EU AI Act 2026: What German SMEs with AI Agents Need to Know Now

On August 2, 2026, the main application phase of the EU AI Act becomes effective. For companies running chatbots, voice agents or AI-powered workflow automation, the grace period ends. Non-compliance risks fines of up to EUR 35 million or 7% of annual turnover.

This guide explains the practical obligations for SMEs and mid-sized companies, the relevant risk class for AI agents, and how to achieve compliance within the next three months.

EU AI Act at a Glance

Regulation (EU) 2024/1689 - the EU AI Act - is the world's first comprehensive AI regulation. It entered into force on August 1, 2024, and applies in stages:

• February 2, 2025: Prohibitions of unacceptable practices + AI Literacy obligation (already in force)
• August 2, 2025: Obligations for General-Purpose AI providers (GPAI)
• August 2, 2026: Main application - high-risk obligations + transparency obligations
• August 2, 2027: Full application of all high-risk provisions

The approach is risk-based. AI systems fall into four risk categories:

The Act distinguishes between Providers (developers of the AI system) and Deployers (companies using AI). Most SMEs running a chatbot or voice agent qualify as Deployers - and are therefore subject to obligations.

Are Your AI Agents Affected?

In about 95% of B2B use cases, AI agents fall under "limited risk":

• Sales chatbots on websites, Instagram, WhatsApp Business
• Support bots for FAQ and ticket triage
• Voice agents for hotlines and reservation taking
• Workflow automation with LLM-based document creation

The main obligation here is the transparency obligation under Article 50 - manageable, but mandatory from August 2026.

Watch out for these high-risk use cases that may seem harmless:

• AI evaluating job applications or pre-filtering candidates → High-risk
• AI calculating credit or insurance scores → High-risk
• AI deciding access to education or professional exams → High-risk
• AI classifying emergency calls or prioritizing medical urgency → High-risk

Strictly prohibited:

• Manipulative systems exploiting psychological weaknesses
• Social scoring by private actors or authorities
• Emotion recognition at workplaces or in education (except safety/medical)
• Real-time biometric identification in public spaces (with narrow exceptions)

6 Obligations for SMEs with AI Agents from August 2, 2026

1. Transparency Obligation (Art. 50)

Users must recognize they are interacting with AI. In chatbots, the first bot message must include a disclaimer. In voice bots, an audio disclaimer at the call start is required.

2. AI Literacy (Art. 4) - already in force since February 2025

Staff must have sufficient AI competence. Document training content, participants, and dates.

3. Documentation Obligation

Maintain an AI inventory: provider, use case, data types, risk class, data flows, responsible person.

4. Vendor Due Diligence

Verify GPAI compliance documentation from providers like OpenAI, Anthropic, Mistral. Check DPA, server location, training opt-out.

5. GDPR Synergy

The AI Act complements GDPR. Companies taking GDPR seriously have already covered ~70% of AI Act requirements.

6. Monitoring and Incident Reporting

Define logging policies, retention periods (typically 30-90 days), anomaly detection. High-risk systems require incident reporting to authorities.

Fines: What Does Non-Compliance Cost?

SME relief: For companies under 250 employees and EUR 50 million annual turnover, the lower of the two values applies. Proportionality assessment is mandatory.

Practical Checklist: Are You AI Act-Ready?

• Chatbot displays AI disclaimer in first message
• Voice bot announces AI at call start
• Staff trained in AI Literacy - documented
• Inventory of all deployed AI systems exists
• Risk classification and data flow documentation per system
• Privacy policy mentions AI processing and LLM providers
• DPAs in place with all AI providers
• GPAI conformity declarations obtained
• Logging and retention policies defined
• Bot-to-human escalation workflow documented

FAQ

We use a chatbot from an external provider like ArkeonTech. Are we affected by the AI Act? Yes. You are the Deployer. The provider fulfills their provider obligations - you must additionally implement transparency, AI literacy training, and documentation.

Can we use ChatGPT, Claude or Gemini in customer service? Yes. Ensure providers fulfill GPAI obligations (request conformity declaration), conclude a DPA, and update your privacy policy.

Do we need separate user consent for AI processing? Not specifically for AI use - but possibly for data processing under GDPR. The AI Act transparency obligation is a notice, not consent.

What's the difference between GDPR and AI Act? GDPR governs personal data. AI Act governs AI systems - regardless of whether personal data is processed. Both apply in parallel.

Who enforces compliance in Germany? The Federal Network Agency (Bundesnetzagentur) acts as the central market surveillance authority, BSI handles security aspects, and data protection authorities retain their GDPR responsibilities.

Conclusion: Compliance as Competitive Advantage

The EU AI Act is not a bureaucratic monster but a realistic framework for responsible AI use. For most SMEs with chatbots and voice agents, the workload is limited to:

• Implement disclaimer (1 day)
• Organize staff training (2 days)
• Create documentation (3-5 days)
• Conduct vendor due diligence (1-2 days)

Companies acting now will have no stress in August 2026 - and can use "AI Act compliant" as a quality seal in sales. That's exactly what we do at ArkeonTech: our AI agents ship with transparency disclaimers, EU hosting and complete documentation from day one.

Want to make sure your AI solutions are compliant by August 2026? Schedule a free consultation - we'll review your status and create a concrete action plan.

---

Sources

• Regulation (EU) 2024/1689 (EU AI Act) - EUR-Lex
• Bitkom Guide on EU AI Act - Bitkom
• European Commission - AI Act - European Commission