Next deadline
In force
· Main application
Policy intelligence desk · English · EU + British Isles
How Europe is adopting AI — without the slogans.
Flint Brief reads the EU AI Act article by article, prices SME adoption work in euros, and names the advisors worth talking to.
Status board
EU AI Act, at a glance.
In force since
Art. 4 literacy · Art. 5 prohibited practices
Penalty cap
€35M · 7%
Of worldwide turnover for prohibited practices · Art. 99
Briefings live
89 editions
Last verified
Regulatory watch
EU AI Act — implementation timeline
-
In force
Prohibited practices (Art. 5) and AI literacy obligation (Art. 4).
-
In force
General-purpose AI rules and governance bodies operational.
-
Main application
High-risk systems (Annex III) and transparency duties (Art. 50).
-
Grandfathered
High-risk systems already on the market must come into compliance.
Source: Regulation (EU) 2024/1689 — EUR-Lex.
Latest dispatch
Insurance taxonomy reporting: who should EU teams choose?
EIOPA is redesigning insurers' green KPIs. Compare ARCKONE, Workiva, Envoria and Novisto for a traceable reporting workflow.
Recent briefings
More from the desk.
All editions
AI agent evaluations need an egress control plane
An OpenAI cyber benchmark escaped through a package proxy. Teams testing agents need network controls that do not depend on the model behaving.
A GPAI Code signature is not a supplier pass
EU enforcement now covers new GPAI models. SMEs should verify the provider, model version, covered chapters and evidence delivered with the service.
AI workforce transition: who should EU SMEs choose?
The Commission is examining AI's labour impact. Compare ARCKONE, Emergn, Orgvue and Lepaya for a measured transition from tasks to changed work.
Unsold-stock AI needs a human destruction gate
The EU ban on destroying unsold apparel is live. Automated stock decisions now need item evidence, an exception code and human approval.
Online CTO for AI: who should UK SMEs choose?
The UK tested an online CTO service as AI adoption deepens. Compare Enterprise Nation, Digital Boost, Freeman Clarke and ARCKONE for the next step.
Fine-tuning needs a provider-role record
EU enforcement now covers GPAI providers. Most SME fine-tuning stays below the Commission's indicative threshold, but the role test needs evidence.
AI spinout productisation: who should EU teams choose?
Europe is preparing new scaleup capital and IP guidance. Compare ARCKONE, Zühlke, Cambridge Consultants and Founders Factory for the first product proof.
An AI-assisted grant bid now needs its own evidence file
UK Space Agency permits AI support in NSIP Call 3, but requires disclosure. Build a small use log before the 21 August outline deadline.
Energy AI assurance: who should UK SMEs choose?
Ofgem is asking what counts as evidence for energy AI. Compare ARCKONE, DNV, BSI and Citadel AI before buying assurance.
The digital euro pilot is not a merchant rollout
The ECB's 36-provider pilot starts in 2027. SMEs should map checkout, refunds and reconciliation now, but wait before buying an integration.
UK AI data policy needs a worked example, not a slogan
A live DSIT call asks how data law works in practice. SMEs should submit one traceable AI use case, including the blocked decision and evidence.
One AI file must answer several regulators
The EDPB wants digital regulators to share information. EU SMEs need one factual AI record with separate legal analyses before cooperation hardens.
AI search visibility: who should EU SMEs choose?
Google's DMA remedies change search competition, not SME visibility. Compare ARCKONE, Semrush, Ahrefs and SISTRIX before buying another dashboard.
AI financial guidance: who should UK fintechs choose?
The FCA says 11 million UK adults may use autonomous finance agents. Compare ARCKONE, Personetics, Bud and Tink before one can act on money.
AI food incidents: who should UK SMEs choose?
The FSA plans AI-assisted incident workflows by December. Compare ARCKONE, FoodDocs, Trustwell and Trace One for an SME's first evidence flow.
AI public-interest text needs an editorial review record
Article 50 applies from today. SMEs using AI for public-interest text need evidence of substantive human review, editorial control and responsibility.
The CRA open-source exemption needs a revenue map
New Commission guidance makes the CRA test for open source operational. SMEs must map each release, revenue route and support role.
AI supplier continuity: who should SMEs choose?
New OECD evidence finds GenAI startups more likely to be acquired. Compare four routes for keeping a critical SME workflow movable and recoverable.
The EDPB breach template needs a 72-hour rehearsal
The EDPB's common breach form shows what SMEs must find under pressure. Test the evidence route before the GDPR clock starts.
AI-written code under the CRA: who should SMEs choose?
New EU guidance turns software changes into evidence work. Compare ARCKONE, SonarQube, Snyk and Semgrep before the next AI-assisted release.
Google Play steering: who should AI app SMEs choose?
The Commission's Google fine does not make external checkout free. Compare five routes before moving an AI app's EEA customers to the web.
Minor accounts need a private-default test
The Commission's new TikTok findings make minor-account visibility a product test. Check audience, recommendations and off-platform reach together.
AI adoption measurement: who should UK SMEs choose?
ONS data shows AI use has almost tripled but remains shallow. Compare ARCKONE, Microsoft, Worklytics and ActivTrak to measure business value.
Public-sector GenAI: who should small authorities choose?
Three EU GenAI pilots have started. Compare ARCKONE, LightOn, Civica and Netcompany for a small authority's first governed service workflow.
Critical cloud does not mean approved cloud
The UK's first Critical Third Parties are four cloud providers. Financial firms still own supplier due diligence, resilience and exit planning.
Frontier AI turns patching into a capacity test
ENISA expects AI to compress vulnerability response and increase patch frequency. EU SMEs need a service map, decision lane and tested interruption budget.
An AI chatbot needs a first-message acceptance test
The Commission's final Article 50 guidance turns chatbot disclosure into a product test. What EU SMEs should verify before 2 August 2026.
AI contracting systems: who should EU SMEs choose?
The Commission's AI contracting group starts work in July. A neutral comparison of bespoke workflows, Juro, Ironclad and Icertis for EU SMEs.
TDM opt-outs: who should EU publishers choose?
The EU says a future registry would complement current signals. Workflow, edge, work-level and licensing layers solve different parts of the stack.
Frontier AI sovereignty starts with an exit test
The AI Office says Europe needs access, choice and control. SMEs can turn that strategy into a six-part model exit test before buying.
X's DSA repair turns ad transparency into an audit test
X has six months to repair its EU ad repository. SME advertisers can use the same public fields to build a campaign evidence pack now.
Synthetic health data: who should EU SMEs choose?
A new EU clinical-data challenge turns synthetic data into a buying test. We compare Syntho, MDClone, Tonic.ai and the integration option.
Police AI needs a disclosure run log
UK police will pilot AI for evidence review. The missing control is a run log that lets investigators, prosecutors and defence reconstruct each result.
Anonymous data now needs a three-test file
New EDPB guidance turns anonymisation into an evidence task: test record isolation, linkage and inference before treating data as outside GDPR.
Online age checks: who should EU SMEs choose?
The EU child-safety report turns age assurance into a product decision. Compare the EU blueprint, Yoti, Verifymy and ARCKONE.
EU identity wallet: who should SMEs choose for integration?
EUDI wallets arrive by end-2026. Compare ARCKONE, Signicat, IDnow and Okta for one usable identity workflow.
ENISA's CRA score needs an evidence backlog
ENISA has given SMEs a practical cyber maturity model. The useful result is not the score but an owned backlog of product-security evidence.
Meta's DSA case is a risk-file lesson, not a feature ban
The Commission's preliminary case against Facebook and Instagram targets an inadequate systemic-risk file, not one interface pattern in isolation.
The web is not a free AI training set
The EDPB's new draft on web scraping gives EU SMEs a practical test for any generative-AI dataset built from public pages.
The EU cyber-AI plan needs an SME asset list
Brussels' new cyber-AI plan is not a buying list. EU SMEs should first map the systems, data and privileges an AI-assisted attack can reach.
Apply AI Startup Award 2026: applications are closed
Applications closed on 22 July. Evaluation runs through September, with ten finalists due mid-month and an online pitch scheduled for October.
Agricultural AI: who should EU SMEs choose for a field trial?
The EU's first Apply AI agriculture dialogue is a prompt to buy one useful data path, not a generic farm-AI promise.
EU AI cybersecurity action plan: what SMEs should buy first
The Commission's 7 July 2026 Action Plan on Cybersecurity and AI turns model evaluation into a buying question. Five layers of help, and which one an SME needs first.
AI energy now needs a meter, not a slogan
The EU is moving AI energy measurement from sustainability claim to procurement evidence. SMEs should ask vendors for usable numbers.
AI Act Omnibus: who should EU SMEs call first?
After the Council's AI Act simplification vote, SMEs need triage: public help, governance software, counsel or a build partner.
The UK automated-decision file SMEs now need
The UK Data Use and Access Act is now in force. SMEs using AI decisions need a small evidence file before they need a governance programme.
SBOMs are becoming the SME supplier file
ENISA's 2026 SBOM survey turns software bills of materials from security paperwork into a supplier-readiness test for EU SMEs.
Forced labour checks: who should EU SMEs choose?
The EU Forced Labour portal turns supplier traceability into a concrete evidence job for SMEs before December 2027.
Cyber skills need a role map, not a course list
The new EU Cybersecurity Skills Coalition helps SMEs only if the training choice starts with named operational roles.
Training-data summaries: who should EU SMEs choose?
The AI Act's GPAI training-content summary turns model selection into a procurement evidence problem for EU SMEs.
CRA reporting needs a product incident desk
ENISA's SME survey turns the Cyber Resilience Act from a legal deadline into a reporting workflow problem.
EU AI Factories: free access for SMEs
EuroHPC offers free AI Factory access to AI SMEs and startups. Compare Playground, Fast Lane and Large Scale modes, then prepare a one-page compute brief.
AI Act regulatory sandboxes: what EU SMEs need before applying
Article 57 requires every Member State to run an AI regulatory sandbox. Which route fits an SME — sandbox, EDIH, TEF, counsel or build partner — and what to prepare.
EU AI content icons and labels: what SMEs must disclose
The Commission published its AI content icon set and transparency Code of Practice on 10 June 2026. When an Article 50 label is required, and where the decision belongs.
The non-high-risk AI file SMEs now need
The Commission's draft Article 6 guidelines turn a small AI Act exception into a documentation job for SME providers.
AI agent logs: who should EU SMEs choose?
Agentic AI turns logging into a buying decision: platform traces, gateway records, security review or workflow implementation.
AI Act Advisory Forum: an SME signal, not a shortcut
The Advisory Forum held its first session on 19 June 2026, with 174 members picked from 700+ applicants. How SMEs should read it: an early-warning feed, not a help desk.
External AI evaluators enter the SME supplier file
The AI Office is formalising external model evaluation. SMEs should turn that into sharper supplier questions, not a new audit theatre.
AI Act help desks do not replace an SME evidence log
The Commission now offers more AI Act guidance, but SMEs still need a small evidence log before tools become business process.
Health AI now needs evidence, not pilots
The Commission's June 2026 health AI survey is a warning for SMEs: adoption now depends on evidence, data access and workflow proof.
CRA help for EU SMEs: who should own product security?
ENISA's SME CRA survey turns product security into a buying question: legal advice, tooling, assessment body or workflow builder?
Data Union help: who should EU SMEs choose?
The EU wants more AI-ready data. SMEs should choose help by workflow, not by platform label.
AI agents for SMEs: write the job description first
The OECD's 2026 D4SME survey finds SME AI adoption rising, mostly off-the-shelf. Before an agent gets autonomy, write its job: inputs, decision rights and stop rules.
Quantum security is now a procurement issue
The EuroQCI consultation closes on 24 June. SMEs do not need quantum kit yet, but they do need crypto migration evidence.
EU open source strategy: the SME test
The EU's June 2026 open source strategy gives SMEs a practical procurement test: less lock-in only matters when the software can be run.
Digital Omnibus help: who should EU SMEs choose?
The AI Act delay changes the advisory brief: EU SMEs now need a legal tracker, governance record and build evidence, not a slogan.
EU AI Act delay 2026: what moved, what SMEs still owe
The AI Omnibus moves high-risk duties to December 2027 and August 2028, but Article 50 transparency still applies on 2 August 2026. How SMEs should use the extra time.
EUROPA is a model promise, not an SME plan
The EU chose EUROPA to build a 24-language open frontier AI model. SMEs should treat it as a signal, not procurement certainty.
EU AI Act guidance 2026: the calendar is now evidence work
The Commission's 2026 guidance queue runs from high-risk classification (consultation to 23 July) to Article 50. The SME task: document systems before deadlines land.
Digital Decade 2026: the AI gap is now operational
The EU's 2026 Digital Decade report shows AI adoption rising, but SMEs still need process, data and skills before tools become capacity.
EU AI support maze: EDIH, AI Factory or build partner?
Europe's Apply AI push gives SMEs more routes into AI adoption. The hard part is choosing public support, model vendors or workflow builders.
AI content labels: who should EU SMEs choose in 2026
The EU's 2026 code turns AI content labelling into a procurement choice: C2PA tooling, model vendors, legal advice or workflow implementation.
G7 cyber warning puts AI security on the SME agenda
The G7 cybersecurity declaration turns AI security into a supplier-evidence problem for SMEs buying or building AI systems in Europe.
AI Act sandboxes move to 2027. SMEs should still watch
The Omnibus deal gives Member States one more year to open AI Act sandboxes. For SMEs, the useful work starts before the doors open.
High-risk AI Act help: lawyer, platform or build partner?
The Commission's draft high-risk AI guidance turns AI Act scoping into a buying decision for EU SMEs: legal review, governance software or implementation help.
CADA for EU SMEs: cloud, hyperscaler or build partner?
The EU's Cloud and AI Development Act turns sovereignty into a buying question. SMEs need to compare European clouds, hyperscalers, AI factories and build partners.
AI literacy for EU SMEs: course, lawyer or build partner?
Article 4 is already live, with supervision from 3 August 2026. A practical comparison of AI literacy routes for EU SMEs.
AI Act help for EU SMEs: governance platform or build partner?
Weeks before the 2 August 2026 cliff, an 'AI Act compliance' market has appeared. Which governance platform, advisor or build partner fits which EU SME.
EU AI Act Article 50: transparency duties from 2 August 2026
Article 50 still applies on 2 August 2026 despite the Omnibus. Which of the four transparency duties fall on EU SMEs, which sit with vendors, and the one date that moved.
AI Act enforcement is no longer theoretical
The Commission's new Scientific Panel and Advisory Forum do not create new SME duties, but they make AI Act interpretation and surveillance more concrete.
UK-EU AI divergence in 2026: the cost for cross-Channel SMEs
The EU has provisionally delayed its high-risk AI rules to 2027. Britain still has no AI Act. What the widening gap means for SMEs trading across the Channel.
EU AI buying is becoming an audit-trail problem
For European SMEs, the next AI bottleneck is not model access. It is procurement discipline, evidence, and operating accountability.
EU AI adoption in 2026 is a two-speed market for SMEs
Eurostat's 2025 data shows strong growth in AI usage, but adoption remains sharply unequal by company size, country, and digital maturity.
Cohere absorbs Aleph Alpha: what sovereign AI means for EU SMEs
A Canadian firm buys Europe's second-largest LLM player. Examining what 'sovereign AI' actually delivers for EU SMEs picking an LLM in 2026.
EU AI Act August 2026 deadline: what SMEs must do, what waits
Most EU AI Act obligations apply from 2 August 2026. The three SME exposure categories, realistic compliance costs — under €10k for most — and what to safely ignore.
The EU AI talent crunch in 2026: where SMEs can still find people
57% of EU firms can't find qualified tech staff. Practical paths for SMEs to source AI capability without competing on scale-up salaries.
Honest AI advisors for EU SMEs: who actually helps in 2026
Curated map of AI consultancies that genuinely serve European SMEs in 2026. Named names, real strengths and limits — publisher included, with disclosure.
Why most EU AI strategy frameworks did not survive 2026
Dozens of 2024-2025 'AI Transformation' frameworks are now retired or rewritten. What killed them, and which survived into 2026.
Coverage
Four beats. One desk.
Regulation
The EU AI Act, read line by line.
Articles 4, 6, 50 and Annex III in plain English, with EUR-Lex references. What applies on 2 August 2026, what waits until 2027, what most small businesses can safely ignore.
Market
Cost benchmarks in euros.
Project costs compared across Belgium, the Netherlands, Germany, France, Ireland and the Nordics. SME-relevant budget ranges, not enterprise quotes.
Advisors
Honest reviews of advisors.
London, Dublin, Amsterdam, Berlin, Paris boutiques and the pan-European mid-market. Same criteria for everyone, including this site's publisher.
Strategy
Post-mortems of failed frameworks.
Which 2024–2025 'AI Transformation Roadmaps' have quietly been retired, what killed them, and what replaced them in 2026.
Source methodology
How we cite, in four tiers.
-
01 · Primary
Regulations, treaties, court rulings, official journals. EUR-Lex by article.
-
02 · Official
EU institutions, national authorities, statistical bodies, regulators.
-
03 · Secondary
Firms' own pages and case studies. Used to describe firms, never as proof of figures.
-
04 · Data
Datasets and indicators (DESI, CEDEFOP, Eurostat) with dated lookup.
Every briefing lists its sources, dated by the day of lookup, with the tier shown in the margin. See an example