GDPR and AI Act: What SMEs Need to Know in 2026

The European AI Act is not a text that will come into force all at once on a distant date: it applies progressively, through successive blocks of obligations. Two deadlines already concern every company that uses, or plans to use, artificial intelligence tools.

Since February 2025

A first block of obligations requires staff training on the use of AI, and prohibits certain practices deemed to pose an unacceptable risk. These rules have been in force for more than a year: they are no longer an upcoming deadline, but a baseline that already applies.

Since August 2, 2026

A new block of obligations has come into effect, covering in particular the transparency of AI systems and their classification by risk level. The penalties provided for can reach 35 million euros or 7% of the company's global turnover, a level comparable to that of the GDPR.

The real risk: what you don't know you're already using

52% of SMEs do not know precisely what they are allowed to do with AI (Bpifrance, Baromètre IA 2026). In practice, this uncertainty often translates into a simple situation: teams are already using AI tools, without formal validation, to write, translate, analyze, or generate content, without management having an overall view of it.

This blind spot is what exposes a company the most: you cannot bring into compliance what you have not inventoried.

A company that does not know whether it is allowed to act, does not act. Removing the uncertainty unlocks projects that would otherwise never get started.

What to check first

• Which AI tools are actually used in the company today, including those never formally validated.
• The risk level of each of these uses under the AI Act.
• The existence of an up-to-date register, available for review in the event of an audit.
• The actual training of the teams that use these tools on a daily basis.

What a compliance diagnostic does

A diagnostic identifies all of your AI systems (including undeclared uses), classifies them by risk level, establishes a compliance register, and proposes a prioritized action plan. This is a common starting point at Sundatalab: short, quantifiable, and often the first step before any other project.

This regulatory timeline may change. We monitor official developments and update our recommendations accordingly; this guide does not replace personalized legal advice for your situation.