EU AI Act 2026: obligations for SMEs and finance teams

The EU AI Act becomes a board-level issue in 2026. Even SMEs that do not build AI systems often deploy them: content generation, sales scoring, accounting automation, HR screening, customer support, cash forecasting or document review. The question is no longer whether AI is used, but whether the company can classify, document and control those uses.

See also our pieces on accounting AI, AI and accounting, accounting automation, compliance audit and DPO requirements.

The EU AI Act entered into force on 1 August 2024. The European Commission states that it becomes fully applicable on 2 August 2026, with exceptions: prohibited practices and AI literacy from 2 February 2025, governance and general-purpose AI obligations from 2 August 2025, and certain high-risk rules for regulated products from 2 August 2027. As of 3 May 2026, companies should also monitor the Commission's simplification proposals.

An SME can be concerned even if it does not publish an AI model. The AI Act distinguishes roles such as provider, deployer, importer and distributor. A company buying an AI SaaS tool is commonly a deployer. A startup putting an AI tool on the market may be a provider.

AI Act compliance does not replace GDPR, trade secrecy, client confidentiality or professional duties. The first SME incident is often simple: an employee pastes a customer list, payroll file, contract or accounting balance into an unapproved tool.

AI governance checklist#

• map AI tools already used by teams;
• classify uses by risk level;
• prohibit sensitive data in unapproved tools;
• document human review for important decisions;
• retain supplier contracts and settings;
• train teams on AI literacy;
• keep an incident and correction register.

Finance teams can connect this work to digital finance transformation, French accounting services and outsourced CFO support. For tech companies, see our startups and tech page.

Management must balance productivity and control. The goal is not to ban AI, but to decide which uses are authorised, who validates them and which tools are approved.

Good AI adoption often starts with focused cases: invoice extraction through Dext, bank matching in Pennylane, or reporting in Power BI. ROI should be measured in time saved, control quality and fewer manual corrections.

For a finance team, the AI Act workstream should be embedded into the monthly close and internal-control roadmap. The safest approach is to maintain a simple register that links each AI use case to a business process: invoice capture, supplier review, bank matching, management reporting, cash forecasting, payroll checks or customer support. Each line should state the tool used, the data processed, the human reviewer, the supplier contract and the fallback process if the tool is unavailable or wrong.

This matters because AI errors are rarely isolated. A wrong supplier classification can create VAT issues. A hallucinated management comment can mislead investors. A payroll or HR recommendation can create legal and social risk. A cash forecast generated from incomplete data can push management toward the wrong financing decision. The finance function therefore needs a control mindset: AI can accelerate work, but the company must still evidence who reviewed the output and how exceptions are corrected.

An SME does not need an overly complex compliance binder for every low-risk use. It does need a practical evidence file. Keep the approved-tool list, supplier terms, data-processing notes, internal policy, training log, risk classification, and examples of human review. For higher-risk or customer-facing systems, add model documentation received from the vendor, incident logs, testing notes and board-level approval of the use case.

The strongest E-E-A-T signal for this type of YMYL content is not a promise that AI is safe. It is the opposite: a clear statement that finance, tax, HR and legal decisions remain under human responsibility, with documented review.

• Monitor any EU changes to the high-risk implementation timeline.
• Do not use consumer AI tools for sensitive finance or HR data.
• Treat HR and scoring use cases with particular care.
• Train teams: AI literacy is already part of the EU timetable.
• Add AI clauses to supplier contracts where critical data is processed.