EU AI Act for SMEs: What You Must Document When AI Agents Do the Work

A 40-person building contractor automates appointment scheduling. An AI agent writes the confirmations, moves appointments around, answers follow-up questions. It has been running for eight months and saves roughly fourteen hours a week. Then the tax advisor asks a simple question: who decided this agent is allowed to answer that way, and where is it written down? Nobody knows. There is no record, no log, no sign-off. That is the exact moment the EU AI Act stops being a Brussels topic and becomes a practical problem for a mid-sized business.

Below you will find what has actually applied since August 2026, which deadlines the Digital Omnibus moved, and how to catch up in a single day on what most companies are missing.

---

Table of contents

1. What has actually applied since August 2026
2. Deployer or provider: your role decides everything
3. What you have to document
4. Getting it done in 30 days
5. Conclusion

---

What has actually applied since August 2026

The EU AI Act is Regulation (EU) 2024/1689 and it applies in stages. 2 August 2026 was the date for the transparency obligations under Article 50. Since then, people must be able to tell that they are talking to an AI system, and synthetic content must be markable as artificially generated. Enforcement has also begun, which means authorities can now come asking.

In parallel, the Digital Omnibus on AI has been published in the Official Journal of the European Union and is in force. It moves several deadlines, and for most companies that is the good news: high-risk obligations under Article 6(2) and Annex III no longer start in August 2026 but on 2 December 2027. Systems under Annex I follow on 2 August 2028. Anyone who already had a system on the market before 2 August 2026 that generates synthetic audio, image, video or text has until 2 December 2026 for the Article 50(2) transparency duties.

What that means for an ordinary mid-sized company: the heavy compliance block has moved back. The duty that hits you first as the operator of a customer chatbot or an internal assistant is transparency. And transparency was not postponed. It is live.

Then there is the mood inside companies. A study by TÜV-Verband and BSI published in October 2026 found that 84 percent of surveyed companies fear wrong decisions by AI agents, and four out of five worry about losing control. At the same time, a September 2026 survey showed that only about one in four mid-sized businesses uses AI agents at all. Scepticism is high, adoption is still low, and that gap is exactly where half-finished setups get built that raise questions later.

Anyone running an agent in production today usually does not have a compliance department. That is fine. What you need is a short, honest piece of documentation and the discipline to keep it current.

Deployer or provider: your role decides everything

The EU AI Act knows two roles that get confused constantly. A provider develops an AI system or places it on the market under its own name. A deployer uses an AI system professionally. If you self-host n8n, build an agent on top of a model from OpenAI, Anthropic or an open-source family, and run it for your own customers or processes, you are normally a deployer. If you build it and hand it to other companies as your product, you quickly become a provider with considerably more obligations.

That distinction is not a formality. It decides how much you have to document. As a deployer you mainly need human oversight, clear responsibilities and the ability to show what the agent did and when. As a provider you add technical documentation, conformity assessment and a risk management system. Agencies building on behalf of clients should settle this question before the first workshop, not after.

A second point gets overlooked: if your agent prepares decisions that matter to people, such as a credit application, a job application or an insurance claim, the system can drift into the high-risk category. For most SME projects that is not the case, because the work is appointments, quotes, support and internal research. But the boundary belongs in writing, otherwise you end up arguing about it with an auditor instead of with yourself.

In practice, one sentence in the project folder is not enough. You need a short system description, the intended purpose, and an explicit statement that no Annex III high-risk use case applies. That takes ten minutes and saves weeks.

What you have to document

The transparency duty in Article 50 is simple at its core. A person must know they are talking to a machine unless that is obvious. In practice: a chat window needs a visible notice, not a footnote. An AI phone assistant has to identify itself at the start of the interaction. An automatically sent email that was phrased by a model should say so if the recipient would otherwise take it for a personal message.

On top of that comes machine-readable marking of synthetic content. If your agent generates images, video or voice, those outputs must be detectable as artificially generated, and for existing systems the deadline is 2 December 2026. For plain text output in a business context the situation is more pragmatic, because the recipient knows the sender. A note in the footer of an automated newsletter is still not a mistake.

What is almost always missing in practice is traceability. Three things you should document, in a place you can find within five minutes:

• Purpose: One paragraph on what the agent should do and explicitly what it must not do. “Answers questions about delivery times, never issues credit notes” is a good sentence.
• Limits and approvals: What the agent may do alone, what requires human sign-off. If an action costs money or touches a contract, a human belongs in the middle. How to build that properly is covered in our article on permissions and least privilege for AI agents.
• Log: What the agent did, when, with which input and which result. A write log in your database is enough, as long as it is readable and does not rotate after seven days.

Practical tip: Store the documentation where your incident playbook lives. A reference nobody can find in an emergency is not documentation.

The second part is oversight. The EU AI Act requires human oversight that actually functions. Someone glancing at a dashboard once a quarter is not oversight. Someone approving critical actions and checking the result is. The difference is organisational rather than legal, and it decides whether your setup holds up in daily operations. Anyone who has watched an agent quietly stop working knows how much monitoring matters. Details in silent failures in production.

Getting it done in 30 days

You do not need a consulting army or new software. You need four calendar entries.

Week 1: inventory. List every agent and automation running in production that touches people or customer data. Per entry: purpose, model, data source, owner. Most companies find between two and nine entries, of which two nobody really remembers. Those two are the actual finding.

Week 2: roles and transparency. For each entry, write down whether you are deployer or provider. Then set the visible notices: chat window, phone greeting, email footer. For most systems this is a configuration change of a few minutes. Afterwards, check yourself that the notice really appears, in the live channel, not in the preview.

Checklist per agent
[ ] Purpose described in one paragraph
[ ] Non-purpose explicitly named
[ ] Role: deployer or provider
[ ] No high-risk use case under Annex III
[ ] Transparency notice visible in the live channel
[ ] Approvals defined for critical actions
[ ] Logging active, retention defined
[ ] Responsible person named
[ ] Emergency switch tested

Week 3: catch up on logging and approvals. If you have no log, build one now. In n8n a single node after each critical step that writes request, response, timestamp and result into a table is enough. If you need approvals, build them as a real stop, not as a hint inside an email. An agent that waits for approval and does not continue without it is an approval. An agent that continues and sends a notification in parallel is not.

Week 4: test and hand over. Simulate an outage by switching the agent off and measure how long it takes anyone to notice. Verify the kill switch works as described in kill switches for AI agents. Then hand the documentation to a second person. If that person can explain in ten minutes what the agent does and where its limits are, the documentation is fine. If they cannot, it is too complicated.

For law firms and other professions bound by confidentiality there is an extra layer, because German professional secrecy rules apply independently of the AI Act. If you build in that space, see our services for how we handle it.

One last point that appears in no regulation but shows up in every audit: if your website says you build AI automation for others, look at your own setup first. The fastest way to end a compliance conversation is to admit your own agent has been running without a log for months. How we solve that internally is described on our B.R.A.I.N. AI system page: agents with fixed roles, defined approval points and a protocol an auditor can actually read.

Conclusion

The most important news this week is uncomfortable and reassuring at the same time. Uncomfortable, because the transparency duties have applied since August 2026 and enforcement has begun. Reassuring, because the Digital Omnibus pushed the heavy part to December 2027 and August 2028. You have time for the big compliance work. You do not have time for the blind spot.

The effort for the first step is small. An inventory, one purpose paragraph per agent, a visible notice, a log and one named person. That is four hours of work and a recurring calendar entry. Do it now and the later conversation becomes noticeably easier, whether with clients, insurers or regulators.

If you are already at it: start with the agent that has the most customer contact. That is where the risk is highest and where the documentation pays off fastest.

About MadeByBrain: We build AI automation for mid-sized companies: custom AI agents, n8n workflows and GEO strategies, running in production. From the first idea to a live automation.

Book a free strategy call →