The Proportionate Path: Compliance Without a Legal Department

The question smaller organisations ask first is whether the Act applies to them. It does. There is no threshold of headcount or turnover below which the Regulation switches off, and a five-person company using a recruitment screening tool holds the same deployer duties as a multinational using the same tool.

What scales is not whether you comply but how much apparatus compliance requires. Three mechanisms do the scaling.

The obligations themselves are mostly outcome-stated rather than process-prescribed, so a small organisation can satisfy them with a document where a large one needs a department.

The Act contains explicit simplifications for smaller providers, which the 2026 Omnibus widened.

And the penalty caps apply differently to SMEs, taking the lower of the fixed amount or the percentage rather than the higher.

So the realistic goal for a small organisation is not a compliance programme. It is a small number of correct decisions, written down, and revisited when something changes.

The 2026 amendments were substantially aimed at reducing burden, and three changes matter here.

The simplified quality management system route, previously available only to microenterprises, was extended to all SMEs including start-ups. A quality management system is the documented set of processes a provider of a high-risk system must maintain, and the simplified form is a materially lighter obligation.

A new category, small mid-caps, was introduced for organisations with fewer than 750 employees and under 150 million euros in annual turnover. These benefit from simplified technical documentation for high-risk systems and lighter quality management requirements. This category did not exist before and it captures a large band of mid-sized European businesses that previously faced the full regime.

And the deferral of the high-risk deadlines, to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I, gives smaller organisations time that large ones did not need as badly.

Note what these simplifications are about: they reduce the documentation and process burden on providers. They do not change the substantive requirements a high-risk system must meet, and they do not touch deployer duties at all.

Most organisations reading this are deployers of systems that are not high-risk. That position is genuinely light, and it is worth stating exactly what it consists of so nobody builds more than it requires.

Know what AI systems you use. This is the foundation of everything else and the part most often skipped.

Confirm none of them involves a prohibited practice. The two that catch ordinary employers are emotion inference applied to staff and biometric categorisation inferring sensitive attributes.

Check whether any sits in an Annex III area. If one does, that is the system that needs real attention and probably advice.

Support the development of AI literacy among staff and others operating systems on your behalf, following the amended Article 4.

Meet the Article 50 transparency duties from 2 August 2026 where they apply: telling people they are dealing with an AI system, and disclosing synthetic or manipulated content.

Write down what you decided and why.

That is the whole list. For an organisation whose AI use is a general assistant and some features inside existing software, this is a few days of work, not a project.

One artefact does most of the load, and it is a table rather than a policy.

For each AI system, record: what it is and who supplies it; what it does and what decision it influences; who it affects, distinguishing staff, customers and the public; your role for that system, provider or deployer; the tier you assessed it into; the reasoning for that assessment; who owns it internally; and the date of the assessment.

The reasoning column is the one that matters and the one usually left blank. The Act is full of judgement calls, most obviously the Article 6(3) derogation, and a judgement without recorded reasoning is indistinguishable from an omission when someone asks about it two years later.

A spreadsheet is a perfectly adequate format at small scale. What makes it work is a trigger that keeps it current: bind an entry to the moment a new tool is approved, so the register updates as a side effect of procurement rather than as an annual exercise nobody schedules.

This register is also the input to everything else, including the governance framework and the vendor diligence covered in the companion cursus.

Any organisation that did GDPR properly has already built much of what the AI Act needs, and rebuilding it separately is the most common source of wasted effort.

The record of processing activities overlaps heavily with the AI system register. Adding columns for role and risk tier is usually cheaper than starting a new inventory.

A data protection impact assessment covers much of the ground a fundamental rights impact assessment requires, and where both apply the Act allows the fundamental rights assessment to build on the data protection one rather than duplicate it.

The lawful basis analysis, the data minimisation reasoning, and the retention decisions are all reusable where the AI system processes personal data.

The governance apparatus, meaning the roles, the review cadence and the escalation route, is the same apparatus. It does not need a parallel structure.

What does not carry over: the AI Act's requirements about accuracy, robustness, human oversight and technical documentation have no GDPR equivalent, and the Act reaches systems that process no personal data at all. So reuse the structure, then add the parts that are genuinely new. The 2026 Omnibus also clarified that special category data may be processed where necessary for bias detection and correction, which resolves a real tension between the two regimes.

The Act requires each Member State to establish at least one AI regulatory sandbox, a controlled environment in which providers can develop, train, test and validate innovative AI systems under regulatory supervision before placing them on the market.

Two features make it relevant to smaller organisations specifically.

SMEs including start-ups are to be given priority access, and access is free of charge for them, without prejudice to the recovery of exceptional costs.

Participation produces documented engagement with the supervisory authority, including a written exit report, which is useful evidence of good faith even where it confers no formal presumption.

The honest caveat is that sandbox capacity is finite and the participating population will be small relative to the number of organisations deploying AI. Treat it as a route worth investigating if you are building something genuinely novel in a high-risk area, and not as a general compliance mechanism.

The more broadly available equivalent is the national competent authority itself. Several Member States have set up guidance functions, and asking a question before deploying is cheaper than defending a decision afterwards.

With the timeline as amended, a proportionate order of work for an organisation starting now.

Immediately, and independent of any deadline: complete the AI system register and confirm no prohibited practice is running. Prohibited practices have been unlawful since February 2025, so this is not preparation, it is a check for an existing exposure.

Before 2 August 2026: meet the Article 50 transparency duties. Where you operate a customer-facing assistant, ensure people are told. Where you publish AI-generated content on matters of public interest, arrange either human editorial review or disclosure. This is the nearest real deadline for most organisations.

Before 2 December 2026: confirm marking obligations for generative systems already in use, and confirm nothing in your estate touches the new prohibition on AI-generated intimate imagery.

During 2027, for any Annex III system: the substantive high-risk work, ahead of 2 December 2027.

During 2027 to 2028, for embedded systems in regulated products: the Annex I work ahead of 2 August 2028.

The sequencing principle is that classification comes first and is cheap, while the high-risk work is expensive and now has room. Doing them in the wrong order is how organisations spend money preparing systems that turn out not to be high-risk.

A deployer's practical leverage sits in the contract, because most of the information you need to comply is held by the provider.

Four things belong in any agreement for an AI system.

A statement of the intended purpose, which is what the provider's conformity assessment was carried out against, and which fixes the boundary beyond which you may become a provider yourself.

An undertaking to supply instructions for use and the information a deployer needs to meet its own obligations, including for high-risk systems the information required to exercise human oversight.

Notification of substantial modification, since a change at the provider's end can alter your position, and notification of any change in the system's regulatory classification.

Allocation of responsibility for the Act's obligations, and cooperation in the event of a serious incident or an authority request.

One question is worth asking of every existing vendor now, because it has a bearing on grandfathering: was this system placed on the EU market before the applicable high-risk date, and what is your position on substantial modification? The answer determines which regime the thing you are using actually sits in. Vendor diligence in depth is the subject of the companion cursus on AI procurement.

Most of the work above does not require legal advice. Some of it does, and knowing the boundary saves money in both directions.

Handle internally: building the register, identifying which systems are AI systems, confirming you are a deployer of ordinary tools, meeting transparency duties, and running an AI literacy programme.

Get advice when: a system sits in an Annex III area and you intend to rely on the Article 6(3) derogation, because that is a documented legal assessment you may have to defend; you may have become a provider by branding, modification or repurposing; you are building a high-risk system yourself; a system touches employment, credit, education, essential services or biometrics; you operate across several Member States with differing national implementations; or you are close to a prohibited practice, particularly emotion inference in a workplace context.

The general rule: the Act's boundaries are where the judgement lies, and the boundaries are exactly where an inexpensive question prevents an expensive position. An organisation that has done the register can ask a lawyer a narrow, cheap question about two systems, rather than an open-ended and expensive one about its whole estate.

That, ultimately, is what the proportionate path buys.