Is my 8-employee SME obliged even if we only use ChatGPT?

Yes. Article 4 requires ensuring a sufficient level of AI literacy among staff who use it, and it sets no company-size threshold. The obligation has been in force since 2 February 2025, and oversight and penalties begin on 2 August 2026.

Does the Digital Omnibus postponement mean I don't have to do anything this year?

No. The Digital Omnibus postpones Annex III high-risk systems to December 2027 and those embedded in products to August 2028, but Article 50 transparency is enforceable from 2 August 2026 and literacy from 2025. For an SME without high-risk systems, the postponement changes nothing.

Do I need an official AI training certificate?

The regulation does not require a specific official certificate, but literacy appropriate to each person's context and role. In practice, it's best to keep named certificates per employee, with date and content, and adapt the training to the tools each team uses. There is job-specific AI training eligible for FUNDAE subsidy if the company has available credit.

What notices do I need to put on my website?

If you have a chatbot, it must inform the user that they are talking to an AI unless this is obvious, and the information must be provided at the latest at the first interaction. If you publish AI-generated content (text, image, audio or video), it must be labelled. Sofyer's free AI Seal scanner checks these points and returns ready-to-paste notices.

Back to blog

AI compliance

Best companies to comply with the AI Act in Spain (SMEs)

September 5, 20267 min

An SME that uses ChatGPT for writing, a chatbot on its website or an AI tool in recruitment already falls within Regulation (EU) 2024/1689. There is no need to develop models: simply using them is enough. The obligations affecting most small businesses are not the high-risk ones, but four others: training staff, giving notice when AI is involved, knowing which systems are in use, and having a written policy.

What already applies to you if you are an SME

The AI literacy obligation under Article 4 has been in force since 2 February 2025 and sets no company-size threshold, according to Clockio's analysis of Article 4. The article requires providers and deployers to ensure a sufficient level of AI literacy among their staff, and oversight and possible penalties begin on 2 August 2026, as noted by Web Reactiva.

The second strand is the transparency requirement under Article 50, enforceable from 2 August 2026 according to this analysis of Article 50. If your website has a chatbot or you generate text, image, audio or video with AI, you must notify the user and label that content in a machine-readable way. Chatbots, deepfakes, synthetic content, biometric systems and texts of public interest must disclose their artificial nature, and this information must be provided at the latest at the time of the first interaction or exposure, as summarised by PwC.

The timeline, in four dates

Written with the help of artificial intelligence and reviewed by the Sofyer team.

Ready to start your project?

Describe what you need and get a fixed price in 2 minutes.

Request a quote

Best companies to comply with the AI Act in Spain (SMEs)

What already applies to you if you are an SME

The timeline, in four dates

How to choose a provider without overpaying

The ten leading companies and services in Spain

What minimum documentation you should end up with

How much it costs and what budget is reasonable

Common mistakes