The EU AI Act for Spanish SMEs in 2026: a checklist
A practical overview of what Spanish SMEs should understand about the EU AI Act, AI literacy, risk categories, and responsible adoption.
Javier Chulvi BernadLLM EngineerMadridMost of the EU AI Act applies from 2 August 2026, although some product-linked high-risk obligations follow a later timetable. Spanish SMEs using AI in HR, customer support, operations, marketing, compliance, or internal knowledge management should understand the obligations that apply to their role and use cases.
The practical message is simple: adopt AI, but do it with governance.
What SMEs should look at first
Most SMEs will not build foundation models. They will deploy AI tools made by others. That still creates responsibilities, especially around transparency, staff literacy, data protection, and human oversight.
The first questions are:
- What AI tools are employees already using?
- Are they used with personal data or confidential business data?
- Are customers or employees interacting with AI without knowing?
- Are any use cases related to employment, credit, education, healthcare, or other sensitive areas?
- Has the company trained staff on basic AI use and limitations?
AI literacy matters
Article 4 of the EU AI Act makes AI literacy a concrete operational issue. Companies should make sure people using AI understand its risks, limits, and appropriate use.
For most SMEs, that does not mean a heavy academic program. It means practical training: what data not to paste into generic tools, how to verify outputs, when to keep a human in the loop, and how to use approved systems.
Internal knowledge tools are a good starting point
An internal AI assistant connected to company documents is usually easier to govern than unmanaged use of many generic tools. Admins can define sources, permissions, and expected behavior.
That does not remove every obligation, but it creates a more controlled environment.
What to document
SMEs should keep simple records of:
- Approved AI tools.
- Use cases.
- Data categories involved.
- User guidance.
- Training completion.
- Review and escalation processes.
Good documentation reduces confusion and makes future compliance work easier.
The practical conclusion
The EU AI Act should not stop SMEs from using AI. It should push them toward safer adoption: approved tools, trained users, clear permissions, and verifiable outputs.
To turn that checklist into working documents, start with the AI acceptable-use policy template or use the broader AI governance toolkit for SMEs.
Polp helps companies move in that direction by keeping AI close to approved knowledge sources and access controls.
Sources: