EU AI Act for SMEs deploying AI agents

Small businesses get proportionality under the EU AI Act, not exemption. An SME deploying AI agents still has to train staff, tell people when they deal with AI, and avoid prohibited practices. If an agent is high-risk, the deployer duties apply in full. The relief sits in penalties, documentation, sandbox access and support.

What does the Act ask of an SME?

The duties attach to roles and risk tiers, not to company size. An SME that deploys agents has the same baseline as a large firm:

• AI literacy for staff who use, configure or oversee agents (Article 4).
• Disclosure to people who interact with an agent, and marking of certain generated content (Article 50).
• No prohibited practices, such as manipulation or exploiting vulnerability.

If any agent is high-risk, the deployer duties in Article 26 follow: use as instructed, competent oversight, relevant input data, monitoring, log retention, and notices to workers and affected people. Whether your agents are in that tier is the first question; our answer to whether the EU AI Act applies to AI agents starts there.

What relief does the Act give smaller firms?

In substance, the Act provides:

• Lower penalty ceilings. For SMEs, including start-ups, fines are capped at the lower of the two amounts the Act sets for each tier, where larger firms face the higher.
• Simplified documentation for providers. Small and micro enterprises that are providers of high-risk systems can supply technical documentation in a simplified form.
• Priority access to regulatory sandboxes, free of charge, to test systems under supervision.
• Guidance and support channels from member states aimed at smaller firms, and consideration of SME interests when fees and standards are set.
• Proportionate quality management for microenterprise providers in some respects.

Most of this helps providers. For an SME that deploys someone else's agents, the main relief is the penalty cap and the guidance. The duties themselves do not shrink.

How should an SME read the Act when its systems are agents?

Small firms are more likely to run agents with broad access. A five-person lender might give one agent read access to everything, and the ability to send emails and update records, because it saves time. That is where the risk sits, and where a proportionate reading has to start.

We suggest four questions, in order:

1. Does any agent take part in a listed high-risk use? For financial SMEs, assessing an individual's creditworthiness or pricing life or health insurance are the likely ones. If yes, the deployer duties apply to that capability.
2. Can any agent move money or take actions that are hard to undo? The Act may not care, but your customers and your regulator will. Put a person in front of those actions.
3. Does any agent talk to customers? Then disclosure applies, and manipulation and exploitation rules matter.
4. Who in the firm understands each agent well enough to stop it? That person is your literacy evidence and your oversight in one.

If you build or rebrand agents yourself, you may become a provider, with heavier duties; see what a provider is under the EU AI Act. If you are based outside the EU but serve EU customers, read EU AI Act for non-EU companies deploying AI agents.

What cannot be skipped, and what evidence is enough?

An SME does not need a governance committee. It needs a named owner per agent, a register that is kept current, and records it can produce. Our template for an AI agent register for the EU AI Act fits on a page.

For an SME that later grows into a regulated institution, compare the heavier picture in EU AI Act for banks deploying AI agents.

What will a supervisor or auditor ask?

• What agents do you use, and what can each do?
• Is any of them high-risk? How did you decide?
• Who is responsible for each one?
• How are customers told they are dealing with AI?
• If an agent made a mistake with a customer, could you show what it did?

What does proportionality not cover?

It does not lower the duties for high-risk agents. It does not exempt SMEs from GDPR, consumer law or sector regulation, which often apply more directly to small financial firms than the AI Act does. It does not make the vendor responsible for the deployer's duties. And it does not help with risks the Act ignores, such as an agent with broad access sending the wrong payment. For a full map of duties and controls, see AI agent regulation, mapped to controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

Small teams often grant agents broad access because narrowing it takes effort. In Pryme, authority is granted per agent and earned through certification on the firm's own cases, so an agent starts at reading and drafting. Actions above its earned depth are held for a named person, which gives an SME oversight and a record without building either.