EU AI Act readiness for SMEs: a practical first pass

An AI Act readiness assessment for a small or mid-sized company comes down to five things: list every AI system you use, sort each use by risk, make sure the people using them understand them, check the GDPR basics for any personal data, and get clear answers from your vendors. You can do the first pass in a few weeks without a consultant. What you can't do is skip it.

I run Skcript Applied Labs, and we build AI systems for companies, now including teams in Europe. We are engineers, not lawyers. This is the practical pass I would want done before any build starts, and it is not legal advice. Where the law is involved, confirm with counsel.

Why SMEs should start now

The AI Act applies by role and by use, not by company size. If you use AI systems in your business in the EU, you are a "deployer". If you build an AI system and put it on the market under your name, you are a "provider". Most SMEs are deployers, and that is the lighter role, but it is not an empty one.

Parts of the Act already apply, including the ban on certain practices and the AI literacy duty in Article 4. Other parts, including the high-risk rules, have dates that have been debated and moved as part of EU simplification work. I am not going to quote those dates here, because they keep changing. Check the current text and timeline with counsel.

The good news is that the first pass is mostly about knowing what you have. That is useful whatever the final dates turn out to be.

Step 1: Build an AI inventory

You can't classify what you haven't listed. Most companies find more AI than they expected: a chatbot on the website, an AI feature switched on inside the CRM, a CV screening tool HR bought last year, and staff using personal chat accounts for customer emails.

For each item, write down:

• What it is and who owns it inside the company.
• What task it does and who relies on the output.
• Whether you built it, bought it, or it came switched on inside another tool.
• What data goes in, and whether any of it is personal data.
• Where the vendor stores and processes that data.
• Whether a person checks the output before it affects anyone.

A spreadsheet is fine. The point is one list with an owner per row. Ask each team lead, and ask finance for software invoices, because that is where the forgotten tools show up.

Step 2: Classify each use case

The Act sorts AI uses into rough bands. At a general level:

• Prohibited practices. A short list of uses that are banned, such as certain kinds of manipulation, social scoring and some uses of biometrics. Most SMEs are nowhere near these, but check.
• High-risk. Uses in areas the Act lists, such as hiring and managing staff, credit scoring, access to essential services, education and biometrics, plus AI that is a safety part of a regulated product. These carry the heaviest duties.
• Transparency duties. Systems that talk to people, or create content that could be mistaken for real, carry duties to tell people they are dealing with AI or that content is generated.
• Everything else. Most back-office work, like reading invoices, sorting supplier emails or drafting replies a person approves, sits here. The literacy duty and GDPR still apply.

The question that catches SMEs is HR. A tool that ranks CVs or scores staff performance is in a high-risk area even if you bought it off the shelf. If you deploy a high-risk system, you will have duties around using it as instructed, human oversight, monitoring and keeping logs, and informing the people affected. Get counsel on anything in that band before you go further.

Step 3: Cover AI literacy (Article 4)

Article 4 asks providers and deployers to take measures so their staff, and others using AI on their behalf, have a sufficient level of AI literacy for their role. The exact wording has been part of the simplification discussions, so check the current version, but the practical work is the same.

It does not mean sending everyone on a course. It means:

• People who use an AI tool know what it is for, what it gets wrong, and when to check with a person.
• People who approve AI output in a sensitive process get more than that.
• You have a short record of who was trained on what, and when.

A one-hour session per tool, built around your own examples of where it goes wrong, does more than a generic certificate. Our test sets are useful here, because they show staff real cases where the model failed.

Step 4: Check the GDPR basics

For most SMEs, GDPR is the bigger and more familiar risk. The AI Act sits on top of it, not instead of it. For any AI use that touches personal data:

• Roles. Are you the controller, and is the vendor your processor? You need a processor contract under Article 28.
• Legal basis. Which basis covers this use, and does it match what you told people when you collected the data?
• DPIA. If the processing is likely to result in high risk to people, do a data protection impact assessment under Article 35 before going live. New technology on personal data at scale often qualifies.
• Automated decisions. If the system makes decisions with legal or similarly significant effects on people with no human involved, Article 22 applies. Keeping a person in the loop who actually reviews the case matters.
• Transfers. If the vendor processes data outside the EU, check the transfer mechanism.
• Data minimisation. Send the model only what the task needs.

German and other national data protection authorities have published guidance on AI and GDPR. Your DPO or counsel should know which applies to you.

Step 5: Ask your vendors the right questions

Most of your AI comes from vendors, so most of your answers do too. I would want these in writing:

• Where is our data stored, and where does the model process each request? These are often different.
• Is our data used to train or improve any model, and can we turn that off by default?
• Which subprocessors touch our data, and in which countries?
• How long are prompts, outputs and logs kept?
• Are you a provider under the AI Act for this system, and what documentation and instructions for use do you give deployers?
• How do we delete everything when we leave?

If a vendor can't answer clearly, that is an answer. I wrote more on these questions in Keeping your data in the UAE. The region is different, but the storage versus processing trap is the same.

What a 10-day pilot can and can't do for compliance

We run a fixed-price 10-day AI pilot on one task. Here is what that does and doesn't give you on the compliance side.

What it can do:

• Produce a complete inventory entry for that one system: owner, task, data, vendor, processing location.
• Settle where data goes before any real data is used, and record it on the scorecard next to accuracy and cost.
• Give you a documented test set from your real cases and a record of how each model performed, including the mistakes.
• Build human review into the first working piece, so a person approves anything important.
• Give the team who will use it real examples of where it fails, which feeds your literacy record.

What it can't do:

• Tell you whether a use case is legally high-risk. That is counsel's call.
• Replace a DPIA, a fundamental rights assessment or a conformity assessment.
• Make the rest of your AI estate compliant. It covers one task.

In practice, the pilot is a good way to do one AI project properly and end up with the paperwork a lawyer would ask for. It is not a compliance programme. You can see what it costs on our pricing page.

A quick self-check

Copy this and tick what you can answer today.

• We have one list of every AI system we use, with an owner for each.
• We know which of those use personal data.
• We have checked whether any use falls in a high-risk area, especially HR.
• Staff who use AI tools have had training that fits their role, and we recorded it.
• Personal chat accounts are either replaced with a business plan or clearly off-limits for company data.
• We have processor contracts with every AI vendor that handles personal data.
• We know where each vendor stores and where it processes our data.
• We have done, or decided we don't need, a DPIA for each AI use on personal data.
• A person reviews AI output before it makes a significant decision about someone.
• Counsel has confirmed the current AI Act dates that apply to us.

If you ticked fewer than half, start with the inventory. Everything else depends on it.

Where to go from here

The first pass is mostly organisation, not engineering. Once it is done, you know which AI uses are fine, which need a lawyer and which are worth building properly.

If you have one task you want to automate and you want it done with the compliance groundwork in place, see how we work in AI consulting for Europe, or start a chat with us on the site. If you are in the Gulf, the equivalent guide is PDPL and DIFC AI compliance in the UAE.