Home/Blog/
EU AI Act For SMEs 2025 A Practical Field Guide

EU AI Act for SMEs 2025 A Practical Field Guide

EU AI Act for SMEs 2025 A Practical Field Guide
in:
Little Known Topics
Created:
20 Aug 2025

with ISO/IEC 42001 & NIST AI RMF alignment

Not legal advice. Always verify against the official text and your counsel.

1) What applies when (2024–2027)

2) First decision: who are you under the Act?

3) Are you “high-risk”?

Two main paths to high-risk status:

  1. AI that is a safety component of regulated products (Annex I sectors), or

  2. AI used in Annex III use cases (e.g., biometrics, critical infrastructure, education testing, employment screening, essential services, law enforcement, migration, justice). Some Annex III uses can be de-scoped if they present no significant risk per Article 6(3)—you must document that assessment. artificialintelligenceact.eu+1wilmerhale.com

Hidden gotcha: If you conclude your system is not high-risk under Article 6(3), you still have a registration duty (see §6). EUR-Lex

4) If you’re high-risk: your Quality Management System (QMS)

Article 17 requires providers of high-risk AI to implement a documented QMS that covers (non-exhaustive): compliance strategy & conformity assessment, data governance, risk management, technical documentation, record-keeping & logs, human oversight, accuracy/robustness/cybersecurity, and post-market monitoring. This underpins CE-marking after assessment. artificialintelligenceact.euEUR-Lexpolicyreview.info

Provider essentials (high-risk):

5) If you’re not high-risk: what still applies?

6) EU Database registration (often missed)

Before placing Annex III high-risk systems on the market (with some exceptions), providers must register in the EU database (Article 71).
And if you classify a system as non-high-risk under Article 6(3), you must register that too (Article 49(2)). EUR-Lex

7) GPAI (General-Purpose AI) obligations (2025–2027)

From 2 Aug 2025, GPAI model providers face transparency & safety duties (e.g., technical documentation, training-data summaries, copyright safeguards; additional testing/incident reporting for systemic-risk models). The GPAI Code of Practice (published 10 Jul 2025) and Commission guidelines (18 Jul 2025) are key implementation aids; adherence to the Code can help demonstrate compliance ahead of harmonized standards. Full enforcement for GPAI begins 2 Aug 2026; legacy models must comply by 2 Aug 2027. Dijital Strateji+1skadden.comArnold & Porter

8) Using ISO/IEC 42001 to structure your program

ISO/IEC 42001:2023 is the first AI management system standard (AIMS). Adopting it gives SMEs a repeatable governance backbone (policy→risk→controls→monitoring→improvement) aligned with ethical, transparency, and risk objectives. Note: It does not automatically create presumption of conformity under the AI Act unless adopted as a harmonized European standard (EN) and cited in the OJEU. CEN/CENELEC’s JTC 21 is actively developing AI Act-supporting standards and considering adoptions. ISO+1CEN-CENELECAI Watchjtc21.eu

Practical takeaway: Implement ISO/IEC 42001 processes now; once AI-Act harmonized standards land, you’ll only need to bridge the gaps.

9) NIST AI RMF (GOV–MAP–MEASURE–MANAGE): quick cross-walk

The NIST AI RMF 1.0 is voluntary but widely used. NIST also curates crosswalks to other frameworks—use these to justify your control mapping. NISTNIST YayınlarıNIST AI Resource Center

Indicative mapping (helpful for auditors):

10) A 90-day action plan for SMEs

Days 1–15 — Scoping & roles

Days 16–30 — Risk & governance

Days 31–60 — Documentation & controls

Days 61–90 — Registration & readiness

11) Compliance checklists you can reuse

Provider (high-risk) mini-checklist