The EU AI Act for Hungarian SMBs — what applies to you, and what doesn’t

Does it apply to me at all?

Almost certainly yes — but not in the way you think. The regulation distinguishes two roles: a provider develops an AI system and places it on the market under its own name or trademark; a deployer uses a finished system in its own activity. The great majority of obligations fall on the provider, and Hungarian SMBs are almost without exception deployers. The role does not depend on company size but on what you do with the system — and one company can be a deployer of one tool and a provider of another.

What if I only use an AI tool?

Then you are a deployer, and your list is short. For a tool that is neither prohibited nor high-risk you have essentially two duties: transparency wherever the system meets a human, and AI literacy among your staff. Technical documentation, conformity assessment, CE marking and registration are the provider’s job, not yours.

One thing to watch: a deployer becomes a provider if you put your own name on the system, make a substantial modification to it, or change its intended purpose so that it becomes high-risk. Those three cases are the dividing line.

What is the AI literacy obligation, and does it really apply to everyone?

Yes — it applies to every provider and deployer regardless of size, and it has been in force since 2 February 2025. You have to take measures that support the development of AI literacy among your staff: they should understand what the tool does, what it is not good for, and when a human has to decide. An EU amendment that took effect in summer 2026 softened the wording — you do not have to guarantee any specific level of knowledge for any individual, but you do have to take measures.

There is no prescribed course, no central exam and no official certificate. The test is whether what you do is proportionate to how you actually use AI — and whether it is documented. The regulation sets no EU-wide maximum fine for this particular obligation; penalties are left to each Member State. That does not mean it carries no consequence — it means there is no EU ceiling on it.

What is actually banned?

Eight practices are prohibited; six of them have been since 2 February 2025. Two of them can genuinely come up in ordinary business: emotion recognition in the workplace and in education (except for medical or safety purposes), and biometric categorisation of people to infer sensitive attributes — ethnicity, political opinions, religion, trade union membership, sexual orientation. The rest (social scoring, subliminal manipulation, exploiting vulnerabilities, untargeted scraping of facial images, real-time facial recognition in public spaces) are typically far from an SMB’s daily operations. And a company does not walk into those two deliberately — it inherits them as a feature of a tool it bought. Worth asking the vendor.

Two further prohibitions start on 2 December 2026, covering systems that generate non-consensual intimate imagery and child sexual abuse material.

When does a system count as high-risk?

When it is used in one of the sensitive areas listed in Annex III of the regulation. An SMB typically meets three of them: recruitment and selection (targeting job ads, filtering applications, evaluating candidates), decisions about the employment relationship and the monitoring of workers’ performance and behaviour, and assessing the creditworthiness of natural persons.

There is a carve-out, and it matters: a system is not high-risk if it only performs a narrow procedural task, improves the result of a previously completed human activity, detects patterns without replacing human assessment, or performs a preparatory task. But that carve-out never applies where the system profiles natural persons — and “we only use it to pre-screen CVs” is typically exactly that. This is where most reassuring self-classifications fall down. Exactly how far the carve-out reaches is what the Commission’s guidelines would settle — but the Commission missed its own February 2026 deadline for them, and they remain in draft.

These rules apply from 2 December 2027. Note, though, that only Sections 1 to 3 of Chapter III were deferred; the parts on standards, conformity assessment and registration, and market surveillance, have applied since 2 August 2026. And a system already in operation stays outside only for as long as it undergoes no significant change in design.

Two 2026 amendments went in favour of smaller companies. SMEs may supply the technical documentation in a simplified form, and notified bodies have to accept it. The definition of “safety component” also narrowed: mere user assistance, performance optimisation, automation or convenience no longer counts as one.

What do I have to disclose to customers?

This is the part that is already live and enforceable, since 2 August 2026. If a system interacts directly with a person — a chatbot, a voice assistant — that person must be told they are dealing with a machine, unless it is obvious from the circumstances to a reasonably well-informed person. There is no grace period for this: it applies today.

If you publish artificially generated or manipulated content depicting real people, places or events (a deepfake), it has to be labelled — in a lighter form for artistic, satirical or fictional works. AI-generated text published on matters of public interest also has to be labelled, unless a human took editorial responsibility for it. Neither of these has a grace period either.

The technical, machine-readable marking is the provider’s obligation — and that is the only part that was given extra time: generative systems placed on the market before 2 August 2026 have until 2 December 2026 to comply. Your job is the visible, understandable disclosure, at the latest at the time of first interaction.

What are the deadlines?

The regulation applies in stages, and the high-risk part was pushed back in summer 2026. What matters today:

The Annex III high-risk rules were originally due to apply on 2 August 2026, and the rules for high-risk systems built into products on 2 August 2027. An EU amendment that entered into force on 27 July 2026 moved both.

One Hungarian detail about the 2 August 2025 row: what started then was the Member States’ duty to establish a penalty regime. In Hungary the authorities and the forint-denominated fine ceilings were created by the implementing decree, in force from 1 December 2025 — in August 2025 no fine could yet be imposed here.

What are the penalties?

The ceilings are genuinely high: EUR 35 million or 7% of total worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most other breaches, including transparency. AI literacy is the exception: the regulation sets no EU ceiling for it. For SMEs and start-ups, however, the cap is the lower of the two figures, not the higher — the regulation says so itself.

In Hungary fines are imposed in forint, and the authority weighs the nature, gravity and duration of the infringement and the size of the company. The ceilings in the regulation were written for the most serious, deliberate cases — not for an SMB’s first mistake.

Supervision in Hungary is carried out by the Artificial Intelligence Authority (Mesterséges Intelligencia Hivatal), which acts only of its own motion: a report does not by itself open a procedure.

What should I do now?

Four steps. The first three can be started within a week, and the fourth is already mandatory:

1. 01List where you use AI today. From formally adopted systems down to whatever someone in marketing or HR started on their own.
2. 02For each item, decide whether you are a provider or a deployer. For most you will be a deployer — and half the list comes off the agenda.
3. 03Mark anything that touches people: recruitment, performance evaluation, worker monitoring, credit decisions. That is your December 2027 agenda.
4. 04Wherever a system talks to a customer or a colleague, make it clear it is AI. This one is already mandatory.

The Hungarian authority publishes Hungarian-language guidance on the transparency obligations that are live now — including a list of questions worth putting to your AI vendor and recording in the contract.

All four steps depend on the same thing: you cannot govern what you have not listed. Most companies have no such list — shadow AI is shadow precisely because it appears nowhere.

Guidance from the Hungarian authority →