Know exactly what
the AI Act asks of you,
and what it does not.
Most AI Act guidance is written for lawyers, or it is generic filler that overstates your duties to sell you something. This pack is 17 editable Word documents and an Excel register workbook, built for organisations that use AI tools built by others. Every item tells you whether it is law, good practice, or something you need to check.
Instant download
What applies now, and what does not
Plenty of products imply every AI Act duty landed in August 2026. That is not accurate. Here is the actual position, which is also why preparing now is sensible rather than panicked.
The real problem is not the deadline.
It is knowing which duties are actually yours.
Deployers have a narrower set of duties than providers. Most SME confusion comes from guidance that blurs the two, or from vendors who imply you carry obligations that are in fact theirs.
Provider duties keep getting sold to you
The chatbot disclosure duty in Article 50(1) is the provider's design duty. Your job is to check the disclosure is switched on, not to build it. Knowing the difference saves real money.
Scope is misunderstood in both directions
Selling to EU customers is not, on its own, the test. The question is whether the output of the AI system is used in the EU. Some businesses assume they are out when they are in, and the reverse.
Screening a tool is not classifying it
Risk tier depends on intended purpose, your role and the specific facts. A screening aid tells you what to do next. It is not a legal classification, and any product claiming otherwise is overselling.
The high-risk work takes time to start
Deployer duties for Annex III systems apply from December 2027, but the vendor information you need takes months to obtain. Starting the paperwork now is the point, not panic.
What is in the pack
Seventeen editable Word documents plus an Excel workbook of working registers. Every document carries its legal basis, who it applies to, whether it is law or good practice, and the date the law was last verified.
Start Here
Who the pack is for, what is inside, how to read the LAW, GOOD PRACTICE and CHECK labels, and the order to work through it.
Master Readiness Checklist for SME Deployers
47 items across seven sections. Every item cites its article or is marked as good practice, so you always know what is legally required and what is merely sensible.
AI Tool Inventory and Screening Register
Four screening questions, four outcomes, and a full Annex III reference table showing what is covered and what is not. States plainly that screening is not legal classification.
Company AI Usage Policy
Eleven sections covering scope, approved tools, prohibited uses, transparency and incident reporting. Marks clearly which rules go further than the Act requires.
Staff AI Literacy Briefing Notes
A 15 to 20 minute briefing covering what the Act is, how it sorts AI uses, and six day-to-day staff responsibilities. Written to be read, not endured.
Staff AI Literacy Training Register
Initial and refresher training records. Notes that you set your own frequency, because the Act does not prescribe a schedule.
AI Transparency Notice Templates
Six versions: chatbot, deepfake, public-interest text, emotion recognition, voluntary business disclosure, and high-risk decision notice. Each states whether it is legally required or optional.
Website AI Use Statement
Publishable page copy, with a clear note that a website statement never replaces a disclosure the law requires at the point of interaction.
High-Risk AI Use Case Assessment Form
Six parts including a classification check, a deployer duties checklist mapped to each article, and a provider information tracker. Duties apply from December 2027; the form starts you now.
Human Oversight Procedure
Five oversight principles including guarding against over-reliance, an oversight register, and a six-step escalation route for when something goes wrong.
AI Incident Log
Includes the Article 3(49) definition of a serious incident and the correct reporting order: provider first, then importer or distributor, then market surveillance authorities.
Vendor AI Information Request Letter
A five-point written request grounded in the provider's Article 13 duty. Acknowledges that some documents will not exist until 2027 and asks for a date.
AI Contract Clauses: Negotiation Language
Five clauses plus an indemnity in an appendix. States up front that none of these is a statutory requirement and that vendors may reject them.
Prohibited AI Practices Declaration
All nine prohibited practices listed with their specific article reference, including the two new prohibitions that apply from December 2026.
Management AI Governance Review and Sign-Off
An eight-point management review with an open actions table. Says plainly that it records a review, and is not a statement of legal compliance.
Annual AI Governance Review Schedule
A twelve-task annual review plus the full key dates table, so the calendar lives inside the process rather than in someone's memory.
EU AI Act: A Plain-English Guide for SME Owners
Scope, provider versus deployer, how the Act sorts AI uses, what applies now, what is coming, the fines table, and five things to do first.
30 Questions SME Owners Ask
Direct answers on scope, CV screening, insurance pricing, translation, social content, vendor pushback, and what the Digital Omnibus actually changed.
What non-compliance actually costs
Published accurately, including the part most sales pages leave out.
| Infringement | Maximum | Basis |
|---|---|---|
| Prohibited practices | €35M or 7% of worldwide turnover | Art. 99(3) |
| Most other operator obligations, including deployer duties and transparency | €15M or 3% of worldwide turnover | Art. 99(4) |
| Supplying incorrect or misleading information to authorities | €7.5M or 1% of worldwide turnover | Art. 99(5) |
Who this is for
Organisations that use AI systems built by others. In the language of the Act, deployers.
SMEs using third-party AI
ChatGPT, Copilot, AI features in a CRM or HR platform, a website chatbot. There is no general size exemption.
Professional services
Accountants, recruiters and consultants. Recruitment uses are among the most common Annex III exposures.
HR and operations leads
Anyone who has been handed AI Act readiness alongside their day job and needs a defensible paper trail.
E-commerce and SaaS
Chatbots, recommendation engines and AI-assisted content, where transparency duties may already apply.
Non-EU businesses
Including UK companies, where the output of an AI system you use is used in the EU. The pack explains the actual test.
Anyone facing a due diligence ask
Insurers, enterprise customers and investors are starting to ask. Documented governance is the answer.
Who this is not for
This pack is built for deployers. It is not designed for providers, meaning organisations that develop AI systems and place them on the market under their own name. If you have built your own AI tool on top of a model or API, you may be its provider for some purposes, and you will need more than this pack. Document 01 helps you check which you are. It also does not cover general-purpose AI model obligations, or sector-specific rules in healthcare, financial services or law enforcement.
How the checklist is built
Every item carries its basis, so you are never guessing whether something is a legal duty or a suggestion. This is a genuine extract from Section 2.
Section 2: AI inventory and screening
Seven items. Each is labelled LAW with its article, or GOOD PRACTICE, or CHECK where it depends on your facts.
47 items across 7 sections in the full checklist
Get the pack
One payment. Instant download. Licensed for internal use by your organisation.
EU AI Act Readiness Pack for SMEs
- 17 editable Word documents
- Excel workbook with 6 working register sheets
- 47-item master readiness checklist, every item sourced
- AI inventory and screening register with full Annex III table
- Company AI usage policy and staff briefing notes
- Six transparency notice templates, law and voluntary marked separately
- High-risk assessment form and human oversight procedure
- Vendor information request letter and five contract clauses
- Prohibited practices declaration, all nine practices cited
- Management sign-off and annual review schedule
- Plain-English guide and 30-question reference
- Law verified 11 September 2026
Secure checkout via Stripe · Instant access after payment
Digital download. All sales final.
Common questions
Answered the way the pack answers them, which is to say accurately rather than alarmingly.
If you are established or located in the EU, yes, whatever your size. If you are outside the EU, it applies where the output of an AI system you use is used in the EU. Selling to EU customers is not, on its own, the test. There is no general size exemption, though SMEs do benefit from some measures, including the lower fine ceilings under Article 99(6).
Yes, through the AI literacy duty in Article 4, which applies whatever tools you use. Transparency duties under Article 50 apply only in specific situations, such as publishing AI-generated text on matters of public interest without human editorial review, or publishing deepfakes. Using these tools to draft internal documents or ordinary emails does not, by itself, trigger Article 50. Any product telling you every AI-assisted email needs a label is overstating the law.
It may. The Act reaches deployers outside the EU where the output of the AI system is used in the EU. Having EU customers does not automatically put you in scope; it depends on how and where the AI output is used. The pack explains the test, but for a definitive answer on your facts you should take advice.
Disclosure is almost certainly needed, because the exemption only applies where it is obvious to a reasonably well-informed, observant and circumspect person that they are dealing with AI, and a human-sounding persona makes that less obvious. But note where the duty sits: Article 50(1) is the provider's design duty. If a vendor supplied the chatbot, your job is to check the disclosure is switched on and has not been removed. If you built it yourself on a model or API, the duty may be yours.
Very likely high-risk. Analysing and filtering applications and evaluating candidates are listed in Annex III, point 4. The narrow exception in Article 6(3) rarely fits ranking or filtering, and never applies where the system profiles people. The deployer duties apply from 2 December 2027, not now. That is not a reason to wait, because the vendor information you need takes months to obtain, which is exactly what Documents 08, 09 and 11 are for.
Yes. The law was verified on 11 September 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, which entered into force on 27 July 2026. That amendment softened the Article 4 literacy duty, moved high-risk obligations to December 2027 and August 2028, gave providers of existing generative systems until December 2026 for machine-readable marking, added two new prohibitions, and extended certain SME measures to small mid-caps. Every document carries the verification date.
No. Provider compliance does not cover your own duties as a deployer, which include AI literacy, transparency where it applies, and for high-risk systems, oversight, logging and informing affected people. Document 11 gives you a written request grounded in the provider's Article 13 duty to supply instructions for use.
No, and the pack says so on every page. It is a general educational and operational resource. It is not legal advice, a legal opinion, a compliance certification, or a guarantee that any organisation complies with the Act. The Act applies differently depending on your role, system, use case, sector and location. For high-risk, regulated or uncertain situations, take advice from a suitably qualified lawyer or regulatory specialist.
Seventeen editable Word documents plus one Excel workbook containing six working register sheets for inventory, training, incidents, oversight, vendors and the annual review. The Word versions of those registers are included as well, for printing and signing. A complete PDF of the whole set is included for reading and reference.
Because this is a digital product delivered instantly and in full, all sales are final and no refunds are offered. The complete contents are listed on this page so you know exactly what you are buying. If you are unsure whether the pack fits your situation, particularly if you think you might be a provider rather than a deployer, email us before ordering and we will tell you honestly if it is not right for you.
Readiness you can evidence,
without overstating what the law asks.
Seventeen documents, an Excel register workbook, and a checklist that tells you the difference between a duty and a suggestion.
Get the Pack, €249Instant download · Licensed for internal use by the purchasing organisation
Digital product. All sales final.