EU AI Act 2026 for business service providers

On 7 May 2026, a provisional political agreement was announced between the Council presidency and European Parliament negotiators on the Digital Omnibus on AI. The main outcome for business service providers: under this agreement, the application of the high-risk rules moves to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product-embedded systems. The agreement still needs to be formally adopted, but the direction is clear: the clock has been turned back, not switched off.

What stays the same: the Act’s risk-based architecture, the obligations for high-risk systems, and the fine structure. What changes: you have eighteen months more than you thought to establish your governance, documentation, and human oversight. And a new obligation: AI watermarks for synthetic content must be implemented by 2 August 2026 (a shorter transition period than previously proposed).

For business service providers already using AI in client work, internal knowledge processes, recruitment, document analysis, or preparing advice, this is no time to sit still. The extra time means relief from the crunch, not a reason to postpone. This article sets out what is useful to do in the meantime.

For business service providers, this is no minor detail. AI quickly affects client files, personnel decisions, advice preparation, document analysis, and internal knowledge sharing. Not every system is high-risk, but some applications do require clear classification, documentation, human oversight, and explainability. The fines under Article 99 are tiered: up to 35 million euros or 7 percent of global annual turnover for prohibited AI practices (Article 5), up to 15 million euros or 3 percent for most high-risk violations, and up to 7.5 million euros or 1 percent for incomplete or misleading information supplied to regulators. For SMEs, the lower amount applies, not the higher one, an important nuance often lost in press coverage.

In large organisations, compliance teams have already been working on this for a year. For business service providers in the Netherlands with twenty to a hundred FTEs, the situation is different. Resources to set up a compliance team are limited. Documentation of existing AI applications is often fragmented. And it is tempting to think the Act mainly concerns the large players, even though the text has no turnover threshold for high-risk classification.

This article is for the business service provider that has not yet started in 2026, or already uses AI but does not know where governance should begin. We set out the essentials and a realistic six-month roadmap.

Where your AI systems are likely to fall

The EU AI Act distinguishes four risk levels: unacceptable, high-risk, limited risk, and minimal risk. For business service providers, high-risk, limited risk, and generative AI transparency are particularly relevant.

Examples of prohibited unacceptable uses include social scoring systems and certain forms of biometric identification. For most business service providers, these boundaries are not part of everyday practice, but it is important to document that you do not cross them.

Under Annex III, high-risk includes systems that recruit, assess, or monitor the work of employees. Systems affecting access to education, employment, or essential services can also be high-risk. For business service providers, HR applications, employee monitoring, and decision support affecting clients are particularly relevant.

What that means in practice for a business service provider in the Netherlands. Do you use AI tools to screen CVs in recruitment or monitor performance? High-risk. Do you use an AI tool that prioritises client files, makes risk assessments, or prepares advice? Then you need to document whether the system merely supports decisions or actually influences them. Do you use generative AI for client communication, reports, or marketing content? Then transparency, review, and use of sources are the main concerns.

Much office automation, knowledge search tooling, and draft generation do not automatically fall under high-risk. But even at limited risk, governance remains necessary: what data may go in, who checks the output, how do you prevent hallucinations in client work, and when must a person explicitly approve?

What the Act specifically requires for high-risk systems

Eight requirements, summarised here in terms of what they mean in practice for an SME without its own compliance engineer.

Risk management system. A documented process that maps the risks of the AI system and monitors them throughout its lifecycle. Not a one-off exercise, but a living document.

Data governance. Evidence that your data is appropriate, lawful, and verifiable. For business service providers, this often concerns client documents, internal knowledge bases, personnel data, and confidential project information. Here in particular, the question is not only what is technically possible, but what you may use under your contractual and professional obligations.

Technical documentation. A document describing in detail what the system does, how it works, how it was trained, what its limitations are, and how it is deployed in production. Annex IV of the Act provides an extensive template.

Record-keeping and logging. The system must independently generate log events that can later be audited. Not what your model did in May, but every individual decision it made, with inputs and confidence scores.

Transparency towards users and affected people. Clients must know that an AI system contributed to a decision affecting them, what the implications are, and how they can object.

Human oversight. A person must be able to intervene, and have the authority and knowledge to do so meaningfully. For client advice, HR decisions, and document analysis, this means AI output is reviewed by someone who can take responsibility for the final result.

Accuracy, robustness, and cybersecurity. The system must work reliably under real conditions, withstand attempts to manipulate it, and meet cybersecurity requirements proportionate to its impact.

Conformity assessment, registration, and CE marking. Formal assessment and documentation obligations depend on the type of system and your role. If you build or supply the system yourself, you are closer to provider obligations. If you use a vendor’s tool, some obligations sit with the supplier, but you remain responsible for correct use, oversight, and documentation within your own process.

A six-month roadmap for SME business service providers

Month one: inventory and classification. List all AI and ML systems running in your organisation or under consideration. Classify the risk category for each system. Crucially, shadow AI belongs on this list too. Tools your employees use without formal approval, ChatGPT flows implemented in a specific department, or third-party APIs on which your own products rely. The Microsoft/LinkedIn Work Trend Index 2024 found that 75 percent of knowledge workers use generative AI at work, and that 78 percent of those bring their own AI tools into the workplace. Gartner warned in November 2025 that 40 percent of organisations will experience a security or compliance incident caused by shadow AI by 2030. That matters for governance: you need to know which AI systems are used in the organisation, even when they were not procured centrally.

Month two: prioritisation and gap analysis. For every high-risk system: which requirements do you currently meet, and which do you not? Make this concrete. Not “we have some documentation”, but “we meet six of the eight points in Annex IV, and here are the two gaps”.

Month three: governance framework. A written policy for how your organisation develops, procures, assesses, and monitors AI. An AI committee or similar decision-making body with clear mandates. Acceptable use policies for your employees. Incident response procedures for model failure or a security event.

Month four: technical documentation and logging. For your most important high-risk system: write the Annex IV documentation. Implement compliant logging. Test whether you can reconstruct, from the logs, any single decision from last week, including all its inputs.

Month five: human oversight and transparency. Adapt your client communication for automated decisions. Implement a review workflow for edge cases. Train your employees on when and how to override the AI system.

Month six: formal assessment and decision-making. Determine which obligations sit with you and which with a supplier for each high-risk system. Collect the technical documentation, record how human oversight works, and document whether registration, conformity assessment, or additional vendor evidence is needed before the system continues to be used.

Common mistakes

Three patterns we see among business service providers that start too late.

They treat the Act as a compliance checkbox and delegate it to a lawyer. It is an operational transformation that changes documentation, processes, and culture. A lawyer alone cannot deliver that.

They focus on the tools they build themselves and forget the tools they buy. A SaaS product you use for recruitment, knowledge management, client analysis, or document review can also be relevant to the AI Act. As a deployer, you remain responsible for correct use, even when the supplier provides the technology.

They put it off. With the Omnibus agreement, December 2027 now seems far away, and that is exactly the trap. You cannot build governance, documentation, logging, and human oversight in the final weeks before a deadline. Especially when client work, audit cycles, and operational priorities are involved, starting early is usually cheaper than fixing things late.

What an external partner can do

For a business service provider without an internal compliance engineer or AI specialist, this type of work usually cannot be handled alone, at least not alongside day-to-day operations. What an external partner adds in practice: the inventory and gap analysis in a few weeks rather than months, a governance framework adapted to your situation rather than built from scratch, and an AI Improvement Plan that connects compliance to business value. That way, you do not spend six months doing nothing but administration.

Our AI Strategy & Compliance expertise is built specifically for this, and the Business Services page goes deeper into sector-specific implications. The AI Readiness Scan is the natural starting point: in 10 minutes, you know where you stand, which quick wins avoid making compliance unnecessarily complex, and what your roadmap looks like.

What you should certainly not do is assume that the Omnibus agreement means the Act is becoming softer. It is not becoming softer. The architecture, fines, and obligations remain. Only the implementation clock runs differently. December 2027 is not far off if you have to establish governance, audit trails, and documentation from scratch. Compliance before the new deadline remains a competitive advantage: business service providers that get governance right early earn clients’ trust, reduce risk in client work, and can deploy AI responsibly sooner.

One exception does become binding earlier: from 2 August 2026, AI systems that generate synthetic content (chatbots, image generators, content tools) must technically mark their output. For business service providers using generative AI in client communication, reporting, knowledge sharing, or marketing, this is a short-term task that does not disappear with the Omnibus postponement.

A note on how this was made: our content is AI-assisted. We use AI for research and drafting a first concept. A human reviews and edits the text and takes responsibility for everything we publish. Read how we make our content.