EU AI Act Compliance for Belgian SMEs: What You Actually Need to Do

The EU AI Act is already in force and enforcement deadlines are approaching fast. If you’re a Belgian SME using AI for customer support, email automation, or internal workflows, you need to know where you stand. The good news: most small business AI use cases fall into low-risk categories. But “probably fine” is not a compliance strategy.

This post gives you a plain-language walkthrough of the regulation, a practical compliance checklist, and specific resources for Belgian companies. We build AI-powered automation for SMEs every day at Flowful, and compliance is baked into everything we ship. Here’s what we’ve learned.

Note. Practical primer, not legal advice. The AI Act landscape is still moving (Digital Omnibus deal pending). Verify with a specialist before acting on specific obligations.

What Is the EU AI Act?

The EU AI Act (Regulation 2024/1689) is the world’s first comprehensive AI law. Published in the Official Journal on 12 July 2024, in force since 1 August 2024. It classifies AI systems by risk: higher risk, stricter rules. The full Commission policy page is here.

Key dates, including the postponements agreed in the Digital Omnibus on AI (political deal of 7 May 2026, pending formal Council and Parliament adoption):

2 Feb 2025: Prohibited practices banned. AI literacy (Article 4) applies.
2 Aug 2025: GPAI rules take effect. Code of Practice published 10 July 2025.
2 Aug 2026: Governance, penalties, GPAI enforcement and AI literacy enforcement all kick in.
2 Dec 2027 (new): Annex III high-risk obligations apply (postponed from August 2026).
2 Aug 2028 (new): Annex I high-risk obligations apply (postponed from August 2027).

For Belgian SMEs, the immediately relevant dates are February 2025 (verify you are not running any prohibited practice) and August 2026 (literacy enforcement and the penalty regime). High-risk obligations now land late 2027, but do not wait.

The Four Risk Categories

The AI Act sorts systems into four tiers. The decision tree above shows the canonical examples. Below, what each tier means for an SME.

Unacceptable Risk (Banned)

Social scoring, subliminal manipulation, real-time biometric identification in public spaces (with narrow law-enforcement exceptions), emotion recognition at work or school, untargeted facial-image scraping. For SMEs: very unlikely you are doing any of this. But verify any tool that claims emotion detection, trustworthiness scoring or facial recognition, and get legal advice if it does.

High Risk (Heavy Obligations)

Listed in Annex III: HR/recruitment screening, credit scoring, life or health insurance risk and pricing, education access, essential public services, law enforcement, migration, non-real-time biometrics. Plus AI safety components in regulated products under Annex I (medical devices, vehicles, machinery). For SMEs: if you screen job applicants, assess loan eligibility, or take consequential decisions about individuals, you are likely here. Chapter III obligations (risk management, data governance, technical docs, human oversight, conformity assessment, EU database registration) apply by 2 Dec 2027 for Annex III and 2 Aug 2028 for Annex I.

Limited Risk (Transparency Obligations)

Customer-facing chatbots, virtual assistants, AI-generated content including deepfakes, plus emotion recognition or biometric categorisation where not banned. For SMEs: disclose to users that they are talking to AI, and label AI-generated content. Article 50 obligation, straightforward to implement.

Minimal Risk (No Specific Obligations)

Spam filters, AI-assisted email drafting, workflow automation, product recommendations, inventory forecasting, document classification, AI-assisted translation. For SMEs: almost everything you use daily. No mandatory steps. Document what you run and why.

What This Means for Belgian SMEs

If you use AI chatbots for support, email automation, workflow tools or document processing, your use cases are almost certainly minimal or limited risk. You are probably fine. But “probably” is not a strategy. Four reasons to still pay attention:

You might be high-risk without realising it. HR screening CVs, sales scoring leads feeding into credit decisions, anything consequential about individuals: the classification depends on the use case, not the technology.
Vendors may shift responsibility to you. “Deployers” have their own obligations separate from providers. Deploy a general-purpose AI tool in a high-risk context and the burden lands on you.
Belgian enforcement is coming. BIPT is the main market surveillance authority, SPF Economie coordinates implementation, and the CSA is one of twenty-one Article 77 fundamental-rights bodies (audiovisual media in the French-speaking community). Belgium missed the August 2025 governance deadline; enforcement starts 2 August 2026. Fines under Article 99: up to 35M EUR or 7% of global turnover (prohibited), 15M / 3% (high-risk), 7.5M / 1% (false information). SMEs and start-ups pay the lower of the two figures, still significant.
Clients will start asking. B2B buyers, especially larger companies and public sector, will ask about your AI compliance posture. Being prepared is an edge.

A Practical Compliance Checklist

Seven steps you can start today. No law firm on retainer required.

Inventory your AI systems. List every tool you run, including third-party SaaS. Note what it does, what data it processes, who is affected, and who provides it. You cannot assess risk on what you do not know.
Classify each system. Three questions: does it influence consequential decisions about people, does it interact with users who may not know they are dealing with AI, can it manipulate or exploit vulnerabilities? Three “no” puts you in minimal or limited risk. One “yes”, check Annex III and dig deeper.
Implement transparency. Disclose AI to users (chatbots, voice agents, AI-generated content). Label AI output. Offer a route to a human. Article 50 obligation for limited-risk systems.
Keep humans in the loop. Review AI output before it is sent or used for decisions. Build escalation paths. Let employees override. Mandatory and technical for high-risk; good practice everywhere else.
Document everything. Inventory, risk classification, justification, transparency and oversight measures, incidents, GDPR data-processing records. Documentation is the backbone of compliance. The Future of Life Institute compliance checker is a useful free starting point.
Review vendor contracts. Does the provider classify their system’s risk level? Do they provide the AI Act technical documentation? Who owns the conformity assessment? What happens to your data? Where is it processed? A vendor that cannot answer is a red flag.
Train your team. The Article 4 AI literacy obligation has applied since 2 Feb 2025. Staff must understand what AI they use, how it works at a basic level, its limits, and your internal policy. PhD-level not required.

If you are already GDPR-compliant, most of the analytical work maps over: DPIAs ≈ AI Act risk assessments. Data minimisation and purpose limitation ≈ AI Act data governance. Article 22 ≈ AI Act transparency obligations. GDPR right to human intervention ≈ AI Act human oversight.

Where the AI Act goes further: technical standards on the system itself (accuracy, robustness, cybersecurity, technical documentation). GDPR governs data; the AI Act governs the system. Do not run two parallel projects. Integrate AI Act work into your existing GDPR framework, same team, same docs.

How Flowful Approaches AI Compliance

At Flowful, we are an AI implementation partner. We build web and internal chatbots, AI phone receptionists, email automation, an AI-first helpdesk (TicketFlow), and AI-ready appointment booking (Flowcal) for SMEs in Belgium and France. We design and operate every project with compliance baked in. We are not a law firm. Anything below is how we build, not legal advice; bring in a specialist for the formal conformity work.

Here’s what that looks like in practice:

Core hosting in the EU. Our workflow infrastructure runs on Hetzner in Germany. AI inference, voice, and transactional email are routed through US sub-processors (OpenRouter, ElevenLabs, Twilio, Resend) under Standard Contractual Clauses. Every sub-processor is listed in our DPA. On request, we can restrict processing to EU-only providers or run open-source models on dedicated infrastructure.
Your data is not used to train AI models. We configure every sub-processor we route through to disable training on customer data and we document the per-vendor settings in our DPA. Where a vendor only honours that posture on a specific tier or opt-out toggle, we enable it and verify it.
Human-in-the-loop where it matters. Our email automation can require human approval before sending. Our voice agents escalate to a person when a caller’s request falls outside scope.
Transparency by default. Our chatbots and voice agents identify themselves as AI systems, so users always know they’re interacting with AI.
Data Processing Agreement (DPA) available on request. Our DPA covers both GDPR and AI-specific obligations, including the no-training clause and the sub-processor list. Email contact@flowful.ai to receive it.

None of this makes us unique. It’s what every responsible AI provider should be doing. But we find that many SMEs are relieved to work with a partner that has already thought through these questions. If you want to learn more about building reliable AI systems, we’ve written about that too.

Belgian-Specific Resources

Belgium’s AI ecosystem has several organizations and authorities that can help you navigate compliance. Here are the most useful ones:

Regulatory and Government

BIPT (IBPT): Belgium’s main market surveillance authority for the AI Act. This is where enforcement will happen for most providers and deployers, including a single point of contact for high-risk system operators.
SPF Economie (FPS Economy): Coordinates Belgium’s implementation of the AI Act. The dedicated AI Act section has guidance for entrepreneurs, plus an SME-oriented campaign and a downloadable guide.
Data Protection Authority (APD/GBA): Belgium’s GDPR supervisor. As AI compliance and data protection overlap significantly, the APD remains relevant for AI-related data processing questions.
AI4Belgium Coalition: A multi-stakeholder initiative that published Belgium’s AI strategy. Their resources include practical guidelines and sectoral recommendations.

Regional Innovation Support

Innoviris (Brussels): Brussels’ innovation funding body. Offers AI-specific vouchers and funding programs. If you’re a Brussels-based SME exploring AI, they can help fund a compliant implementation from the start.
Digital Wallonia (Wallonia): Wallonia’s digital strategy hub. Runs the Start IA and Tremplin IA programs, and publishes practical AI adoption guides.
VLAIO (Flanders): Flanders’ innovation and entrepreneurship agency. Offers R&D grants and SME support programs applicable to AI projects.

Practical Tools

EU AI Act Explorer: An independent resource with a searchable, annotated version of the full regulation. Useful for looking up specific articles and requirements.
Future of Life Institute AI Act Compliance Checker: A free self-assessment tool that helps you determine whether your AI system might be high-risk under the AI Act.

We’ve also published a guide to funding AI projects in Belgium, which covers subsidies and grants that can help offset the cost of building AI solutions that are compliant from the start.

What to Do Next

A realistic timeline for a Belgian SME:

Now: inventory, verify no prohibited practice, start AI literacy training, review vendor contracts.
By June 2026: finish risk classification, start high-risk remediation if applicable, update GDPR docs.
By 2 Aug 2026: AI literacy enforcement and penalty regime kick in. Training and policies must be in place.
By 2 Dec 2027: Annex III high-risk obligations enforceable (date pending formal Digital Omnibus adoption).
Ongoing: monitor delegated acts, implementing acts, and Belgian guidance. Keep documentation current.

For most Belgian SMEs running standard business automation, the workload is manageable. Start now, classify honestly, build the documentation habit.

This post is a primer, not a compliance assessment. For a formal conformity check, work with a legal or compliance specialist. If you are planning AI-powered automation and want it built with these obligations baked in from day one, get in touch.