EU AI Act 2026: What French SMBs Must Put in Place Before Year-End
The European AI regulation is entering into force progressively in 2026. Here are the concrete obligations for French SMBs using ChatGPT, Make.com, or AI tools in their business processes.
The EU AI Act is no longer future legislation. Since August 2024, provisions on prohibited AI systems are in force. Since February 2025, rules on general-purpose AI models apply. And by August 2026, obligations for high-risk systems enter application. For French SMBs that have adopted AI tools in the past two years, the countdown has started.
What Already Applies
Since February 2025, obligations on general-purpose AI models (GPT, Claude, Gemini) apply to anyone using these models via API in products or processes.
According to a Bpifrance study (2026), 67% of French SMBs use at least one generative AI tool in their operations. Less than 12% have implemented EU AI Act-compliant transparency notices.
What Arrives Before End of 2026
Before August 2026, limited-risk AI systems must meet transparency obligations. If your SMB uses: a customer chatbot powered by ChatGPT → disclose that users are interacting with AI; automatic CV screening → document criteria and inform candidates; commercial scoring tools → document decision criteria.
3-Step Action Plan for SMBs
- Inventory (1 day): List all AI tools used. Classify each: prohibited / high-risk / limited-risk / minimal risk.
- Compliance for limited-risk uses (1 week): Add visible transparency notices for all AI tools in contact with third parties.
- Evaluate high-risk uses (2-4 weeks): If using AI for decisions affecting people, commission a compliance assessment.
Gartner estimates full compliance costs at €25,000-40,000 for a 50-employee SMB, versus €200,000-500,000 in potential sanctions.
Frequently asked questions
Is my company affected by the EU AI Act if I only use ChatGPT?
Yes, if you use ChatGPT in processes that affect decisions about people (hiring, credit, customer scoring). You are then a 'deployer' of a limited-risk AI system and transparency obligations apply from August 2026.
What are the fines for SMBs for non-compliance?
Fines range from €7.5M or 1% of global revenue (prohibited uses) to €15M or 3% of revenue (failure to meet obligations). For an SMB with €2M revenue, the typical maximum fine would be €60,000.