You are probably a deployer, not a provider
Most SMEs use AI systems built by someone else. That makes you a deployer, with lighter but real duties.
Build an AI inventory
List every AI system in use, who owns it, what data it touches and which decisions it influences.
Classify the risk
Most SME use cases — drafting, summarising, forecasting — are minimal or limited risk. HR screening, credit scoring and biometric use are high risk and need far more.
Meet the transparency duties
Tell people when they interact with an AI system and label synthetic content.
AI literacy is mandatory
Staff working with AI systems must be trained appropriately. A short, documented internal training already goes a long way.
Write it down
Policy, inventory, training log, human-oversight rules. Documentation is what an audit actually asks for.