot retain logs it never receives, and cannot explain a decision it cannot reconstruct.

That makes the contract the pressure point. Deployer-side clauses should secure the instructions for use and technical documentation, access to logs, notification of incidents, advance notice of material changes to the model or its intended purpose, and a commitment to cooperate with supervisory authorities. An SME's leverage over a supplier may be limited, but the time to establish what a vendor will provide is before signature.

Literacy first, and the commercial case alongside

AI literacy is the cheapest obligation to satisfy and the one most likely to reduce operational risk. The Act asks deployers to ensure a sufficient level of AI literacy among staff dealing with AI systems on their behalf, proportionate to their role and the context of use. For most SMEs that means basic, role-specific training: what the tools do, where their limits lie, when to escalate, and how to record an override.

The commercial argument runs the same way. Larger customers, insurers and lenders are increasingly asking suppliers to describe how they govern automated decision-making, and a documented inventory, a named oversight structure and retained records answer those questions directly.

That is the operating discipline the Global SME Awards are designed to surface: firms that treat new obligations as a reason to tighten how the business runs, rather than as a document to file. The August 2026 date gives SMEs a fixed point to work towards, and the inventory is the place to begin, because everything else depends on knowing where AI already makes decisions inside the business.