EU AI Act from 2 August 2026: what really applies to SMEs now

What really takes effect on 2 August 2026

The most tangible new point is in Article 50, the transparency obligations. Anyone who deploys an AI system that communicates directly with people must disclose from 2 August that AI is involved. Examples are a chatbot on your website, an AI phone assistant or automated email handling that replies on behalf of your company. Deepfakes and AI-generated text for publication must also be labelled as such. This obligation has not been postponed by this spring's simplification package.

A transition period applies to the machine-readable marking of synthetic content (Article 50(2)): systems that were already on the EU market before 2 August 2026 have until 2 December 2026. New systems must comply immediately. Note that this watermarking is an obligation for the provider of the AI system, not for you as a user.

In addition, from 2 August the European Commission can impose fines under Article 101 on providers of general-purpose AI models, of up to €15 million or 3 percent of worldwide annual turnover. That affects parties such as OpenAI, Google and Anthropic. A wholesaler that uses Copilot is not covered.

The big misunderstanding: the high-risk part has in fact been postponed

Anyone who followed the coverage this spring already knows: the simplification package (the Digital Omnibus) has in fact pushed the heaviest obligations back. High-risk AI under Annex III, such as AI for recruitment and selection, credit scoring, biometrics and education, does not need to comply until 2 December 2027. That is sixteen months later than the original date of 2 August 2026.

AI built into regulated products under Annex I, such as machinery and medical devices, has even been given until 2 August 2028. The deadline for national AI sandboxes moves to 2 August 2027. If you use AI in recruitment, appraisal or rostering, your planning horizon is therefore December 2027. Anyone who sells you a rush project now, arguing that it must be finished before August, is selling urgency that does not exist.

What already applied and is therefore not news

The prohibited AI practices (Article 5) and the AI literacy provision (Article 4) have applied since 2 February 2025, a year and a half before this date. Anyone who has not yet taken measures for the AI literacy of their people has therefore been behind for some time already, but that is not 2 August news.

The same goes for the rules for providers of general-purpose AI models: they have been in force since 2 August 2025, with a transition period until 2 August 2027 for models that were already on the market before then.

Fines: which amounts are correct, and for whom

The often-quoted €35 million or 7 percent of turnover applies to prohibited practices such as social scoring and manipulative AI, not to the absence of training. Moreover, that penalty framework (Article 99) has existed since August 2025 and is therefore not new either.

Relevant for the level-headed reader: Article 4, the AI literacy provision, is not on the list of provisions in Article 99 that are directly subject to fines. The simplification package has also softened the wording into a best-efforts obligation: you must be able to show that you are making a serious effort, and no guaranteed level of knowledge per individual is required. That does not make the obligation optional, but it does make scare stories about immediate fines for a missed course untenable.

The Netherlands: the regulators are known, the law is not yet

In the Netherlands, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) and the RDI (Dutch Authority for Digital Infrastructure) have been designated as coordinating supervisory authorities. But the Uitvoeringswet AI-verordening (the Dutch act implementing the AI Act), which formally governs national enforcement, will not yet be in force on 2 August 2026: the online public consultation closed on 1 June, the advisory opinion of the Raad van State (Council of State) followed, and after that the bill still has to pass the Tweede Kamer (Dutch House of Representatives). The Dutch government itself acknowledges that national implementation will not be ready in time.

The Regulation is directly applicable, so the obligations do apply. But at present there is no operational national power to fine SMEs. There will be no inspector on your doorstep on 3 August. Do not use that breathing space to do nothing, but to put things in order calmly and properly.

What this means in practice for logistics, food and agri

For most companies in our target group, which use AI for planning, quality control, administration or forecasting and run no high-risk applications, exactly one thing changes on 2 August and one thing continues to apply.

The one new thing: if an AI system communicates with customers, job applicants or suppliers on your behalf, that must be disclosed from now on. The one thing that remains: Article 4 asks for measures for the AI literacy of everyone who works with AI, and that already applied. The rest is either not applicable to you, or only becomes relevant towards December 2027.

What to put in place this month

Four points, in order of urgency:

• Take stock of where AI communicates with people on behalf of your company (a chatbot on the site, an AI phone assistant, automated email handling) and make sure a clear AI notice is shown there. This is the only hard new obligation.
• Record who in your organisation works with AI, in which processes, and who has been trained in what. That way you can show which measures you have taken for Article 4.
• Adopt a short AI usage policy of no more than one A4 page: which tools are permitted, what may and may not go into a prompt, and when the human decides.
• In your AI inventory, flag which applications lean towards Annex III (recruitment, appraisal, credit decisions) and put December 2027 in your diary. No panic, but do plan.

The calendar from here

For those planning ahead: on 2 December 2026 the transition period for machine-readable marking of existing systems ends. 2 August 2027 is the deadline for national AI sandboxes and for older general-purpose AI models. By 2 December 2027, high-risk applications under Annex III must comply. And on 2 August 2028 Annex I follows, the AI in regulated products. If you put your inventory and literacy in order now, for example through the free Practice Scan, you will not have to rush for any of those dates.