The EU AI Act is no longer a future concern; it is a present reality for businesses in and trading with the European Union. In May 2024, the Act was formally adopted, triggering a series of compliance deadlines that every organisation using artificial intelligence must understand.

As an AI governance advisor with over 20 years of experience in regulated industries, I've seen the conversation with SME boards shift dramatically. The question is no longer 'what if?' but 'what now?'. The official timeline for the EU AI Act is set, and for small and medium-sized enterprises, proactive preparation is the key to managing risk and seizing competitive advantage.

This article provides the latest official timeline, explains what each deadline means for you, and offers a practical, step-by-step plan to get your organisation ready.

On 21 May 2024, the Council of the European Union gave its final approval to the AI Act. This was the last legislative step. The Act was then published in the EU's Official Journal, which means it is now officially law and the compliance clocks have started ticking.

This landmark regulation takes a risk-based approach. The obligations for an AI system depend on the level of risk it poses to health, safety, or fundamental rights. For SMEs, this means you must first understand what kind of AI you are using or building before you can determine your compliance burden.

The regulation will be implemented in stages. In our work advising leadership teams, we stress the importance of mapping your AI systems against this timeline. Some rules apply much sooner than others.

Here is a breakdown of the key dates and what they mean for your business.

The most immediate deadline concerns prohibited AI. By the end of 2024, you must ensure you are not using any AI systems that the Act deems an 'unacceptable risk'.

Waiting until 2026 is not a viable strategy. The work required to classify systems, review contracts, and implement controls takes time. As an IAPP-certified Artificial Intelligence Governance Professional (AIGP), I recommend a structured, phased approach.

Here are five steps you can take today.

You cannot govern what you don't know you have. Start by creating a register of all AI systems used across your business, from marketing automation and HR software to customer service chatbots and developer tools. Note who owns it, what it's used for, and what data it processes.

Using your inventory, classify each system according to the EU AI Act's risk pyramid:

If you identify any high-risk systems, this is your priority. Under the Act, these systems require robust risk management, high-quality data governance, detailed technical documentation, human oversight, and high levels of accuracy and cybersecurity. Frameworks like the NIST AI Risk Management Framework provide an excellent foundation for these controls.

Many SMEs are users of AI, not developers. You are still responsible for ensuring the high-risk systems you deploy are compliant. Scrutinise your contracts with AI vendors. Do they accept their obligations as a 'provider' under the Act? Do they provide the necessary technical documentation and transparency to allow you to meet your obligations as a 'deployer'?

Compliance should not be an ad-hoc scramble. Adopting a formal AI management system, such as ISO/IEC 42001, provides a structured and repeatable process for managing AI risk and demonstrating compliance. In our experience, organisations with a recognised framework find it significantly easier to map their activities to the EU AI Act's requirements and prepare for conformity assessments.

While the UK government is pursuing its own 'pro-innovation' approach to AI regulation, as detailed in its February 2024 response to the AI white paper, this does not give UK firms a free pass.

Due to its extraterritorial reach, the EU AI Act sets a de facto global standard. If your product is available to customers in the EU, you must comply. We see boards struggle most with underestimating this reach. For most UK SMEs with international ambitions, aligning with the EU AI Act is the most commercially pragmatic path forward.

Building your governance to meet the EU's requirements will likely satisfy the principles-based approach of the UK and other jurisdictions, providing a robust foundation for global operations. An assurance scheme like AI Assured helps you build one framework that maps to multiple regulations, saving significant time and effort.

Ultimately, the EU AI Act's timeline is a call to action. It's an opportunity to move beyond reactive compliance and build a proactive AI governance strategy that fosters innovation, manages risk, and earns trust. The companies that act now will be the ones that lead tomorrow.

What is the final deadline for the EU AI Act?

The timeline was revised by the EU AI Act Omnibus, in force since July 2026. High-risk obligations for stand-alone AI systems (Annex III, e.g. recruitment, credit scoring) now apply from 2 December 2027, and for AI embedded in regulated products (Annex I) from 2 August 2028. Rules banning prohibited AI already applied from the end of 2024, and Article 50 transparency plus Article 4 AI literacy duties remain due from 2 August 2026, unaffected by the delay.

Does the EU AI Act apply to my small business?

Yes, if your business operates in the EU or your AI's output is used there. The compliance obligations depend on the risk level of your AI system, not the size of your company. Many SMEs will only have minimal or limited-risk systems with few obligations.

What is considered a 'high-risk' AI system?

High-risk AI systems are those used in critical sectors listed in the Act's annexes. This includes AI for recruitment, employee management, credit scoring, critical infrastructure, education, law enforcement, and medical devices. These systems face the strictest rules.

What are the penalties for non-compliance with the EU AI Act?

The penalties are severe and can be up to €35 million or 7% of global annual turnover, whichever is higher, for violations like using prohibited AI. Other infringements carry fines of up to €15 million or 3% of turnover.

How is the EU AI Act different from GDPR?

GDPR protects personal data, focusing on how it is collected, processed, and stored. The EU AI Act regulates the AI systems themselves, focusing on the risks they pose to health, safety, and fundamental rights, regardless of whether they process personal data.

What is a General-Purpose AI (GPAI) model?

A General-Purpose AI (GPAI) model, or foundation model, is a large AI model like OpenAI's GPT-4 that can be adapted for a wide range of tasks. Under the AI Act, these models have specific transparency requirements, such as providing technical documentation to downstream users.