August 2026 is not a distant date. It is when the European Union starts fining companies that do not comply with the artificial intelligence regulation. And not just large ones: Article 4 of the AI Act applies to every company that uses AI, regardless of size.
This guide does not discuss legislation. It discusses what you need to do this week in your company to stay compliant. Six concrete steps, with real cost and estimated time for each.
Your SME already uses AI (even if you don't know it)
If anyone in your company uses ChatGPT to write emails, if your CRM automatically prioritises leads, if you have a chatbot on your website or if your marketing team uses tools with generative AI functions, your company is an AI deployer under the EU AI Act. That comes with obligations.
The regulation defines an "AI system" broadly: any machine-based system that generates predictions, content, recommendations or decisions influencing physical or digital environments. This includes everything from Copilot to Gmail's spam filter, plus any AI plugin integrated into your workflow.
Shadow AI is the biggest risk. If your employees use ChatGPT or Claude on their own for work tasks, your company is responsible. It does not matter whether you approved it. The first step is knowing what AI is being used in your organisation.
What happens in August 2026
Three things change:
- Article 4 (already in force): every company must ensure its staff has a sufficient level of AI literacy. Demonstrable training.
- Article 5 (August 2025): practices like social scoring, subliminal manipulation and emotion recognition in the workplace are prohibited.
- High-risk systems (August 2026): if you use AI for CV filtering, credit scoring, medical diagnosis or judicial decisions, you need a risk management system, human oversight, technical documentation and logging.
35M €
Maximum fine for prohibited practices (or 7% of global turnover)
15M €
Maximum fine for breaching high-risk obligations (or 3% of turnover)
For SMEs, fines are calculated on the lower figure (percentage of turnover), but 3% of annual revenue is still an amount that can jeopardise a small company's continuity.
Step 1: Inventory your AI
Estimated time: 2-3 hours. Cost: EUR 0.
Open a spreadsheet and list every tool you use that has AI functions. Do not limit yourself to the obvious ones:
| Tool | Counts as AI? | Typical SME use |
|---|---|---|
| ChatGPT / Claude / Gemini | Yes | Emails, documents, customer support |
| HubSpot / Salesforce (lead scoring) | Yes | Classifying and prioritising leads |
| Canva AI / Jasper / Copy.ai | Yes | Generating images and copy |
| GitHub Copilot | Yes | Code generation |
| Website chatbot (any) | Yes | Answering customer queries |
| Gmail spam filter | Yes (minimal risk) | Filtering emails |
| Excel / Google Sheets | No | Formulas and calculations |
Ask your team. Many use AI informally without the company knowing. That is your shadow AI, and it is your responsibility.
Step 2: Classify each system by risk level
Estimated time: 1-2 hours. Cost: EUR 0.
The AI Act establishes four levels. Most SMEs will only have minimal or limited risk systems:
Minimal risk (most SMEs)
Spam filters, product recommendations, code assistants for internal use. No specific obligations beyond Article 4.
Limited risk (transparency obligations)
Chatbots, AI-generated content, deepfakes. You must inform the user they are interacting with AI or that content is generated.
High risk (few SMEs, but verify)
CV filtering, credit scoring, AI in healthcare or education. Heavy obligations: conformity assessment, documentation, human oversight, EU database registration.
Step 3: Train your team (Article 4)
Estimated time: 10 hours per person. Cost: EUR 0 with FUNDAE (Spain).
This is the most urgent obligation. It has been in force since February 2025. You must demonstrate that your staff understands how AI works, its limitations, risks and opportunities.
A master's degree is not needed. A 10-hour course covering fundamentals, risks, responsible use and the legal framework is sufficient. The training must be demonstrable: diploma, attendance records, course syllabus.
FUNDAE covers 100%. Your company's training credits can be used for this course. If you do not use them, they expire in December. Our Secure AI Application for Business course meets Article 4 requirements and we handle all FUNDAE paperwork.
Step 4: Create an AI usage policy
Estimated time: 2-4 hours. Cost: EUR 0 (if done internally).
A 2-3 page document defining:
- Which AI tools are approved for professional use.
- What data can be input into AI tools and what cannot (never personal customer data, confidential financial information, intellectual property).
- Who is responsible for overseeing AI use in each department.
- What to do when an employee wants to use a new AI tool.
- How to label AI-generated content (images, text, code).
You do not need a 50-page document. Something clear and concise that you can share with the whole team and have them sign upon reading.
Step 5: Transparency in interactive systems
Estimated time: 1-2 hours. Cost: EUR 0.
If you have a chatbot on your website, the user needs to know they are talking to a machine. If you generate content with AI (product images, descriptions, posts), you must label it.
Concrete actions:
- Add a notice to your chatbot: "This assistant is powered by artificial intelligence."
- Include a note on AI-generated content: "Text generated with AI assistance and reviewed by our team."
- If you use AI to analyse customer data (scoring, segmentation), reflect this in your privacy policy.
Step 6: Document everything
Estimated time: 1-2 hours. Cost: EUR 0.
Compliance is demonstrated with paperwork. If an inspection arrives, they will ask for:
- Inventory of AI systems with their risk classification.
- Training records (diplomas, course content, attendees).
- AI usage policy signed by employees.
- Evidence of transparency (chatbot screenshots with notice, labelled publications).
- If you use high-risk systems: risk assessment, technical documentation, human oversight records.
Keep everything in a shared folder. Update it every time you add a new tool.
How much it costs to comply
For a typical SME using minimal or limited risk AI:
| Step | Cost | Time |
|---|---|---|
| 1. AI inventory | EUR 0 | 2-3 hours |
| 2. Risk classification | EUR 0 | 1-2 hours |
| 3. Article 4 training | EUR 0 (FUNDAE) | 10h per person |
| 4. Usage policy | EUR 0 | 2-4 hours |
| 5. Transparency | EUR 0 | 1-2 hours |
| 6. Documentation | EUR 0 | 1-2 hours |
For most SMEs, the total cost is EUR 0 if they use FUNDAE credits and do the work internally. The only real expense is time: approximately one week of work to have everything tied down.
5-minute checklist
Use this list to see where you stand:
- Do you know what AI tools are being used in your company? If the answer is "not really", start with step 1.
- Has your team received AI training in the last 12 months? If not, step 3 is urgent.
- Do you have a written AI usage policy? If not, step 4.
- Are your chatbots and AI-generated content labelled? If not, step 5.
- Do you have all documentation saved and accessible? If not, step 6.
Companies have already started. 56.6% of Spanish companies already use agentic AI according to IDC. Those that adapt now will have a competitive advantage and be compliant. Those that wait will face fines and a market disadvantage.
EU AI Act Training for SMEs
Comply with Article 4 at EUR 0
Our Secure AI Application for Business course covers Article 4 requirements: how AI works, risks, limitations, responsible use and the legal framework. 10 hours, 100% subsidised by FUNDAE. We handle all paperwork.
View Secure AI Course →Your team needs secure AI training
The EU AI Act requires AI literacy for all staff from August 2026. Our courses cover compliance, AI agents and governance. FUNDAE can subsidise 100% of the cost.
