EU AI Act: what an SME that uses agents must do in 2026

In short

• An SME that uses an AI agent is most often a “deployer” under the EU AI Act. It can also be a “provider”: the text also covers anyone who “has an AI system developed” and puts it into service under its own name. Have your adviser check your case, and write each party's role into the contract.
• Since 2 August 2026, an agent that deals directly with your customers must tell them it is an AI, at the latest at the first interaction.
• The “high-risk” rules (recruitment, employee management, creditworthiness of natural persons) will apply on 2 December 2027. Now is the time to identify these uses.

The EU AI Act, often called the “AI Act”, is Regulation (EU) 2024/1689. Regulation (EU) 2026/1744, known as the “digital omnibus on AI”, has amended it. It entered into force on 27 July 2026.

If the subject seems unclear to you, you are not alone. In 2025, among EU businesses with at least 10 employees that considered AI without using it, 52.5% cite a lack of clarity about the legal consequences (Eurostat).

Here is a practical reading for an SME that uses AI agents. An “agent” here means software that relies on an AI model to carry out a task: sorting emails, preparing a reminder, replying to a customer. This reading does not replace a lawyer's advice.

Deployer or provider: where your business stands

The Regulation defines several roles (Article 3). Two concern you:

• The provider develops an AI system, or “has it developed”, then places it on the market or puts it into service “under its own name or trademark”. This is generally the software publisher.
• The deployer uses an AI system “under its authority”, in a professional setting. This is the case for an SME that uses an agent to sort its emails or prepare its payment reminders. Your employees who use the tool on your instructions are not separate deployers: the business is the deployer (Commission guidelines on Article 50, point 14).

In most cases, your business is a deployer. Two situations need more attention.

1. You have a custom agent developed and you put it into service under your name. The definition of provider also covers anyone who “has a system developed”. The Commission guidelines cite a similar case: a business that develops a chatbot in-house and puts it into service for its own use, under its own name, is a provider. Depending on the arrangement, this role can therefore fall to you or to your service provider. Have your adviser check your arrangement, and write each party's role in black and white in the contract.
2. You change how a tool is used. A deployer is considered a provider if it “modifies the intended purpose” of an AI system so that it becomes high-risk (Article 25). For example, an SME of 30 employees that reuses its support agent to sort job applications.

And the AI model that runs the agent? It is generally a “general-purpose AI model” (recital 99). Its rules apply to its publisher, not to your SME.

The timetable after Omnibus Regulation 2026/1744

Sources: Articles 113 and 111, Commission timetable.

Article 50: telling your customers clearly that they are talking to an AI

The rule fits in two sentences (Article 50):

• An AI system intended to “interact directly with natural persons” must inform them that they are dealing with an AI. Exception: when this is obvious to a person who is “reasonably well-informed, observant and circumspect”.
• The information is given “in a clear and distinguishable manner at the latest at the time of the first interaction”. It complies with the accessibility rules.

On 20 July 2026, the Commission published guidelines on Article 50. They are not binding: only the Court of Justice of the EU gives an authoritative interpretation. They do, however, clarify several points:

• an interaction is “direct” when the AI itself communicates with the person, including by email or by phone;
• an agent must say that it is an AI and on whose behalf it acts;
• the “it is obvious” exception is interpreted strictly. Example given: an internal assistant reserved for trained employees, who know they are using an AI.

In practice:

• Chatbot on your website: the welcome message says it is an automated assistant.
• Voice agent on the phone: it announces it at the start of the call.
• Agent that replies to emails on its own: the reply mentions it, for example at the top of the message. It also says which business the agent is writing for.
• Draft reviewed and sent by an employee: the guidelines exclude this case when the employee uses the AI as an aid and remains the customer's real contact. Be careful: the mere possibility of review is not enough. A review in form only must not be used to get round the obligation. If in doubt, mention the AI anyway.

This obligation applies to the provider, who designs the tool. If you are a provider yourself (see above), it falls to you. As a deployer, check that the notice is displayed and do not turn it off.

Among the other rules in Article 50, two may concern you:

• Marking of generated content (§2): the provider makes the text, images, audio and video produced by the AI detectable by a machine. Exception: an AI that only helps with routine formatting, or that does not substantially change the content provided or its meaning. Systems placed on the market before 2 August 2026 have until 2 December 2026.
• Deepfakes (§4): an image, audio or video generated or modified by AI that resembles real people, places or events and could pass as authentic must be flagged by the deployer. The same rule applies to AI-generated text published to inform the public on a matter of public interest, unless it has been reviewed by a human under the editorial responsibility of a person.

A breach of Article 50 exposes you to a fine capped at €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. For an SME, it is whichever is lower (Article 99).

High-risk: the uses to watch

Annex III lists the so-called “high-risk” uses. For an SME, three families matter:

• Recruitment: targeting job ads, analysing and filtering applications, evaluating candidates.
• Employee management: deciding on a promotion or the end of a contract, allocating tasks based on behaviour or personal traits, monitoring and evaluating performance and behaviour.
• Credit and insurance: assessing the creditworthiness of natural persons or giving them a credit score (except for detecting financial fraud), assessing risk and setting the price of life or health insurance for natural persons.

A sole trader, who operates without creating a company, is a natural person: in France, the INPI points out that the sole proprietorship is legally the same as the person. An agent that scored the creditworthiness of such customers could fall into this case. Check with your adviser.

An Annex III use is not high-risk if it does not pose a significant risk to health, safety or fundamental rights. This is the case, for example, of a narrow procedural task or a preparatory task. It is always high-risk if it involves “profiling”, that is, if it automatically evaluates personal aspects of a person from their data: work, financial situation, reliability, behaviour… (Article 6; definition in Article 4 of the GDPR). The provider that rules out high-risk in this way must document its assessment before placing the system on the market or putting it into service.

These rules will apply on 2 December 2027, instead of the 2 August 2026 originally planned. The deployer will then have to, in particular (Article 26):

• use the system according to its instructions for use;
• assign human oversight to people who are competent, trained and have the necessary authority;
• monitor how it operates and report problems;
• keep for at least six months the activity logs generated automatically, when they are under its control;
• inform staff representatives and the employees concerned before it is put into service at work;
• inform the people concerned when the system makes, or helps make, decisions about them.

The uses planned for our four standard agents, in preparation (Payment Reminders and Invoices, Emails and Support, Quotes and Prospects, Accounting Documents), do not, in principle, appear in this list. One point remains to be examined: the list of “at-risk” customers that the Payment Reminders and Invoices agent will prepare, if these customers are natural persons (see above). We will apply to all our agents rules close to those for high-risk: at the start, the agent proposes and a human decides; each action will be logged; the agent stops and hands over in case of doubt.

Article 4 (AI literacy): the essentials

Since 2 February 2025, providers and deployers must see to the “AI literacy” of their staff. Regulation 2026/1744 has relaxed this rule (Article 4):

• providers and deployers “take measures to promote” this literacy, according to each person's knowledge and the context of use;
• the obligation “does not require” guaranteeing a specific level for each person;
• the Commission and the Member States help businesses, in particular SMEs; the Commission publishes practical examples.

The text does not impose a format. A simple basis: short training on the tool and a written rule of use. We go into this in our article on training teams.

What the contract provides: who carries which role

A contract for setting up agents should specify, agent by agent:

• each party's role: who is the provider, who is the deployer;
• the “you are dealing with an AI” notice: who designs it, where it is displayed;
• the intended use and the excluded uses, in particular those in Annex III. Changing the use calls for a new analysis;
• the log: what is recorded, for how long, who has access;
• incidents: who detects them, who informs whom;
• personal data: the processing contract provided for by Article 28 of the GDPR (text on the CNIL website).

At Kendu Intelligence, the rulebook for each agent, which you will approve before it is built, will specify its mission and its stopping cases. Each party's role under the Regulation will be defined with you in the quote, depending on the chosen deployment. Each action of our agents will be logged.

Going further

• Our method: the agent's rulebook approved by you, autonomy levels 0 to 3.
• Training: training courses in preparation, hands-on introduction included in every set-up.
• Data and security: where your data will be hosted, and where the AI model can be operated.
• The audit: we review your tools, your uses and the personal data processed. It is on quote.