Intragentic
All guides

What SMEs need to know about software and AI in 2026

Which 2026 law changes on software and AI affect small and medium-sized businesses, when they apply and what to do. As of October 2026.

Published
Reading time
14 minutes

Which of the 2026 law changes for SMEs affect your business on software and AI depends on its size and what it offers. Take a made-up tile dealer in the district of Erlangen-Höchstadt with 22 employees and around 3.5 million euros in turnover. It sells to tradespeople and, online, to private customers too. The team writes quote texts with an AI tool in the browser, and the business has no internal rules for it.

Also made up: a special-purpose machine builder near Schwabach with 120 employees, around 24 million euros in turnover and connected machines. Its HR department is testing a tool that pre-sorts job applications. All figures are made up.

Under the EU definition, a small enterprise has fewer than 50 employees and at most 10 million euros in turnover or balance sheet total. A medium-sized enterprise stays below 250 employees and has at most 50 million euros in turnover or 43 million euros in balance sheet total. So the tile dealer is small and the machine builder is medium-sized.

This overview reflects the law as of 21 October 2026. Only the text of the law and the competent authority are binding. This is not legal, tax or funding advice.

AI Act

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Since 27 July 2026, it has been in force as amended by the Digital Omnibus (Regulation (EU) 2026/1744, entry into force). A deployer is anyone who uses an AI system under their own authority in the course of their work (Art. 3(4)). So the tile dealer with its browser tool already counts. Small and medium-sized enterprises have the same deployer obligations.

Art. 4 has applied since 2 February 2025 (date of application) and has been worded less strictly since 27 July 2026. Deployers take measures to support the development of AI literacy among their staff and other people who work with AI systems on their behalf. They do not have to guarantee a particular level, but it is still an obligation. According to the Bundesnetzagentur, the Federal Network Agency, no certificate or standard course is required. It recommends documenting the type, scope and participants of each measure.

Art. 4 is not among the infringements subject to fines (Art. 99(3) to (5) AI Act and Section 15 KI-MIG). KI-MIG is the German act implementing the AI Act. Since 29 July 2026, the supervisory authority in Germany has generally been the Bundesnetzagentur (Section 2(1) KI-MIG, entry into force).

Art. 50 has applied since 2 August 2026 (date of application). In a chat, customers learn no later than the first message that they are writing to an AI. The notice must be clear and accessible (paras. 1 and 5). The obligation lies with the provider. Who that is when an outside developer builds the chat for you has not been conclusively settled.

Providers of generative AI must also mark its output in a machine-readable way (para. 2). For systems placed on the market before 2 August 2026, a transition period runs until 2 December 2026 (Art. 111(4), deadline). Both obligations are aimed at the providers of the tools.

Deployers have obligations of their own. Anyone who uses AI to generate or alter image, audio or video content that is a deepfake must disclose this (para. 4). The same applies to AI-generated text that informs the public on matters of public interest. Texts are exempt if a person has reviewed them and a person or your company holds editorial responsibility for them.

High-risk AI includes systems that screen or filter job applications or evaluate applicants (Annex III point 4). It also includes AI for decisions on promotion, dismissal or performance reviews and for credit checks on natural persons (points 4 and 5). The obligations for these apply from 2 December 2027 (date of application). The machine builder’s application tool falls into this category.

What to do: record an AI literacy measure, start a chat only with a notice, and check application AI against Annex III first.

Data protection with service providers

If a service provider processes personal data on your behalf, you need a data processing agreement under Art. 28(3) GDPR. This applies, for example, to cloud AI, hosting, website chat and inventory management in the cloud. The processor acts only on your documented instructions (para. 3) and uses sub-processors only with your authorisation (para. 2). The agreement must be in writing, and electronic form is enough (para. 9).

Art. 28 makes no exception based on size. If data goes to a third country, Art. 44 onwards also apply. Servers in Germany do not replace the agreement either. What to do: list your services and find the agreement for each one.

E-invoicing

Since 1 January 2025, every business in Germany must be able to receive e-invoices (date of application). This includes small traders under the VAT exemption (Kleinunternehmer). According to the Federal Ministry of Finance, an email inbox is enough. The obligation applies only between businesses in Germany, not to invoices to private customers (Section 14(2) UStG, the German VAT Act).

Until 31 December 2026, all businesses may still send paper or, with the recipient’s consent, PDF invoices (deadline). From 1 January 2027, businesses with more than 800,000 euros in turnover in the previous year must issue e-invoices (date of application). Those with turnover of at most 800,000 euros have until 31 December 2027 (Section 27(38) UStG, deadline). From 1 January 2028, the obligation applies to everyone. The exceptions are small invoices up to 250 euros, travel tickets and VAT-exempt small traders.

The German Confederation of Skilled Crafts is calling for a postponement, but none has been decided. More on handling incoming invoices with AI.

NIS2 and the BSIG

The new BSIG, the German Act on the Federal Office for Information Security, implements NIS2. It has been in force since 6 December 2025. According to the BSI, the Federal Office for Information Security, there is no general transition period.

An important entity is a company of a type listed in Annex 1 or 2 with at least 50 employees. The same applies if turnover and balance sheet total each exceed 10 million euros (Section 28(2) BSIG). Annex 2 lists, for example, mechanical engineering, electrical equipment, motor vehicle parts, medical devices, food wholesale and the food industry, and chemicals under REACH. Annex 1 covers, for example, energy, transport, health and digital infrastructure.

Below these thresholds, you are generally not covered yourself. The exceptions are a few cases that apply regardless of size, such as trust services and DNS services. Small businesses can still be affected indirectly, though. If you supply an NIS2 entity, it can write requirements on security, incidents and updates into your contract (BSI, FAQ). There is no general certificate for this.

The machine builder is an important entity and was required to register with the BSI within three months (Section 33). By our calculation, the period ended on 6 March 2026 (deadline). The BSI says it has expired and urges those affected to register in the BSI portal without delay.

Section 30(2) adds risk management with ten minimum measures, such as backups, training, multi-factor authentication and supply chain security. Significant security incidents must be reported first within 24 hours, again within 72 hours and finally within one month after that (Section 32(1)). Management implements the measures, monitors them and takes part in training regularly (Section 38). For culpable breaches, management is liable under company law. You check yourself whether your business is affected; the BSI’s applicability check helps with this.

Accessibility in your online shop

The BFSG, the German Accessibility Strengthening Act, entered into force on 28 June 2025. It covers websites and apps through which consumers enter into contracts, such as online shops (Section 1(3), Section 2 No. 26). Only micro-enterprises providing services are exempt. These have fewer than ten employees and up to 2 million euros in turnover or balance sheet total (Section 3(3)). A shop purely for business customers is not covered.

The tile dealer’s shop is covered, because the business has more than ten employees. There is no exemption for medium-sized enterprises. Supervision lies with the federal states (Section 20). What to do: have your shop and ordering process checked for accessibility.

Data Act and switching cloud providers

The Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025 (date of application). As the customer of a cloud service, you may switch to another provider or to your own servers (Art. 23). The notice period for this is at most two months, the transition period at most 30 days (Art. 25). From 12 January 2027, switching charges are abolished (Art. 29, date of application).

These rights do not depend on your size. For services built for a single customer, the ban on switching charges, among other rules, does not apply (Art. 31). What to do: read the switching clauses at your next renewal.

Manufacturers of connected products must provide for data access in everything placed on the market after 12 September 2026 (Art. 3(1), date of application). Micro and small enterprises without larger partner or linked enterprises are exempt, medium-sized ones only in the first year (Art. 7(1)).

Cyber Resilience Act

The Cyber Resilience Act (Regulation (EU) 2024/2847) is aimed mainly at manufacturers that place products with digital elements on the market. This means connected hardware and software (Art. 2, Art. 3). Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents affecting product security (Art. 14, date of application). The early warning is due within 24 hours.

The reporting obligation also covers products delivered before 11 September 2026 (Art. 69(3)). The act applies in full from 11 December 2027 (Art. 71, date of application), and then also to importers and distributors.

The machine builder is a manufacturer. Micro and small enterprises get some relief, such as simplified technical documentation (Art. 33(5)); medium-sized enterprises do not.

If you only buy and use software, you do not make it available on the market and, in our understanding, are not a manufacturer. Under the Commission’s guidelines of 27 July 2026, pure browser applications are not a product under the CRA. The guidelines are not binding.

It is still open whether in-house software built only for your own business can be covered. It is also open how to classify custom software that has been handed over and runs at the customer’s site.

Deadlines at a glance

  • Since 1 January 2025 (date of application): receiving e-invoices, all businesses.
  • Since 2 February 2025 (date of application): AI literacy measures under Art. 4, new wording since 27 July 2026 (entry into force).
  • Since 28 June 2025 (entry into force): BFSG for shops selling to consumers, except micro-enterprises.
  • Since 6 December 2025 (entry into force): BSIG with NIS2; registration by 6 March 2026 (deadline, calculated), expired according to the BSI.
  • Since 2 August 2026 (date of application): transparency obligations under Art. 50, such as the AI notice in a chat.
  • Since 11 September 2026 (date of application): reporting obligations for manufacturers under CRA Art. 14.
  • 31 December 2026 (deadline): paper or PDF between businesses for everyone. From 1 January 2027 (date of application), e-invoices if previous-year turnover exceeds 800,000 euros.
  • 12 January 2027 (date of application): switching cloud providers without switching charges, except for services built for a single customer.
  • 2 December 2027 (date of application): high-risk obligations, for example for selecting applicants with AI.
  • 1 January 2028 (date of application): e-invoices between businesses for everyone except VAT-exempt small traders, small invoices and travel tickets. The transition period up to 800,000 euros ends on 31 December 2027 (deadline).

What Intragentic can take on

Our AI workshop costs €1,490 for half a day with up to twelve people. It includes documentation of the AI literacy measure under Art. 4, not a certificate. If we build a chat or assistant, the production build from €29,000 includes labelling under Art. 50.

With Operations from €490 a month, your instance and the models run on servers in Germany. Dedicated instances with open-source models are our standard. For your data, we sign a data processing agreement under Art. 28 GDPR with you. All prices are net.

At the tile dealer, a chat could answer questions on delivery times only from the inventory management system. A member of staff approves discounts and complaints. At the machine builder, an assistant drafts maintenance reports, and the technician checks and approves them. We do not build AI for selecting applicants or for decisions about people.

We do not advise on law or NIS2, and we do not make any business “NIS2-compliant”. If a client is an NIS2 entity, we provide the information about our service that it needs for its supply chain.

Tell us which AI tools and cloud services you use. In a first call, we work out with you what is technical and what to clarify with your law firm or tax adviser.

Sources

All links accessed on 21 October 2026. EU law as published in the Official Journal; amendments by the Digital Omnibus according to the consolidated version.

Let’s talk about your process.

A first call takes 30 minutes and costs nothing. Afterwards you know which step fits.

Request a first call

Assistant

Fixed answers, no AI