2 August 2026. The deadline most European SMBs are not ready for.
The EU AI Act enters its main enforcement phase on 2 August 2026. Risk classification, transparency obligations, technical documentation, human oversight, AI literacy for everyone using AI at work. Fines up to seven percent of global turnover. If your team uses Copilot, ChatGPT, Claude, or any other AI in a real workflow, this applies to you. 3DH delivers a 4-week sprint that closes the gap before the clock runs out.
Five obligations every SMB using AI needs to close
AI literacy (Article 4)
Everyone in your organisation using AI tools needs documented training appropriate to their role. Not a one-line policy. Evidence.
Risk classification
Each AI use case is either prohibited, high-risk, limited-risk, or minimal-risk. Wrong classification creates exposure. Most SMBs have not done this yet.
Transparency obligations
When AI generates content shown to customers, employees, or counterparties, certain disclosures are mandatory. The format and triggers depend on use case.
Technical documentation
For any high-risk AI system, you need a documentation pack covering training data, intended purpose, risk management, human oversight design, and accuracy / robustness measures.
Human oversight
Some AI workflows now require designed-in human review before action. The design needs to be documented, not improvised.
From unknown exposure to documented compliance
- Week 1
AI inventory and risk classification
We map every AI use case in your business. Copilot in Outlook, ChatGPT used by anyone, custom GPTs, Make / Zapier flows touching AI, shadow agents in Copilot Studio. Each one gets classified against the AI Act risk tiers. Output: a written register your legal counsel can sign.
- Week 2
AI literacy programme and transparency baseline
Role-based AI literacy training designed for your specific tool stack. Documented attendance, documented content, documented refresh cadence. Transparency disclosures drafted and approved for the use cases that need them, in the languages your customers actually use.
- Week 3
Technical documentation pack
For each high-risk system in your inventory: intended purpose statement, data documentation, risk management plan, oversight design, accuracy measurements, post-deployment monitoring plan. Format is the EU template, not invented ad hoc.
- Week 4
Handover and monitoring retainer
We hand the full compliance pack to you and your counsel. Walk through every artifact. Set up the monthly retainer that watches for enforcement signals, updates the documentation when your tooling changes, and refreshes AI literacy each year.
€8,500 to €15,000 fixed. €1,200 monthly for ongoing monitoring.
Pricing depends on the scope of your AI inventory. A 10-person SMB with Copilot and one ChatGPT use case starts at €8,500. A 50-person company with high-risk classifications, multiple tools, and counterparty-facing AI sits at €15,000. We scope in the first 30 minutes of conversation, not after a paid discovery.
Portuguese SMEs may qualify for PRR funding covering up to 75 percent of digital transition spend. We help you check eligibility at no cost during the initial call.
You have less than three months. Start now.
We take a limited number of compliance engagements per month to keep delivery quality high. If your business uses any AI in production and you have not yet classified the risk, we should talk this week.
Book a 20-minute call