EU AI Act from 02 August 2026.

What is the EU AI Act and why does it affect SMBs?

The EU AI Act (officially: EU Regulation 2024/1689 on Artificial Intelligence) has been in force since 02 August 2024 but becomes enforceable in stages. It regulates the deployment of AI systems in the EU with a risk-based approach: high-risk systems (e.g. AI in medical diagnosis, personnel selection, credit scoring) require comprehensive conformity assessments. Lower risk (AI in customer interactions, chatbots, voicebots, marketing automation) requires 'merely' transparency obligations, but these are strict from 02 August 2026. What many SMB owners don't know: even if you don't develop the AI yourself but only deploy it (the regulation calls this 'deployer'), you are responsible for the obligations in your business. Anyone using an AI phone assistant, chatbot or marketing AI must inform their end users and document for their employees. The regulation applies EU-wide, also to providers from third countries (USA, UK, Switzerland) when they make AI systems available in the EU. So anyone using a US tool or any other third-party provider must check whether the provider supports the obligations at all.

The 4 most important obligations for DACH SMBs in 2026

First, Art. 4 (AI literacy), already in force since 02 February 2025. Anyone deploying AI in their business must produce minimum documentation of deployment limits and escalation logic. In practice: a PDF describing how your AI is deployed, what it cannot do, when it escalates to humans. Second, Art. 50 (transparency obligation), enforceable from 02 August 2026. Every person interacting with your AI system (caller, chat visitor, email recipient) must be clearly informed at first contact. For voice agents: greeting announcement must disclose AI nature. For chat widgets: persistent AI badge. For emails: header disclaimer. Third, GDPR Art. 28 (data processing), already mandatory since 2018. When deploying third-party AI, a data processing agreement (DPA) must be in place that regulates data processing. Fourth, GDPR Art. 22 (automated decisions), for legally relevant AI decisions, human escalation must be possible. In practice for customer service AI: on complaints, returns, cancellations, the AI agent must be able to escalate to a human.

• Art. 4 AI literacy: documentation of deployment limits + escalation logic (since 02.02.2025)
• Art. 50 transparency obligation: disclosure at first AI contact (from 02.08.2026)
• GDPR Art. 28: data processing agreement with every AI provider
• GDPR Art. 22: human escalation for legally relevant decisions

EU AI Act fines, what's really at stake

The EU AI Act provides graduated fines. Violations of the strictest obligations (prohibited AI practices per Art. 5, social scoring, manipulation, biometric mass surveillance) can be sanctioned with up to €35M or 7 percent of global annual turnover, whichever is higher. Violations of obligations for high-risk AI systems: up to €15M or 3 percent. Violations of transparency obligations (Art. 50) and most other obligations: up to €15M or 3 percent. False or misleading information to authorities: up to €7.5M or 1 percent. For SMBs with annual turnover under €500M, the monetary values become binding (not the percentage), but €15M is practically existential for a DACH SMB. Plus: on repeated violations, the competent market surveillance authority (in Germany: Bundesnetzagentur) can prohibit the AI system or remove it from the market. The fines are only the financial tip of the iceberg, the reputational and business interruption damage on a violation is often higher.

EU AI Act vs. GDPR, where the obligations overlap and where not

Many SMBs confuse EU AI Act and GDPR. In fact, the two regulations are complementary: GDPR regulates the processing of personal data (all data attributable to a natural person), EU AI Act regulates the deployment of AI systems regardless of whether personal data is processed. In customer service AI context, both apply simultaneously: GDPR regulates handling of caller data (Hetzner hosting, EU LLMs, DPA, privacy notices per Art. 13 GDPR). EU AI Act additionally regulates transparency obligation (Art. 50, the caller must know they are speaking with an AI) and AI literacy (Art. 4, the employee deploying the AI must know the deployment limits). In practice for DACH SMBs: a GDPR-compliant AI provider is not automatically AI Act-compliant. You need both, GDPR + Art. 50 + Art. 4. Rinqo fulfills all three obligations in one platform: Hetzner Germany (GDPR), default disclosure announcement (Art. 50), AI literacy templates to adapt (Art. 4). With US providers, you must check GDPR compliance separately (Cloud Act exposure, DPF volatility remains) and implement Art. 50 disclosure yourself (which is often technically not possible at all).

How Rinqo fulfills the EU AI Act, concrete and verifiable

Rinqo fulfills all EU AI Act obligations for DACH SMBs from day 1, without the customer having to do any compliance work. First, Art. 50 default disclosure: every Rinqo AI agent (phone, chat, email) makes a clear announcement on first contact that this is an AI, wording is editable to your brand voice, disclosure itself not deactivatable. For voice: 'Hello, this is the AI assistant from [company]. You are speaking with an AI, the call is processed for quality assurance.' For chat: persistent AI badge in header + entry banner. For email: 'This response was created with AI support' disclaimer in footer. Second, Art. 4 AI literacy: templates in the Rinqo dashboard you can adapt to your specific deployment configuration, which AI models are deployed, which data is processed, which escalation thresholds apply. You document once, keep the documentation current on configuration changes. Third, GDPR Art. 28: DPA contract is automatically provided at contract closure, without separate request. Fourth, GDPR Art. 13: privacy notices are automatically announced at the start of voice agent calls. Fifth, EU hosting: Hetzner Falkenstein and Nuremberg as hosting location, EU LLMs on dedicated Microsoft Azure OpenAI (Microsoft Ireland Operations Ltd., Sweden Central, EU Data Boundary — Microsoft Corp. is the US parent. are transparently disclosed on /security), EU data residency for your customer data.