EU AI Act consultants for SMEs, compared
Most SMEs are deployers of limited-risk AI, not providers of high-risk AI. What actually binds you: Article 4 AI literacy, in force since 2 February 2025, and the transparency obligations that applied from 2 August 2026.
A lot of AI Act advice currently on sale is priced against a deadline that has moved. The Digital Omnibus, in force since 27 July 2026, pushed the Annex III high-risk obligations out to December 2027, while the obligations that genuinely apply to most SMEs were already in force and are quietly being under-sold. This page separates the two.
Last updated: 5 August 2026
Most SMEs are deployers of limited-risk AI, not providers of high-risk AI. What actually binds you: Article 4 AI literacy, in force since 2 February 2025, and the transparency obligations that applied from 2 August 2026. The Annex III high-risk regime, the expensive one, was postponed by the Digital Omnibus from August 2026 to 2 December 2027. In the Netherlands the Autoriteit Persoonsgegevens coordinates supervision. Expect €80–€300 per hour for advisory, or a fixed-price check in the low four figures.
How this list was built
Every firm below was found through public search on the query this page answers, then checked against four criteria. We list what we could verify, and we say so when we could not.
- It really serves this segment: the firm's own site shows work at this size and in this market, not enterprise work relabelled.
- Published, checkable specifics: prices, durations or named deliverables on their own pages. A firm that publishes nothing gets listed, but is marked as such.
- Reachable and current: a live site and a findable decision-maker as of the verification date.
- Honest fit: we name who each firm is the better choice for, including where that is not us.
The timeline, after the Digital Omnibus
Check this against any proposal you receive. If a consultant is still selling urgency on an August 2026 high-risk deadline, they have not updated their material since July.
| Obligation | Applies from | Relevant to a typical SME? |
|---|---|---|
| Article 4: AI literacy | 2 February 2025 (already in force) | Yes. Applies to every organisation using AI, any size |
| Prohibited practices | 2 February 2025 | Rarely, but worth one read to confirm |
| Transparency obligations | 2 August 2026 | Often. Disclosure when users interact with AI or see generated content |
| GPAI model obligations | 2 August 2025 | Only if you build and place a general-purpose model on the market |
| Annex III high-risk regime | 2 December 2027, moved from 2 Aug 2026 by the Digital Omnibus | Only for genuine high-risk uses, e.g. AI in hiring decisions |
Who supervises this in the Netherlands
The Autoriteit Persoonsgegevens (AP) is the coordinating supervisor, with enforcement beginning 2 August 2026. Sectoral supervisors take their own domains: DNB and AFM for financial services, IGJ for healthcare, and the Nederlandse Arbeidsinspectie for workplace matters. That last one matters more than SMEs expect: AI used in recruitment or staff monitoring lands in two regimes at once, the AI Act and the GDPR.
What a supervisor will realistically ask a 40-person company: what AI are you using, who decided that, what did you tell the people affected, and what did you do about staff competence. An AI register, a usage policy and a training record answer all four.
Four ways to get compliant, at very different prices
Alphabetical within each tier. The least expensive adequate option is genuinely adequate for many SMEs. Do not let anyone tell you otherwise before they have seen your AI inventory.
| Route | Who offers it | Indicative cost | Best fit |
|---|---|---|---|
| Self-service platform | AIComplianceHub.nl: Dutch-language platform with a free risk scanner, AI register and document generation | Free tier upward | Low-risk deployers who mainly need a register, a policy and evidence |
| Fixed-price compliance check | Crux Digits AI Act Check €950; Estrelle runs a three-step SME programme completed within a week | roughly €950–€5,000 | SMEs of 10–100 staff wanting a defensible answer fast |
| Specialist AI-compliance consultancy | CleverTech, Embed AI, Delbion and comparable firms publishing SME-specific AI Act material | €80–€300 per hour | Sector-specific questions, or genuine Annex III exposure |
| Law firm / Big Four | Deloitte and peers; specialist tech-law practices | Enterprise rates | Real high-risk classification disputes, or when you need privilege |
What most SMEs actually need to buy
For a typical Dutch SME using ChatGPT, a CRM with AI features and perhaps a chatbot, the compliance work is genuinely modest:
- An AI register: a list of the AI systems in use, what each does, and who owns it. A spreadsheet is a legitimate starting point.
- A usage policy: what staff may and may not put into which tools. This is also your best GDPR control.
- An Article 4 training record: who was trained, on what, when. The comparison of AI training providers sets them side by side on price, format and who each course is for.
- A transparency check: where customers interact with AI or see generated content, say so.
- A risk classification you can defend: usually "limited risk deployer", written down with the reasoning.
Four things that should end the conversation
The AI Act has produced more fear-selling than any regulation since the GDPR. Watch for:
- "Fines up to €35 million" as the opening line. True for prohibited practices by large providers; irrelevant to a 30-person deployer, and quoting it as your headline is a tell.
- Urgency built on the August 2026 high-risk deadline. That date moved to December 2027 under the Digital Omnibus. Anyone still selling against it is working from stale material.
- Classifying you as high-risk before inventorying your systems. Classification follows the use case; it cannot be asserted in a sales call.
- A compliance retainer before a compliance check. You cannot price ongoing work before anyone knows what you are running.
Our own position
Disclosure: Crux Digits is one of the firms on this page. We built the list, so treat our own entry with the scepticism that deserves, and check the others' sites yourself. There are no affiliate links, no paid placements and no reciprocal-listing deals anywhere on this page. The order is alphabetical, not a ranking.
Crux Digits sells a fixed-price AI Act Check at €950 and an AI-literacy programme at €12,500. We are an AI implementation firm with a compliance offer, not a law firm. If your question is a contested high-risk classification or anything that may end in a dispute, engage a specialist tech-law practice instead of us. If your question is "what are we actually running and what do we need to write down", the €950 check is designed for exactly that, and a free platform like AIComplianceHub may get a well-organised SME most of the way for nothing.
Compare further
Frequently asked questions
Did the EU AI Act deadline change in 2026?
Does the EU AI Act apply to small companies?
What does EU AI Act compliance cost for an SME?
Who enforces the AI Act in the Netherlands?
Do I need a lawyer or a consultant for the AI Act?
Is ChatGPT use by staff covered by the AI Act?
Want a defensible answer in a week?
The AI Act Check is €950 fixed: your AI inventory, a risk classification with reasoning, and the documents to evidence it.
Book a free consultation →