Why SME deployers need a clear EU AI Act map
An SME's EU AI Act duties depend on whether the Act applies to its system and whether it acts as a provider or deployer. Assess the specific use case and risk classification before treating an operational checklist as a legal requirement.
Include third-party tools in the role assessment. Record how the SME uses each system, the data it receives and the decisions that rely on its output before deciding which duties apply.
The safe answer is to classify the role, then evidence the use
For each AI use case, ask the reviewer to establish whether the SME is a provider, deployer, importer, distributor or product manufacturer. Assess the role and applicable duties for that use instead of inferring them from the business sector.
Use a short AI use-case register to record what the system does, its owner, supplier, data categories, outputs relied on and assessed risk category. Record the review steps chosen for decisions affecting customers, employees or clients and who is responsible for them.
Map your AI risk and efficiency gaps
Support mechanisms help, but they do not erase duties
Check whether official guidance, templates, sandbox access or other support is available for the proposed use. Review the terms and relevance of any support before relying on it in the firm's assessment.
For recruitment, credit, insurance, legal operations or compliance monitoring, assess each system and intended use separately. Record the applicable requirements and planned controls; participation in a support scheme is not a substitute for that assessment.
What an SME deployer should keep on file
For each material AI use case, consider the following operating records, then check any specific legal requirements separately:
- the business purpose and process owner;
- the supplier, model or product name, and contract version;
- the data used, including any personal or confidential data;
- the risk classification and rationale;
- the human oversight step and escalation route;
- testing notes, known limitations and monitoring cadence;
- staff instructions covering safe use, prohibited inputs and output checks.
Keep the records current and accessible to the people responsible for the use. This list is a starting point for review, not proof of compliance or a complete statement of the evidence a buyer or regulator may require.
Put lightweight AI governance on a retainer
How to make this proportionate for a smaller business
Prioritise uses with material customer, employee, financial or confidentiality consequences. Assess those first, then reuse relevant evidence for similar uses while checking the requirements of each task.
Ask a non-technical director to review four questions: what are we using, where is it used, what could go wrong, and who checks the output before it matters? Use gaps in the answers to identify work for the assessment owner.
Conclusion
Keep the role, scope and classification assessment alongside supplier evidence, oversight records and staff instructions. Revisit both the assessment and the operating record when tools or workflows change, and leave unresolved questions with the approval owner.
Turn the AI governance register into working implementation
Need a safer AI route for your firm?
For the proposed use, prepare the purpose, owner, supplier, data and review record. List unresolved legal and supplier questions separately so the approval owner can decide what still needs assessment.