A lot of AI Act advice currently on sale is priced against a deadline that has moved. The Digital Omnibus, in force since 27 July 2026, pushed the Annex III high-risk obligations out to December 2027 — while the obligations that genuinely apply to most SMEs were already in force and are quietly being under-sold. This page separates the two.
By Tom Joseph · Last updated: 5 August 2026
Most SMEs are deployers of limited-risk AI, not providers of high-risk AI. What actually binds you: Article 4 AI literacy, in force since 2 February 2025, and the transparency obligations that applied from 2 August 2026. The Annex III high-risk regime — the expensive one — was postponed by the Digital Omnibus from August 2026 to 2 December 2027. In the Netherlands the Autoriteit Persoonsgegevens coordinates supervision. Expect €80–€300 per hour for advisory, or a fixed-price check in the low four figures.
Every firm below was found through public search on the query this page answers, then checked against four criteria. We list what we could verify, and we say so when we could not.
Check this against any proposal you receive. If a consultant is still selling urgency on an August 2026 high-risk deadline, they have not updated their material since July.
| Obligation | Applies from | Relevant to a typical SME? |
|---|---|---|
| Article 4 — AI literacy | 2 February 2025 (already in force) | Yes. Applies to every organisation using AI, any size |
| Prohibited practices | 2 February 2025 | Rarely — but worth one read to confirm |
| Transparency obligations | 2 August 2026 | Often. Disclosure when users interact with AI or see generated content |
| GPAI model obligations | 2 August 2025 | Only if you build and place a general-purpose model on the market |
| Annex III high-risk regime | 2 December 2027 — moved from 2 Aug 2026 by the Digital Omnibus | Only for genuine high-risk uses, e.g. AI in hiring decisions |
The Autoriteit Persoonsgegevens (AP) is the coordinating supervisor, with enforcement beginning 2 August 2026. Sectoral supervisors take their own domains: DNB and AFM for financial services, IGJ for healthcare, and the Nederlandse Arbeidsinspectie for workplace matters. That last one matters more than SMEs expect — AI used in recruitment or staff monitoring lands in two regimes at once, the AI Act and the GDPR.
What a supervisor will realistically ask a 40-person company: what AI are you using, who decided that, what did you tell the people affected, and what did you do about staff competence. An AI register, a usage policy and a training record answer all four.
Alphabetical within each tier. The cheapest adequate option is genuinely adequate for many SMEs — do not let anyone tell you otherwise before they have seen your AI inventory.
| Route | Who offers it | Indicative cost | Best fit |
|---|---|---|---|
| Self-service platform | AIComplianceHub.nl — Dutch-language platform with a free risk scanner, AI register and document generation | Free tier upward | Low-risk deployers who mainly need a register, a policy and evidence |
| Fixed-price compliance check | Crux Digits AI Act Check €950; Estrelle runs a three-step SME programme completed within a week | roughly €950–€5,000 | SMEs of 10–100 staff wanting a defensible answer fast |
| Specialist AI-compliance consultancy | CleverTech, Embed AI, Delbion and comparable firms publishing SME-specific AI Act material | €80–€300 per hour | Sector-specific questions, or genuine Annex III exposure |
| Law firm / Big Four | Deloitte and peers; specialist tech-law practices | Enterprise rates | Real high-risk classification disputes, or when you need privilege |
For a typical Dutch SME using ChatGPT, a CRM with AI features and perhaps a chatbot, the compliance work is genuinely modest:
The AI Act has produced more fear-selling than any regulation since the GDPR. Watch for:
Disclosure: Crux Digits is one of the firms on this page. We built the list, so treat our own entry with the scepticism that deserves — and check the others' sites yourself. There are no affiliate links, no paid placements and no reciprocal-listing deals anywhere on this page. The order is alphabetical, not a ranking.
Crux Digits sells a fixed-price AI Act Check at €950 and an AI-literacy programme at €12,500. We are an AI implementation firm with a compliance offer, not a law firm — if your question is a contested high-risk classification or anything that may end in a dispute, engage a specialist tech-law practice instead of us. If your question is "what are we actually running and what do we need to write down", the €950 check is designed for exactly that, and a free platform like AIComplianceHub may get a well-organised SME most of the way for nothing.
The AI Act Check is €950 fixed: your AI inventory, a risk classification with reasoning, and the documents to evidence it.
Book a free consultation →