EU AI Act from 2 August 2026: What Companies Must Do Now

EU AI Act from 2 August 2026: What Companies Must Do Now

This article is part of our guide AI Agents for SMEs: The 2026 Playbook.

The EU AI Act reaches its most important milestone on 2 August 2026: numerous core obligations of the regulation become enforceable. For SMEs this means that anyone using AI – and especially AI agents – in production needs clear responsibilities, a use-case classification and a documentation structure in place by then. This guide summarizes what applies and what to do.

The EU AI Act timeline at a glance

The risk classes – and what they mean for you

• Prohibited AI (e.g. social scoring): banned since February 2025.
• High-risk AI (e.g. HR, credit scoring, critical infrastructure): extensive obligations – risk management, data governance, technical documentation, human oversight, conformity assessment.
• Limited risk (e.g. chatbots, generated content): transparency obligations – users must know they are interacting with AI.
• Minimal risk: no special obligations.

GPAI: obligations also for users of AI agents

If you use GPAI models (such as large language models) in productive workflows, you must classify, document and monitor your use cases – whether you are a provider or a deployer. The mandatory documentation typically covers four blocks:

1. Risk classification per use case
2. Inventory of the data categories used
3. Human oversight mechanisms
4. Conformity assessment records

Fines: why this is a board-level topic

Violations can be costly: up to €15 million or 3% of global annual turnover for high-risk breaches, and up to €35 million or 7% for prohibited practices. SMEs receive relief – including a 50% reduced fine ceiling, priority access to AI regulatory sandboxes and simplified documentation templates.

Your 7-point checklist for August 2026

1. Create an AI inventory: which AI systems and agents are in use?
2. Assign each use case to a risk class.
3. Name responsibilities (who owns AI compliance?).
4. Set up a documentation framework (the four GPAI blocks).
5. Define and log human oversight mechanisms.
6. Ensure employee AI literacy under Art. 4.
7. Add transparency notices for AI interactions.

A structured approach: AI Governance for SMEs.

Conclusion: set up governance now

Even though the Digital Omnibus extends some deadlines, the organizational base structure – classification, documentation, responsibilities, literacy – should be in place by August 2026. Companies that do this now avoid fine risks and create the foundation to scale AI agents safely.