EU AI Act for SMEs in Spain: what applies now

If you use ChatGPT to draft emails, run a chatbot on your website or use a tool that summarises invoices, the EU AI Act applies to you. Lightly, in most cases. But it has applied for a while, and several dates changed in 2026 that are still being quoted wrong.

Here is where things stand on 15 October 2026.

A European regulation that already applies

The law everyone calls the AI Act is Regulation (EU) 2024/1689. It's a regulation, not a directive: it applies directly in Spain without Spain passing anything.

It entered into force on 1 August 2024 and applies in phases. Two of them are behind us:

From	What applies
2 February 2025	Prohibited practices and the AI literacy obligation
2 August 2025	Rules for general-purpose models (OpenAI's, Anthropic's, Google's…) and the penalty regime
2 August 2026	The transparency obligations in Article 50

The third row is the one that matters most to an ordinary SME, and it's already in force.

What changed in July 2026

On 24 July 2026 the EU published Regulation (EU) 2026/1744, the "Digital Omnibus on AI". It entered into force on 27 July and adjusts the timetable and several obligations. What matters for you:

High-risk is postponed. Annex III high-risk systems, due on 2 August 2026, move to 2 December 2027. Those embedded in regulated products (Annex I) move to 2 August 2028.
Transparency is not postponed. It stays at 2 August 2026, with a window until 2 December 2026 only for generative systems already on the market to mark their output as artificial.
AI literacy stays, reworded: no specific level is required, and the Commission will publish practical examples.
SMEs, and now small mid-caps too, get their own treatment: simplified technical documentation, proportionate management systems and the lower fine cap.

If you've read that "the AI Act has been delayed", that's only true for high-risk. The rest stands.

What applies if you only use AI tools

Most SMEs don't build AI; they use it. In the regulation's terms they are "deployers". For everyday use there are two things to check.

Enough training for the people who use it. Article 4 requires staff who operate AI systems to have sufficient AI literacy for their job and the risk involved. No certificate is needed. You need to be able to show your team knows what the tool does, where it fails and which data must never go into it. An internal session and a note of what was covered, and for whom, is a reasonable start.

Transparency towards your customers. Since 2 August 2026:

If you put a chatbot on your website or WhatsApp, people must know they're talking to an AI system, unless it's obvious.
If you publish AI-generated or manipulated images, audio or video that look real (a "deepfake"), you must say they're artificial.
If you publish AI-generated text to inform the public on matters of public interest, the same applies, unless a person reviewed it and someone takes editorial responsibility.

For your company blog, reviewed by you, or a retouched product photo, the practical risk is low. For a chatbot that doesn't say it's a chatbot, it isn't.

When high-risk might apply to you

High-risk isn't about which tool you use but what you use it for. Annex III includes uses an SME can genuinely have, for example:

Filtering CVs or scoring candidates in a hiring process.
Evaluating employee performance, or deciding promotions and dismissals with the help of a system.
Assessing people's creditworthiness.
Deciding access to essential services.

If you do something like this, you have until 2 December 2027 to meet the obligations of a high-risk deployer: use the system as instructed, keep human oversight and logs, and in many cases inform the people affected. Our advice is not to wait until 2027 to find out whether you're in this group. A list of where you use AI, and for what, is enough to tell.

What has been banned since 2025

Some uses have been prohibited outright since 2 February 2025. They're usually far from an SME's day-to-day, but worth knowing: manipulating people with subliminal techniques, exploiting their vulnerabilities, social scoring, or inferring emotions at work or in education except for medical or safety reasons. The Omnibus adds a ban on creating realistic nude or sexual content of identifiable people without their consent.

Fines, and why not to panic

Article 99 sets fines of up to €35 million or 7% of worldwide turnover for prohibited practices, and up to €15 million or 3% for breaching most other obligations. For SMEs, the lower of the two figures applies, not the higher.

Those are ceilings. What actually protects an SME is having the list of uses, documented training and the transparency notices in place.

And Spain's own law?

Since 2023 Spain has had its own supervisory authority, the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), based in A Coruña.

What it doesn't have yet is the law that sets national penalties and responsibilities. The Government approved the draft organic law on the good use and governance of AI on 26 May 2026, but the bill lapsed when Royal Decree 806/2026 dissolved Parliament on 6 October and called elections for 29 November. It will have to go through Parliament again.

Don't read that as "it doesn't apply in Spain". The EU regulation applies regardless. What's missing is the national piece.

What we would do this week

Make the list. Every AI tool you use, who uses it and what for. A shared document is fine.
Flag anything that could be high-risk. If it touches hiring, employee evaluation or credit, mark it and review it before 2027.
Add the notices. Make your chatbot say it's an automated assistant, and label generated images or videos that could pass as real.
Document the training. One session with the team on what each tool does and which data stays out of it, and a note of who attended.

If the list shows AI is saving you little, or doing it badly, that's no longer a legal question. It's about how you're using it, which is exactly what we do.

This article is for information only and is not legal advice. Dates, articles and regulations were checked on 15 October 2026 against the Official Journal of the EU, the BOE and Cuatrecasas's summary of the Omnibus Regulation. If you use AI for decisions about people, talk to a lawyer before 2027.

Sources

Official Journal of the EU — Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence
BOE (OJEU) — Regulation (EU) 2026/1744 of 8 July 2026, Digital Omnibus on AI
Cuatrecasas — Digital Omnibus on AI has been published (summary of the changes and new dates)
ICAB — Royal Decree 806/2026 of 5 October, dissolving Parliament and calling elections