Key takeaways
- The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases until 2028, not all at once.
- The Digital Omnibus on AI (Regulation (EU) 2026/1744 of 8 July 2026) postponed the deadlines for high-risk systems: December 2027 and August 2028 instead of 2026 and 2027.
- The ban on certain practices and the AI literacy obligation already apply since 2 February 2025, regardless of company size.
- Fines go up to 35 million euros or 7% of worldwide turnover, but an SME is sanctioned on the basis of the lower of the two caps.
- The European Commission's official portal does not currently list any Belgian authority formally designated to enforce the AI Act, which does not suspend the obligations themselves.
Many Belgian SME owners believe the EU AI Act is a distant deadline, set for 2026 or 2027. In reality, part of its obligations has applied since February 2025, and the timeline for the remaining deadlines changed in July 2026 with the adoption of a corrective text. This article sets out the dates that actually matter today for a Belgian SME, the obligations that follow from them depending on the risk of the system used, and the penalties for non-compliance.
What the AI Act changes for Belgian SMEs
Regulation (EU) 2024/1689, known as the AI Act, governs the placing on the market and use of artificial intelligence systems in the European Union. It entered into force on 1 August 2024, twenty days after its publication in the Official Journal of the European Union.
The text does not distinguish obligations by company size, but by the risk level of the AI system used or placed on the market. An SME that simply uses a consumer-facing AI tool (drafting, translation, document sorting) is subject to lighter obligations than a provider that develops or markets a system classified as high-risk, for example for recruitment or credit scoring.
AI Act application timeline: the key dates
The regulation does not apply all at once: its provisions take effect in successive blocks, spread over several years.
- 1
Regulation enters into force
1 August 2024Regulation (EU) 2024/1689 enters into force, but most of its obligations are not yet applicable.
- 2
Prohibited practices and AI literacy
2 February 2025The prohibited AI practices (art. 5) and the staff AI literacy obligation (art. 4) become applicable.
- 3
General-purpose AI models and governance
2 August 2025The rules on general-purpose AI models, EU governance and the penalty regime (except one specific article) apply.
- 4
Majority of provisions and SME measures
2 August 2026Most of the remaining provisions apply, including the transparency obligations (art. 50) and the SME support measures (art. 62).
- 5
Standalone high-risk systems (Annex III)
2 December 2027Obligations for standalone high-risk systems (recruitment, credit, education...) apply, after the delay decided in 2026.
- 6
Embedded high-risk systems (Annex I)
2 August 2028Obligations for high-risk systems embedded in products already regulated (machinery, medical devices...) apply.
Which obligations apply depending on the AI system's risk level
The regulation classifies AI systems into four categories, with obligations proportionate to the risk they pose to fundamental rights or safety.
| Risk level | Example | Main obligation | |
|---|---|---|---|
| Unacceptable risk | Social scoring, behavioural manipulation | Outright ban since 2 February 2025 | |
| High risk | Recruitment, credit scoring, medical devices | Risk management, documentation, human oversight | |
| Limited risk | Chatbot, AI-generated content, deepfake | Transparency obligation towards the user (art. 50) | |
| Minimal risk | Spam filter, AI-powered video game | No specific obligation under the regulation |
Most tools used today by a Belgian SME (writing assistant, machine translation, support chatbot) fall under limited or minimal risk. A provider or deployer implementing a high-risk system, however, must meet heavier obligations of risk management, technical documentation and human oversight.
AI literacy and the penalties set out in the regulation
Article 4 of the regulation has required, since 2 February 2025, providers and professional users of an AI system to ensure a sufficient level of AI literacy among their staff, meaning the ability to understand the possibilities, limits and risks of the tool used. This obligation is worded as binding, even though it does not appear in the list of breaches to which the regulation attaches a specific fine.
The penalty regime itself is precise, and has already been applicable since 2 August 2025 for most of its mechanisms.
prohibited practice
the higher of the two amounts, for a large company
other breaches
provider, deployer, transparency obligation
misleading information
given to an authority or a notified body
For an SME or a start-up, the regulation reverses the logic: the lower of the two caps (fixed amount or percentage of worldwide turnover) applies, not the higher one as for a large company.
Review your regulatory obligations
Monsiegesocial supports Belgian SME owners with company formation, business domiciliation and governance organisation in the face of new regulatory obligations.
Who enforces the AI Act in Belgium
The regulation requires each Member State to designate at least one notifying authority and one market surveillance authority, with published contact details (art. 70). As of the writing of this article, the European Commission's official AI Act portal does not list any Belgian authority formally designated for this purpose, and no text published in the Moniteur belge confirms such a designation.
In the absence of a confirmed designation, the FPS Economy plays a coordination and information role for businesses regarding the AI Act's obligations. This situation has no effect on the application of the obligations themselves: an SME remains bound to comply with them, regardless of how far the designation of the competent Belgian authority has progressed.
How a Belgian SME can prepare
Coming into compliance with the AI Act does not require, for the vast majority of SMEs, a heavy process. The points below cover the essentials of what is already required.
To check right now
List the AI tools used in the company
Writing assistants, customer data processing tools, any recruitment or scoring solutions.
Rule out any prohibited practice
Check that no tool falls under the practices prohibited since February 2025 (social scoring, behavioural manipulation, certain biometric uses).
Document an AI literacy approach
Train staff who use AI tools on their limits and risks, and keep a record of this process.
Identify any potential high-risk system
A recruitment or credit-scoring tool bought from a provider may fall under high risk; check its classification with the vendor.
Follow the SME support measures
Article 62 provides priority access to regulatory sandboxes and reduced compliance fees for SMEs and start-ups.
For the compliance of data processed by these tools, GDPR remains fully applicable alongside the AI Act: the two texts apply together as soon as an AI tool processes personal data.
Going further
- Artificial intelligence for SMEs in Belgium: use cases, ROI and compliance: how to adopt AI usefully, beyond the regulatory dimension alone
- GDPR obligations for SMEs in Belgium: the data protection framework that applies alongside the AI Act
- European Commission AI Act Service Desk: consolidated text and official resources on the regulation
