EU AI Act: What Small Companies Have to Do Now, and What Is Coming

A twelve-person software company in Ghent shipped a small feature: when a patient emails the dental practice, the software drafts the reply. Six months later a hospital group sent a compliance questionnaire. Question eleven: are you a provider of an AI system under Regulation (EU) 2024/1689, and please attach your conformity documentation.

He cannot write "no". He also does not need a lawyer. And question eleven asks for a document that, for his product, does not have to exist. This episode is why all three are true.

For a small company the Act arrives as a customer questionnaire long before an inspector does. The skill is telling apart what applies today from what applies in 2027.

What already applies: the prohibitions of Article 5, including the two a small developer can walk into. Article 4 on AI literacy. And Article 50 on transparency, in force since 2 August 2026, which ordinary software companies are least ready for: it is engineering work, not a policy document.

Including the part almost nobody has noticed. The Digital Omnibus gave a four-month transitional period for the marking duty in Article 50(2), but only for systems already on the market before 2 August 2026. Those have until 2 December 2026. Anything shipped after that gets no grace period at all.

What is coming: 2 December 2027 for the Annex III use cases, 2 August 2028 for high-risk AI inside regulated products. A module that decides who gets an instalment plan is evaluating creditworthiness, presumed high risk subject to the filter in Article 6(3). One sprint can turn a small company into the provider of a high-risk system.

Also here: no size threshold anywhere in Article 2, three narrow ways out of scope, why the fine ceiling in Article 99 inverts for small companies, why most high-risk systems need no notified body, and the Article 25 trapdoor that turns a buyer into a provider. Plus the honest part: the classification guidelines are still a draft and no harmonised standard has been cited.

Two hosts, twenty minutes, every article number checked so you can check us.

DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a real conversation. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for its content.

This episode is information, not legal advice. Before you sign a compliance warranty in a customer contract, talk to a qualified lawyer.

CHAPTERS

0:00 These are AI voices, and why we say so first

1:44 Welcome to Project Cognivora

2:21 There is no size threshold in the AI Act

3:50 The three ways out of scope

4:57 What already applies: the prohibitions of Article 5

6:26 Article 50, in force now, and it is engineering work

9:11 Article 4 in a company of twelve

9:36 General-purpose AI, and the fine that inverts

11:21 What is coming: 2 December 2027 and 2 August 2028

13:17 The guidelines are a draft, the standards unpublished

14:33 What being small actually buys you

16:21 Article 25, the trapdoor for small builders

17:15 Ninety seconds: four things to do on Monday

19:17 What happened in Ghent

SOURCES

Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj

Commission FAQ on Article 50, the December 2026 grace period: https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act

Project Cognivora: https://www.project-cognivora.com